0. CASL Compliance & Enforcement Update
2016 IT.CAN Annual Conference
Montreal| October 24, 2016 | David Elder

1. CASL Agenda CASL 101 Complaints Enforcement Actions: CRTC
Privacy Commissioner of Canada
Competition Bureau
Lessons Learned – investigations & undertakings
Record-Keeping Tips

2. CASL 101: Review of Key Requirements

3. CASL in a Nutshell Commercial Electronic Messages
Prohibits sending commercial electronic messages without express consent
Some exceptions
Installation of Computer Programs
Prohibits the installation of a computer program without express consent
Some exceptions
Alteration/Rerouting
Prohibits the alteration of transmission data or rerouting of messages without express consent

4. Enforcement
AMPs for “violations” (Up to $ 1 M individual, $ 10 M corporate)
Undertakings
Public shaming
Registration with court – enforced as contempt
Injunctions, Restraining Orders
Offences
Private right of action
Preservation demand
Notice to produce
Search warrant

5. Investigation & Enforcement
CRTC has been active with respect to enforcement/investigations re CEMs and alteration of transmission data
Tools:
Preservation demands
Notice to produce
Warrants
“Honeypots”
For computer programs, initial focus on malware/botnets?

6. Complaints
CASL

7. Complaints Spam Reporting Centre up and running
CRTC has received approx. 710,000 complaints as of September 30th
Bulk of these were forwarded to
Fewer filled out online form, provided details
Believed vast majority of complaints re commercial electronic messages (not installation of programs, alteration or rerouting)

8. Enforcement Actions
CASL

15. Other investigation/enforcement models
Preservation/Production Order
Entry Warrant (with Police) - seizure
Direct Issuance of NOV
Right to make representations to CRTC
Commission decides on b.o.p. whether violation committed
May impose NOV penalty, may reduce or waive penalty, or may suspend payment of penalty subject to any conditions necessary to ensure compliance

18. Privacy Commissioner Action
CASL

20. Compu-Finder
Address harvesting, but also consent (Principle 4.3, s. 7)
Personal information/business contact information
Collection of addresses
Telemarketing – no disclosure that purpose for collection was marketing
Websites – collected where notices said not to be used for commercial purposes
Evidentiary and accountability issues
Errors in responses

21. PIPEDA lives! “The relevance of CASL
In its representations, Compu-Finder referred to provisions of CASL relating to the sending of commercial electronic messages, and regulations made thereunder, as justification for its practices. In our view, these provisions, while similar in some respects to those found in the Act, are not directly relevant to our investigation, which was focused on Compu-Finder's compliance with PIPEDA. We have therefore not considered such provisions further in our analysis, except with respect to the amendments CASL made to the Act regarding address harvesting.”
Compu-Finder findings, paragraph 114

22. Competition Bureau Action
CASL

24. Investigations and Undertakings
CASL

25. Anatomy of a typical investigation
Request for information
Response
Follow-ups and Response (repeat as necessary)
Invitation to discuss findings/settlement
Agreement
Review and finalization of undertaking agreement
Execution
Payment of AMPS
Media release

26. Typical CRTC Undertaking
Applies to broader corporate family
Agreement to comply in future
Agreement to cease offending practice(s)
Payment of AMP
Creation/update of corporate compliance program
Confirm when done
Review on annual basis – provide written report on request
Note CRTC practice is to register agreements with Federal Court – can be enforced as if order of the Court

27. Typical OPC Compliance Agreement
List of OPC findings
Acknowledgement/no admission
List of agreed to remedial measures
Reporting, monitoring obligations – 3rd party report?
Notice that OPC may request further info, visit premises, go to Fed Ct
Organization to pay costs of compliance
Publication
Info session?

28. Record-Keeping Tips
CASL

30. Record-keeping tips
All evidence of express and implied consent (audio, forms, electronic forms
Date, time, originating telephone number/IP address, etc.
Best evidence rule: CRTC prefers direct evidence; organization-created record likely insufficient
All unsubscribe requests and resulting actions
Documented methods through which consent collected (particularly important where oral consent)
Documented CASL compliance policies and procedures, including training

31. Lessons Learned
CASL

32. Lessons Learned May help to revise practices quickly (or may not)
Only partial disclosure of case against you
Complainants assumed to be truthful– onus on company to disprove
Some have settled where not clear violation committed
Predilection for AMPs
Unclear what weight, if any given to due diligence
Unclear how AMPs calculated
Warrants are intense, disruptive – watch privilege issues closely
Warrants most likely re malware investigations
Beware continuing application of privacy laws

34. David Elder delder@stikeman.com
Questions & Answers
David Elder