Industry Committee on Oct. 7th, 2009

[The Chair, Conservative, Michael Chong]

Order.

Good afternoon, everyone.

We're here to conduct meeting 36 of the Standing Committee on Industry, Science and Technology. The meeting is pursuant to the order of reference of Friday, May 8, 2009, concerning Bill C-27, the anti-spam bill, otherwise known, in its short form, as the Electronic Commerce Protection Act.

Welcome to all of you, members of the committee and our three witnesses today.

From the Department of Industry, we have Madam Janet DiFrancesco, director general of the electronic commerce branch.

Welcome.

We also have Mr. Philip Palmer, senior general counsel of legal services at Industry Canada, and

Mr. André Leduc, Policy Analyst, E-Commerce Policy.

Welcome, everyone.

Before we begin with an opening statement from officials, I want to wish Mr. Van Kesteren a happy 54th birthday today.

[Voices]

Hear, hear!

[The Chair, Conservative, Michael Chong]

In our mother tongue, we say, hartelijk gefeliciteerc.

So happy birthday to you. I just heard about it; I wish you a good day today.

Without further ado, we'll begin with a 10-minute opening statement from officials.

[Janet DiFrancesco, Director General, Electronic Commerce Branch, Department of Industry]

Thank you, Mr. Chairman.

I'm pleased to be here today as the new director general of the electronic commerce branch at Industry Canada, having recently replaced Richard Simpson, who appeared alongside Minister Clement and Assistant Deputy Minister Helen McDonald in June.

As you indicated, I'm joined here today by our legal counsel, Philip Palmer, and from my staff, André Leduc.

Industry Canada has made a commitment to increasing confidence in the digital economy, to clarifying the rules of the domestic and international markets, promoting the adoption and use of e-business and eliminating barriers to the use of e-business. The electronic commerce protection bill represents an importing step in achieving these objectives. Our department is pleased with the support this initiative has received in the testimony and briefs that have been submitted to the committee.

It is no surprise that there has been such interest in this legislation, as the Internet is now the communications platform of the emerging economy. ECPA is about more than just the nuisance of spam; it is about malicious and detrimental activities that dissuade Canadians and Canadian businesses from taking part in the online marketplace.

I should note that ECPA could not have been drafted without the important work of the task force on spam and their recommendations, as well as the experience shared with us by global partners, specifically New Zealand, Australia, and the United States. By working closely with these counterparts, Canada has drafted world-leading legislation based on the best and most effective aspects from legislative initiatives from around the world.

Spam and on-line threats come from both inside and outside Canada. The current bill contains important provisions designed to protect Canadian consumers and businesses from the most dangerous and harmful types of spam and will introduce a regulatory system that will protect the privacy and personal safety of Canadians in the on-line environment. The bill will include a set of clear rules that will benefit all Canadians and that will increase their trust in on-line communications and electronic business.

I would like to take this opportunity to address a couple of the common misperceptions about the legislation.

The committee has heard a number of witnesses express concern about the consent regime. It should be noted that there is no time limit to express consent. Once an individual has provided express consent to a person, the consent can only end when the individual opts out or unsubscribes. The 18-month period with respect to existing business relationships allows companies to imply consent in order to give them time to obtain the individual's express consent.

Secondly, with regard to the private right of action, some witnesses have indicated that they do not see a need for it. We believe this provision provides an important mechanism that will allow individuals and groups of individuals to pursue violators and enable telecommunications service providers and Internet service providers to pursue those who threaten their networks. It would, for example, enable a bank or financial institution to take civil action against phishers who falsely impersonate their organizations in an attempt to defraud their customers.

Mr. Chairman, we have examined the concerns expressed before your committee and have prepared motions respecting a number of them. At Mr. Lake's request, we have distributed to all members an annotated version of the bill indicating the amendments proposed by the government. More than 40 amendments are planned, a number of which are of a technical nature.

Our purpose is to strengthen confidence in online commerce, and the opportunity for public comment presented by the committee's study of Bill C-27 has been most helpful. Of all the areas discussed, those that provoked the most comments were those relating to the perceived breadth of the legislation and the requirements respecting express and implied consent. We considered these concerns carefully, and amendments are being proposed to better focus those provisions that were considered too broad.

