The bulk of Canada’s anti-spam law, known colloquially as CASL, came into force on July 1, 2014. CASL sets out strict rules for a variety of online behaviours and is considered the strictest anti-spam law in the world, providing for administrative monetary penalties (AMPs) of up to $1 million for individuals and $10 million for other persons. CASL is jointly enforced by the Canadian Radio-television and Telecommunications Commission, the Competition Bureau and the Privacy Commissioner of Canada, and since its inception there have been prosecutions and undertakings (a form of voluntary settlement available to preclude further action) resulting in AMPs or settlements ranging from $15,000 to $1.1 million. On July 1, 2017, the stakes will be raised even higher if, as currently scheduled, sections 47 through 51 and section 55 of CASL come into force. Section 47(1) provides for a private right of action for

• sending non-compliant commercial electronic messages (CEMs) (section 6, CASL);
• altering transmission data in an electronic message without consent (section 7, CASL);
• installing computer programs on another’s system without consent (section 8, CASL);
• aiding, inducing or procuring any of the foregoing (section 9, CASL);
• contraventions of the prohibition in the Personal Information Protection and Electronic Documents Act (PIPEDA) against harvesting of electronic addresses using computer programs;
• the collection of personal information by unlawfully accessing, using or interfering with computer systems under PIPEDA; and
• sending or causing to be sent false or misleading representations in an electronic message (section 74.011 of the Competition Act). (See “Watch This (Email) Space: New Private Right of Action for Misleading Representations.”)

Section 52 of CASL provides for the personal liability of directors and officers of a corporation if they directed, authorized, assented to, acquiesced in or participated in any of the above violations. As well, employers have vicarious liability under section 53 of CASL for the actions of their employees acting within the scope of their authority. While all of the offences and the AMPs have existed since 2014 (or January 1, 2015, in some cases), what is new is the private right of action, which as of July 1, 2017, allows individuals to sue both corporations and their directors for alleged violations that were previously policed only by the regulators, together with the coming into force of section 55, which provides that where there is more than one defendant, the liability is joint and several.

The private right of action contemplates compensatory damages for actual loss or damage suffered or expenses incurred, as well as non-compensatory or statutory damages. The statutory damages include $200 for each contravention relating to CEMs, to a maximum of a $1 million per day, and $1 million per day for contraventions of the prohibitions against alteration of transmission data (transmission hacking), installation of computer programs, unauthorized computer downloads, email harvesting and unlawful personal information collection, and for reviewable conduct under the Competition Act in respect of misleading emails. It is this availability of statutory damages without regard to whether actual loss has been suffered that represents a potential incentive for both individual and (more likely) class actions in respect of these types of statutory breach. Section 51(2) of CASL states that the awards of statutory damages are intended not as punishment but rather to enforce compliance, so it is an interesting question whether the private right of action and statutory damages will promote compliance by providing a greater incentive for defendants to enter into undertakings with the regulators or will prove to be a big boot to allow the class action bar to kick defendants and take the regulatory burden off the regulators. The interplay between the voluntary settlement/undertaking provisions of CASL and the private right of action is informative: if a defendant enters into an undertaking with the regulator of CASL, that defendant cannot also be subject to statutory damages. The defendant can, however, be subject to a claim for actual loss or damage.

There are defences available against a claim of contravention, as well as statutorily prescribed considerations that could mitigate damage awards. The better course of action for those businesses that may be subject to a regulatory action or a private right of action is not to wait and find out how those untested provisions play out in a court proceeding but instead to review their practices and ensure that they are in compliance with CASL and the related provisions under PIPEDA and the Competition Act.

The Canadian Bar Association and other industry associations have made submissions to the government suggesting that implementation be delayed until after the statutory review of CASL has been completed. To date there has been no indication as to whether the government is amenable to such a delay.