On Dec. 22, 2010, the House of Commons passed Bill C-28 which aims to regulate unsolicited electronic commercial messages, commonly called "spam." Normally, this act will come into force by proclamation in at the end of fall 2011.
When in force, this act will require Canadian individuals and companies, as well as foreign individuals and companies sending commercial electronic messages to Canada, to obtain the prior consent from recipients before sending them commercial electronic messages. The law shall also require certain formalities such as the requirement to include an exclusion mechanism in all messages. The requirement of prior consent shall be substantially more restrictive than the one contained in the equivalent U.S. law (CAN SPAM Act) which only requires companies to stop sending electronic messages if the recipient manifests its refusal to receive them ("opt-out"). Please also note that the law does not distinguish between legitimate messages and malicious messages nor between individual and bulk messages; they all require the prior consent of the recipient, consent which cannot itself be sought by a commercial electronic message.
Despite the presence of several exceptions in this law that can soften its scope, such as existing business, private or family relationships with the recipient, the fact remains that this legislation will have a significant impact on the business of all persons using electronic messages to promote their activities or to enter in contact with past or prospective clients. For example, existing mass mailing lists will need to be purged of all contacts for which the company is unable to prove consent or an exception.
The consequences of not respecting the new Bill C-28 shall be very important. Indeed, the CRTC, the agency responsible for enforcing this law, may investigate and institute penal proceedings and impose fines of up to $10,000,000 dollars. The law also provides a private right of action, unusual in Canada, for recipients of unsolicited commercial electronic messages. I believe that this private right of action, which can be exercised as a class action, will pose a serious threat to large corporations who, if not compliant with Bill C-28, could be targeted by opportunistic plaintiffs seeking to collect the $200 per infraction per plaintiff statutory penalty provided for by the law.
Since the adoption of the law in December 2010, the CRTC and Industry Canada published in July 2011 two regulations clarifying some of the obligations and exceptions contained in the law.
Faced with this significant risk, I believe that proactive measures need to be implemented by Canadian and foreign companies doing business in Canada to prepare for the entry into force of the law. U.S.-based companies sending commercial electronic messages in Canada will need to be especially careful since complying the U.S. CAN-SPAM Act is not sufficient to comply with the upcoming Canadian law. This risk increases for U.S.-based companies who have assets in Canada as enforcement of fines and penalties will be facilitated.