In brief, the amendments deal with the definition of commercial electronic messages, existing business relationships, business-to-business relationships, third party referrals, and the installation and update of programs and applets.

First, with regard to commercial electronic messages, we recommend expanding the range of situations in which the sending of e-mails is excepted from the requirements of express consent. For instance, correspondence in reply to an inquiry is clearly exempt, as would be ongoing correspondence relating to insurance policies, warranties, subscriptions, and other longer-term relationships.

Secondly, amendments have been drafted concerning existing business relationships. For example, for those relationships that are in effect prior to the act coming into force, a transitional or grandfather clause will extend the implied consent regime for a period of 36 months to allow commercial entities time to contact existing clients and obtain their express consent for future communications. Similarly, we have clarified by way of proposed amendment that the 18-month period concerning an “existing business relationship” referred to in subclause 10(4) commences on the date that the subscription, membership, account, or loan has been terminated, as opposed to the beginning of that relationship.

You will also find an amendment that clarifies that in the instance of the sale of a business, the purchaser is deemed to have an existing business relationship with the seller's clientele.

In the context of business-to-business relationships, we have suggested expanding implied consent to encompass the conspicuous publication of an electronic address, such as on a website or in a print advertisement. In these circumstances, the sender's message must relate to the business or office held by the recipients. Implied consent would also be extended to cover situations where it is reasonable to believe that consent has been given—for instance, in giving out a business card or providing an e-mail address in a letter.

We have recognized the importance in certain industries of being able to contact referrals through e-mail and have drafted an amendment to this effect. In the document before you, you will find a provision permitting under certain conditions unsolicited commercial messages that are follow-ups to third party referrals.

In terms of consent to installation of computer programs, you will find proposed amendments to clarify that automatic updates—for example, daily or weekly updates to anti-virus software—will not require consent for each update as long as this is set out as part of the original contract under which the software was installed.

Similarly, you will find that there are proposals to ensure that running applets such as JavaScript or Flash programs will not require express consent each time they are run.

Last, during witness testimony, a suggestion was made to have the administrative monetary penalties, or AMPs, provision amended to provide further assurance that companies that make an honest mistake will not be subject to heavy fines. It has been suggested that the CRTC be given the capability to suspend AMPs for a specified period of time, and that if the business does not violate the act again during that time period, the AMP could be lifted. As a result, we propose that clause 25 be amended to indicate that the CRTC has the ability to reduce, suspend, or waive an administrative monetary penalty.

I want to thank you for your review of the Electronic Business Protection Act. We are convinced that this work will result in healthy regulation and that the bill will take into account the interests of businesses and consumers in an equitable manner.

We welcome the committee's questions. Thank you.

[The Chair, Conservative, Michael Chong]

Thank you, Ms. DiFrancesco.

We'll have about one hour and 40 minutes to listen to questions and comments from members of this committee, beginning with Madame Coady.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

Thank you very much.

Thank you for appearing before us again today, and for sending out the information yesterday, and for giving a good discourse of what your proposed changes are. So thank you for listening.

I have a couple of comments and questions based on some of the testimony that we have heard over the last number of months with regard to this legislation.

The first question gives us an opportunity for you to discuss when you were reviewing the scope of the bill. We heard a lot of discussion over the last number of months that the scope of the bill was a bit too broad, that we needed to narrow the scope further. There were some suggestions brought forward on how to do that. Could you perhaps give us your rationale on how you actually looked at narrowing that scope and what exactly you've done? That's my first question.

[Janet DiFrancesco]

By way of clarification, are you referring to the scope of the opt-in--

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

The definition.

[Janet DiFrancesco]

Oh, to the definition of an electronic commercial message. Maybe I'll respond and then I'll turn to André to fill in any blanks.

