By Barry Sookman and James Gannon
In May of this year, we sent an e-Alert that reviewed the concerns many Canadian businesses had expressed with the first draft of Bill C-27 – the Electronic Commerce Protection Act (ECPA). The Bill was criticized for containing overly broad anti-spam and anti-spyware provisions that would have rendered illegal many common legitimate commercial practices. It would have potentially exposed businesses to millions of dollars in fines and liabilities for activities that were unrelated to sending spam emails or installing spyware programs.
Since then, officials at Industry Canada and MPs on the Standing Committee on Industry, Science and Technology (INDU) have made substantial amendments to the Bill to address the concerns raised by Canadian businesses. However, some problems remain.
Amendments to the ECPA
The INDU Committee completed its clause-by-clause review of the ECPA on Monday, October 26. Among the amendments recommended by the committee:
• The spam provisions will not extend to electronic messages that (a) provide a quote or estimate; (b) facilitate, complete or confirm an existing commercial transaction; (c) provide warranty information; (d) provide information related to an ongoing subscription, membership, account or loan; (e) provide information related to an employment relationship; or (f) deliver a product, goods or a service, including product updates and upgrades.
• The spam provisions will also not extend to messages sent to a published e-mail address, where the message is relevant to the person’s type of business so is not considered spam.
• The anti-spam laws will now only apply to messages that are sent or accessed from within Canada. Messages that are merely routed through a Canadian server will not be subject to the Bill.
• The disclosure requirements for the installation of computer programs were changed from describing the “function, purpose and impact” of the program to simply the “function and purpose.” However, if a program performs certain undesirable functions, it must bring their foreseeable impacts to the attention of the user. The prescribed list of undesirable functions is similar to those found in international anti-spyware law precedents.
•The anti-spyware law was also amended to create exceptions for software updates, upgrades and patches.
• The maximum damage award for a contravention of the anti-spyware provision was changed from $200 per contravention to $1 million for each day on which a contravention occurred.
• Transitional provisions were included so that businesses have up to three years to obtain consent to send messages from existing business contacts. Similarly, if a computer program was already installed before the ECPA comes into force, the user’s consent to updates and upgrades can be implied for up to three years.
While these amendments would alleviate a number of concerns that were expressed with respect to the ECPA, a key amendment to Section 78 that had sought to preserve the ability to collect personal information to investigate breaches of law was not adopted by the Committee.
Under the original draft of the Bill, PIPEDA would have been amended to make it illegal to collect “personal information, through any means of telecommunication, if the collection is made by accessing a computer system or causing a computer system to be accessed without authorization.” There were no exceptions to this prohibition.
Business groups such as the Canadian Chamber of Commerce, ITAC and others were concerned that the new prohibition was not subject to the usual PIPEDA exceptions, including the exception that permits the collection of personal information for the purposes of investigating breaches of an agreement or the contravention of a federal or provincial law.
The business community was worried that s.78 could have been construed to prevent the collection of personal information over the Internet to investigate contraventions of law including: fraud such as bank, insurance, and credit card fraud; money laundering, securities violations, theft, misappropriation, or unauthorized use of confidential information/personal information; violations of business practices legislation; defamation; workplace-related sexual harassment; computer hacking, including committing the criminal offences associated with theft of telecommunications services, making unauthorized use of a computer, or mischief in relation to data; identity theft or impersonation; and violations of copyright by peer-to-peer networks and other infringers.
The government had tabled amendments to fix this potentially serious flaw in the Bill, however, during the final day of Committee hearings, the government withdrew its proposed amendment and the flawed bill is being sent to Parliament for Third Reading. If the proposed amendments are not made before the Bill becomes law, there could be serious implications for private and public law enforcement in Canada.
Bill c-27 will now go to the Senate before becoming law. It will have major implications on software licensing practices as well as on how businesses collect and use personal information in their electronic communications. Since the Bill will become law soon, it is essential that businesses review their practices concerning sending electronic messages, their privacy policies, and software licence and maintenance agreements to ensure compliance with the ECPA.