The CRTC's Proposed Regulations
Identification Information
The proposed regulations prepared by the CRTC present a list of criteria which are to be included as part of the prescribed information which identifies a sender of a commercial electronic message (a "CEM") and the person on whose behalf the message was sent (a "Message Originator"). In addition to names and business names of both the sender and Message Originator, each CEM must include the physical and mailing address, a phone number (with access to an agent or voicemail system), web address and email of both the sender and Message Originator. A statement that the CEM is being sent on behalf of the Message Originator is also required, if applicable.
Where it is "not practicable" to include all this information in a CEM and the unsubscribe mechanism as required by the Act, this information may be provided on a web page accessible via a link included in the CEM. The prescribed information or link must be clearly and prominently set out in the CEM. The recipient must be able to access the web page by a "single click" on the link or another equally efficient method of access which is provided at no cost to the recipient. In addition, the recipient must be able to unsubscribe in no more than two clicks.
Given the various interpretations which have been given to the term "not practicable" and similar phrases like "not practical" by the courts, the CRTC's proposed regulations may lead to confusion for both businesses and their legal advisors. When in doubt, include the prescribed information directly in the body of the CEM.
Separate Consent
The CRTC's proposed regulations also include guidance on information to be included in requests for consent to send a CEM, alter transmission data, or install a computer program on another person's computer. A request for consent must include the names and business names of both the person seeking the consent (the "Consent Seeker") and the person on whose behalf consent is being sought (the "Consent User"), the physical and mailing address, a phone number (with access to an agent or voicemail system), web address and email of both the Consent Seeker and Consent User. A statement that the consent is being sought on behalf of the Consent User is also required, if applicable, in addition to a statement indicating that the consent may be withdrawn by contacting either the Consent Seeker or Consent User.
Each such request for consent will also need to be obtained separately. Furthermore, a computer program which performs any of the restricted functions described in the Act will need to be brought to the attention of the computer user separately from the request for consent. A separate written acknowledgement that a computer program performs those restricted functions will also need to be obtained from the computer user prior to obtaining their consent.
Industry Canada's Proposed Regulations
Industry Canada's proposed regulations define certain key phrases and exceptions under the Act. More specifically, the restriction on sending unsolicited CEMs under the Act does not apply to CEMs which are sent by a person, or on behalf of a person, who has a "personal or family relationship" with the recipient.
Family Relationship
A "family relationship" is defined along the same lines as what can be found in the Income Tax Act. A "family relationship" means a relationship between two individuals who are connected by blood, marriage, common-law partnership, or adoption. Interestingly, a "blood relationship" is limited to children, siblings, parents, grandparents, or collateral descendants of a common grandparent. Thus, a person could send an unsolicited CEM to her aunt (her father's sister) but could not send an unsolicited CEM to her great aunt (her father's aunt), or a second cousin, without running afoul of the proposed regulations.
Personal Relationship
In order to qualify has having a "personal relationship" with another person, the relationship must be other than in relation to a commercial activity, the two individuals must have met "in-person" and must have had a two-way communication within the last two years. In other words, an unsolicited CEM sent to a business associate could potentially be a violation of the proposed regulations.
The term "in-person meeting" is somewhat ambiguous. More and more often today, meetings happen virtually, whether it is through VoIP applications like Skype or videoconference. Industry Canada will need to clarify whether or not an "in-person" meeting means a physical in-person meeting, or whether a virtual in-person meeting would qualify under the exception. Furthermore, one would presume that the "two-way communication" required in the proposed definition of "personal relationship" must have occurred at a time other than at the "in-person meeting".
Membership in Clubs, Associations or Voluntary Organizations
Under the Act, consent is implied for the purpose of sending a CEM only under a limited set of circumstances. One such circumstance is an "existing non-business relationship". Although the Act provides certain examples of what would constitute an "existing non-business relationship", the concepts of "membership" and "club, association or voluntary organization" were left to be determined in the regulations. Industry Canada's proposal would see "membership" be defined as "the status of having been accepted as a member of a club, association or voluntary organization in accordance with [its] membership requirements."
A "club, association or voluntary organization" must be a non-profit organization which is "organized and operated exclusively for social welfare, civic improvement, pleasure or for any purpose other than profit." However, unless the primary purpose of the organization is the promotion of amateur athletics in Canada, no part of the organization's income may be payable or made available to any proprietor, member or shareholder.
Seeking Consent on Behalf of an Unidentified Person
The Act permits a person to seek out and obtain consent to send a CEM, alter transmission data or install a computer program, on behalf of an unidentified third party. For example, a company's website contact form or registration page may prompt a site visitor to sign-up to receive CEMs from the company's "partners" (i.e., third-party advertisers who likely provide compensation to the company based on the number of subscriptions they refer). The third-party advertisers may not always be a static group, as new advertisers are added to the list of partners and others are removed over time, and thus the partners remain unidentified.
Under the proposed regulations, where such consent is obtained, the person who obtained the consent ("Consent Aggregator") may authorize any person (an "Authorized Person") to use the consent on two conditions:
- first, the Consent Aggregator must ensure that they are adequately identified in any CEM sent to a consenting recipient; and
- second, the Authorized Person must, in addition to providing an unsubscribe mechanism in accordance with the Act, must permit the consenting recipient to withdraw their consent from the Consent Aggregator or the Authorized Person.
The Consent Aggregator must also ensure that they are notified by the Authorized Person of any withdrawal of consent. It will then be incumbent on the Consent Aggregator to notify all other Authorized Persons of the withdrawal of consent and ensure that effect of the withdrawal of consent is given (by both the Consent Aggregator and all Authorized Persons) no later than 10 business days after the withdrawal of consent has been made.
Impact on Business
The CRTC's proposed regulations will require businesses to pay close attention to the form and content of their CEMs. Proper identification of the sender and Message Originator is required, and must be clearly and prominently displayed within the body or the CEM. Alternatively, businesses which deem it not practicable to display this information within the CEM will need to prepare static web pages with this information clearly and prominently displayed on their corporate websites, accessible via a single-click from the CEM. In addition, the two-click unsubscribe mechanism will require many businesses to re-design their unsubscribe contact forms to a single input box for the person's email address and a submit button; one click to enter the email address which is to be unsubscribed from the sender's and Message Originator's list, and one click to submit the request to the server.
The proposed requirements for obtaining separate consent for each of the activities restricted under the Act will mean that businesses will need to develop more sophisticated consent-tracking and reporting systems.
Industry Canada's proposed regulations on seeking out the consent on behalf of unidentified third parties will require businesses to review their contractual arrangements with their third-party advertising "partners" to ensure that adequate notifications are made upon a withdrawal of consent, and effect is given to such requests in a timely manner.
Social media marketers will need to pay close attention to the definitions of personal and family relationships, to ensure that they are not running afoul of the regulations. In addition, Industry Canada also identified "forward to a friend" features as a potential sticking point for businesses. The burden will now be placed on website owners to ensure that they are not inciting their website visitors to forward their website content or links to persons who fall outside the proposed definitions.
The proposed regulations of both the CRTC and Industry Canada are open for comment until September 7, 2011. If you wish to make any submissions to either the CRTC or Industry Canada, we would be happy to assist you in their preparation.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