I would say that in terms of the definition of electronic message, I'm not sure that we've narrowed the scope, but what we've tried to do is refine very carefully what is an electronic message and what isn't. For greater certainty, we've added a number of provisions to indicate that, for instance, an electronic message that provides a quote that was requested by the client would not be covered. We've clarified that warranty information or product recall information as a follow-up would also not be covered. Those kinds of clarifications have been added to the legislation.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

Some have come before us who have suggested that the scope of the definition should actually look at fraudulent activity or malware.

[Janet DiFrancesco]

Oh, okay. My apologies.

[André Leduc, Policy Analyst, E-Commerce Policy, Department of Industry]

I guess it gets to the point of the legislation, which is how one would define what is malicious and what is not malicious. Basically, the idea behind this piece of legislation is that it is a compliant regime, designed to encourage compliance with the rules set out in the legislation. The application, both in terms of the way it's drafted here and in principle, is on all commercial activities. Non-commercial activity is ultimately not falling under the application of the act.

The idea there was that spammers don't necessarily choose which line of business they're focusing on, and if we didn't have something that applied to everybody equally, any gaps would be taken advantage of by those who have the intent to spam or defraud Canadians.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

One of the criticisms we heard was that because the scope was so broad, you're capturing a wide net; you're not only looking at malware, you're looking everywhere. Now, if you look at some of the others, such as the New Zealand spam act or the Australia spam act, the legislation applies to a defined list of commercial electronic messages that relate to direct marketing, for example. Could you comment on why you chose to do it, as you said, rather narrowly versus broadening it out? I'm sure when you listened to some of the witnesses who came before us, you gave some further consideration to that.

[André Leduc]

Well, we did our homework in terms of direct marketing, and we spoke to our colleagues in New Zealand and Australia when we were developing the legislation. In fact, most of the definitional aspects of the legislation were taken directly from the Australian and New Zealand models. The scope of their legislation isn't limited to direct marketing; it applies in almost the exact same manner as this legislation would. Our definition of electronic address and commercial electronic message is almost verbatim what appears in the Australian and New Zealand models.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

Thank you.

I have two other questions, and one is on consent. We heard a number of people before us who thought that the consent provisions were far too narrow and went beyond what the international community did, and even went beyond how PIPEDA and the spam task force defined their implied consent, for example, where consent may reasonably be inferred from the action or the inaction of the individual.

You've mentioned that you made a few changes to consent, and I'd like you to further expand on that because we are going to have a lot of people who are concerned about implied and expressed consent.

[André Leduc]

We're heading down the street of having specific definitions for express consent and implied consent, and trying to create a model for implied consent under the existing business relationship and the existing non-business relationship and the other factors we've set out here, partly because it was suggested to us by our colleagues internationally, where they've been running into some problems in their proceedings.

When it comes time to serve notice of violation, the hearings become more about whether consent can be reasonably or unreasonably inferred. Most of the focus is on whether it was reasonable or not. It was suggested to us by them that we should be able to focus on this. I think we've done a fairly good job of putting up a clear mandate on what you can do for express consent and applied consent. They fall under these specific rules. We've allowed ourselves a small gateway, where we think there might be a mistake in this framework, to add circumstances and regulations.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

I'm going to move to another question on TSP exemptions and routing. You've made a small change to that area. Could you explain that change to the TSP exemptions? Of course that was one of the critical pieces for BlackBerry.

[André Leduc]

Which section are you looking at?

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

This is under subclause 8(2).

[André Leduc]

Philip might be better able to provide the rationale for this. The one under subclause 8(2) is just a technical amendment to clarify that the person is in Canada when they give the directions.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

So this would get rid of the concern expressed about having, for example, a person in New York and person in Los Angeles routing through BlackBerry.

[André Leduc]

It's not for that at all.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

So you haven't made that change.

[André Leduc]

No. The jurisdictional scope of the legislation is for communications sent to Canadians or to Canada, sent from Canada, or routed through Canadian networks.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

So you did not broaden the definition of TSP.

[André Leduc]

No.

[The Chair, Conservative, Michael Chong]

Thank you very much, Madam Coady.

Thank you, Monsieur Leduc.

Monsieur Bouchard.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

Thank you, Mr. Chairman.

Thanks as well for being here this afternoon.

Pardon me for being late. I was used to always going to Room 308, where I went and saw that you were in another place.

First, I have examined your document in broad terms and seen that the observations and requests made by the businesses that have testified before us do not seem to have been considered.

I want to raise one point. I'd like to have an explanation from you of this option that businesses would have of sending e-mails without obtaining prior consent.

Could you tell me why this is the case? Because in the testimony and hearings we've had, a number of business representatives said that, since the purpose of this bill is to promote electronic business, among businesses, obtaining consent should be necessary.

Why have you not accepted those demands?

[Philip Palmer, Senior General Counsel, Legal Services, Department of Industry]

In my opinion, we've brought in major amendments in response to industry concerns, especially in two areas. First, there is the sending of messages between businesses in the course of business operations. On that point, we've advanced the idea of open publication of e-mail. This enables the business to send an e-mail concerning the function of the person who receives the message.

Second, we agreed that an exchange of business cards is enough to allow a message to be sent from one business to another, perhaps even to a consumer. We've also responded to concerns, mainly from Desjardins and the investment industry, concerning third-party referrals. We've made sure that a business can, in accordance with certain rules, send an initial e-mail to obtain consent enabling it to maintain a link with an individual or another business.

I think we've responded quite well to the concerns of businesses.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

You mentioned Desjardins. Those people suggested the possibility that an e-mail could be sent without first obtaining consent. They were talking about one time here, about the possibility of sending one e-mail. I don't believe you considered that request.

[Philip Palmer]

Yes, it was carefully considered. It was in the context of the very basis of the act. In that case, the problem was what's called a freebie. Technically, a spammer can very well send only one e-mail, but address it to a number of businesses, companies or sectors. It's technically easy to avoid this opening. Consequently, we decided instead to permit the initial e-mail in limited circumstances. We also opted for a relaxation of the rules concerning implied consent.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

Let's suppose I get an e-mail from a business offering me services. The bill provides for a 10-day time frame. Submissions were made on that point. People said that was too short. However, I haven't seen any observation or remark proposing that the time period during which someone can consent to the sending of other information by a business be extended.

[André Leduc]

I want to be sure I clearly understand your question. Are you talking about a case in which you would like to tell a business that you no longer want to receive e-mails from it? Then we're talking about the number of days the business has to take the necessary steps to meet your request.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

Indeed.

[André Leduc]

We carefully considered that question. In the context of the committee, there was talk, concerning the Do not call list, of a 31-day time frame to respond to that request. We made a minor change. As you can see, the bill now refers to 10 working days. The idea was to grant 10 days. However, that time frame was very limited, especially for small and medium-size businesses, in view of staff leave, holidays and absences on weekends, and so on. So we opted for 10 working days, which in fact amounts to a time frame of 14 to 16 days, including holidays.

[The Chair, Conservative, Michael Chong]

Thank you, Mr. Leduc.

Thank you, Mr. Bouchard.

Now we'll go to Mr. Lake, but before we do, I want to thank the parliamentary secretary for working with the minister's office and the department in getting these proposed amendments to the committee members.

You should all have a copy of this spiral-ringed binder, which contains the government's proposed amendments in red-lined text so it's clear which amendments the government is proposing.

I want to thank you for doing members the courtesy of distributing this to all members. Thank you for that effort and for that work.

Mr. Lake.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

You're welcome, Mr. Chair.

To the witnesses, thank you for being here today.

I just want to focus, if I could, for a moment on this opt-in versus opt-out, because there seems to be a philosophical divide among proponents and opponents--maybe not of the whole bill, because most people are in favour of the bill, but of certain sections of the bill, based on opt-in versus opt-out. I want you to correct me if I'm wrong. I have a scenario for you.

Whether you opt in or opt out, the scenario starts with a transaction that occurs at some point between a consumer and a company. Right at that point, there's a divide. There's the marketing strategy, I guess, that would be undertaken under this legislation, and then there's the marketing strategy that would be undertaken under an opt-out regime.

Under the opt-in regime, it seems as though the marketing strategy would be for the company to clearly indicate a choice in some form, on a form, for whether customers want to receive more information from the company itself or its partners. It seems like the marketing strategy would be to try to persuade the customer, the consumer, to say yes to that.

I would think that if you're doing an electronic transaction, you'd probably actually require the customer to answer yes or no. I mean, that would be a logical marketing strategy and a good strategy if you're a marketer. I come from a marketing and sales background, so I'm trying to think about the way I would approach this. It seems to me under that this option we have a fairly transparent marketing strategy there.

Under the opt-out regime, it seems to me that you would, from a marketing strategy--I would be doing this--probably try to have a form that's long enough so that nobody reads through the whole form, and then you would hide the option to opt out somewhere within that form--

[Voices]

Oh, oh!

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

--so that no one opts out. From a strategic sampling, it seems as though that would make sense so that you can keep your list of available people you can e-mail as long as possible.

Both of those would be legitimate marketing strategies, given the appropriate circumstance. Do I have anything wrong in terms of what this legislation entails versus what an opt-out legislation might entail?

[André Leduc]

I think you're dealing specifically with a set of circumstances, whether the check box is ticked or whether it's not ticked. You get right down to the basics. The American model is an opt-out model, whereby nobody has to have prior consent or permission to send out any commercial electronic message at any time. The opting out is that unsubscribe mechanism. So every time I get an e-mail, I have to unsubscribe for it. And if there are 300 million businesses, they each get a shot at me, and I have to unsubscribe every single time. A “you can spam” act is basically what it turned out to be. In fact, many groups within the United States that are trying to protect the citizens are saying don't unsubscribe, because all you're doing is giving effect to your e-mail address. If you're confirming your e-mail address, then you're just going to be bombarded even more. That's the opt-out strategy.

The opt-in strategy is already under way. The Canadian Marketing Association appeared here. Most industry best practice is when we're getting your e-mail address. One, how are they getting the e-mail address? I'm writing it on a sheet of paper at the point of purchase, here it is. And in that form, when I'm writing my personal information in there and I'm writing in my e-mail address, it should state why you're collecting the e-mail address and what you intend to do with it. So if you intend to send me e-mails about products or services at that enterprise, and I'm filling in my e-mail address, that's express consent.

The question we should always ask ourselves before we go all over the place is, how are they collecting my electronic address? If I'm giving it to them, well, it's at that point where they should say, “Is it okay if we contact you or have partner organizations contact you to offer you a better deal the next time you rent a car?” And that's the idea here. For a legitimate, responsible enterprise, when they're collecting that address, it's to get my consent to send me further e-mails, to use this electronic communications vehicle as a preferred method to contact me. Because yes, it is the cheapest method to contact clients, whether they're prospective or existing.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Actually, setting aside the issue of all of the malicious actions that this act would prevent, I want to talk about the “legitimate” business e-mails that people would send. A lot of people have talked about that.

Is there any idea now of the volume of e-mail out there that business is using and the direction that volume of e-mail is going in, and maybe the cost, in terms of bandwidth, that this e-mail has?

[André Leduc]

Well, we have measured within our borders and around the world what percentage of all e-mail traffic is spam, and estimates vary, with between 75% and up to about 92% or 93% being garbage. So 90% of traffic is garbage that we're either having to filter through or it's getting into your inbox.

But in terms of whether businesses are using this as a tool to increase productivity, yes, at Industry Canada we've done studies on using e-business applications, having a website, automating a bunch of processes, and what type of impact this has on the company's bottom line; and it's impressive, to say the least. Automating business processes.... You know, the folks around the table here were saying it's so much cheaper to send an e-mail than it is to print something and ship it over mail, which is not environmentally friendly. Well, yes, all of that holds true for all electronic commerce, all e-business applications. The productivity gains are unbelievable.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

There has been some talk about the broadness of the bill, and I understand where people are going, that maybe there are risks of having a bill that's too broad. I'm not convinced, in terms of the opt-in and opt-out arguments, but there are measures within the bill to make changes using the regulations, am I correct? If there's an area that someone looks at and says, “You know what, that's not quite the effect we meant to have”, can there be changes made through regulation so as to not have to come back to the House of Commons and through this process again?

[André Leduc]

Yes, in many of the clauses within the bill, and then more clearly under clause 63, you will see that the Governor in Council has the capacity to make regulations regarding certain aspects of the bill, and then generally, for the proper functioning and application of the legislation. So it does appear under a number of clauses, but then more clearly, those clauses are all linked back through clause 63.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Thank you very much.

[The Chair, Conservative, Michael Chong]

Thank you, Mr. Lake.

[Philip Palmer]

Could I make a supplemental observation on that?

The regulatory powers we have asked for have all been within the context of the ability to expand and ease what otherwise might create difficulties for legitimate activities. The opposing theory is that every time a new evil arises, you make new regulations and cover it that way. But speaking as counsel to a government department who has been functioning for 30 years in the public service, I can assure you that an enforcement regime where you're chasing the evil rather than covering things and letting the good guys out is by far the easier and cheaper enforcement approach. I think it is easiest for industry as well, once they get used to the rules of the game.

[The Chair, Conservative, Michael Chong]

Thank you very much, Mr. Palmer and Mr. Lake.

Mr. Masse.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Mr. Chair.

Thank you for being here.

With regard to your amendments, the first one in particular, I want to make sure the following is correct. If a company I'm doing business with right now has an insurance policy, can they then continue to send me information on things other than, say, my insurance policy or warranty? Or does it have to be specific to the product I've purchased and the relationship I have?

[Philip Palmer]

It is specific to the relationship you have. We've used the word “solely” here, so that it is solely information about the relationship you have.

[Brian Masse, NDP, Windsor West, ON]

Okay, so if I had a subscription to a magazine, they couldn't send me other magazine subscriptions from their company related just to the one subscription I have?

[Philip Palmer]

That's right.

[Brian Masse, NDP, Windsor West, ON]

Okay, thank you.

With regard to number two, can you maybe give the reason for the 36-month grandfathering? That seems like a long time; it's three years. I'd like to learn the reasoning behind a three-year timeframe for a business to adjust, especially in this day and age.

[Philip Palmer]

I think you are right as far as businesses go, although you must remember there are a lot of small businesses that haven't automated their e-mail lists and those kinds of thing. So it does give people time, and presumably it will even out the demand for tech services somewhat.

The other concern was that this covers, of course, other people who may be sending commercial electronic messages, people such as your university alumni association, or your humane society that you support and that's selling chocolates or T-shirts to help raise money for a new kennel or something else. These people would also be caught in regard to these activities, and they are less apt than commercial enterprises per se to have the technological sophistication. So this gives what we thought was a reasonable time for the more disorganized organizations to get their acts together.

[André Leduc]

If I could quantify that, the 36-month transitional period only applies to existing business relationships and existing non-business relationships. So there is a quantification there. The burden of proof is still that you must have had that existing business relationship—if it's your real estate agent three years ago, for example—and we're just giving them that 36-month transition period to catch up so they are not caught off-guard by the legislation.

[Brian Masse, NDP, Windsor West, ON]

Could we not have a different categorization for small business, and also for not-for-profit organizations?

[André Leduc]

We haven't done that anywhere in the legislation. The legislation applies to commercial activity. It doesn't matter whether you're a political party, a religious group, a charity, or Sears; it's the activity that people are engaging in that we're saying you have to get express consent for prior to this.

So we haven't done it anywhere else. There hasn't been much discussion to that effect—

[Brian Masse, NDP, Windsor West, ON]

But is possible.

[André Leduc]

Yes, it is possible, but where do you cut off the line? What's a small business? Is it 50 people or 500? What if it's a small manufacturing firm?

[Brian Masse, NDP, Windsor West, ON]

We could define that through taxes too. We could use a definition of taxes, which could be a quite easy way to do it. And not-for-profits have to be registered by the federal government or the provincial governments.

I'm running out of time, so I want to ask you two quick questions to get your input on them. I'll ask the questions and then turn it over to you to get the answers so there's enough time.

The 18-month period of implied consent, post the beginning of the relationship, is going to put it all over the map. It will be hard to follow when that date falls, so I'm a little bit concerned about that.

Last, the biggest one I'm really concerned about is the one about third parties, number six, that under certain unsolicited commercial messages that are follow-ups to third party or referrals.... I have checked into your notations here, and I'm really concerned about the definition of “family” and “personal relationships” as defined in the regulations. I'm wondering whether “family” refers to a brother, sister, or cousin-in-law. Not all of us get along with all of our family, and I'm just wondering whether that gives broad consent to allow people to be approached just through their relationship. And who is defining that and who is going to police that is going to be really interesting.

I will turn it over to you for the answers.

[André Leduc]

The 18-month thing was a clarification. It came through the witness hearings--i.e., what happens if I have a subscription to House & Home magazine for two years and the subscription is about to run out, but they've also run out of the 18 months? We're saying that they get the 18 months at the end of the subscription to contact me and see if I'd be interested in again subscribing for the next two years.

It was really with regard to memberships, subscriptions. If it's a point of purchase, where I purchase something and that's the end of the relationship, at the end of the purchase, then the 18 months starts there. So it was more of a clarification for those other things.

With regard to the third party referral, we wanted to be sure that we heard....

Oddly enough, Paul Vaillancourt, the financial adviser who appeared before you, is my financial adviser.

[Voices]

Oh, oh!

[André Leduc]

I didn't know he was appearing. It was just kind of odd to see him in the room.

Actually, Paul got me through a third party referral.

[A voice]

So you're in a conflict.

[André Leduc]

Yes.

We didn't want to allow third party referral to.... We understand, for financial advisers, real estate agents, and other professional or business service-type people, that referrals are key to their business, and that they have lost the ability to contact referrals through the do-not-call legislation. That said, we didn't want to let the referrals thing be anybody to anybody at any given time. So we said that in order for me to refer somebody to my financial adviser, I have to have a personal or family relationship with this person...to be defined in regulations, although “family” we're fairly solid on; we're going to follow what's in the Income Tax Act already.

So you have to have that kind of one-to-one relationship. And if you don't want to refer your cousin, don't refer your cousin.

We're going to use those definitions. Then the person who's sending the e-mail--i.e., my financial adviser--has to name, in that e-mail, the person who has made the referral.

If you fail to meet these criteria that we're naming here, you will be in violation of the act. We've tried to make allowances for business, the functionality of using this medium to contact prospective clients, but at the same time not poking a hole big enough that somebody could drive a truck through in the act and you might as well not have the legislation.

So we really did try to have a useful third party referral that didn't allow for absolutely everything to happen there.

[The Chair, Conservative, Michael Chong]

Thank you very much, Mr. Masse.

Thank you, Mr. Leduc.

Mr. Rota.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

Thank you, Mr. Chair.

Thank you for being here today.

My question goes to clause 12. I guess there's some concern around the part that says “a computer system located in Canada is used to send, route or access the electronic message”. Now, “access” and “send” I can understand--that's under our jurisdiction—but “route”? That's where I start getting concerned.

If we have a company who's dealing with an American customer or a foreign customer, and we want that processing, that routing, to go through Canada...because that is jobs that are here; it's not affecting Canadians, because it's only being routed through. Are we shackling Canadian companies by forbidding them from allowing the information to be routed through and off to another country? Or are we allowing them to...?

I just feel that our companies are being restricted unfairly. If that's the case, what's to stop the companies now in Canada from saying, “You know what? This is too strict; we can route from anywhere in the world, so we're shifting our jobs and our companies south of the border or somewhere in a third world country”?

[Philip Palmer]

That's a very good question.

The jurisdictional clause is designed to permit enforcement on behalf of Canadians. Now, as you're aware, telecommunications service providers are not liable for carrying traffic. So if there were traffic between Los Angeles and New York that is in the form of unsolicited e-mails, even if they violate U.S. law, the Canadian has not committed a contravention of the act in Canada. There is no violation.

What it does, though, is this. If the communications company is being swamped by e-mails coming into its network such that they can't properly manage traffic, it allows them to complain so that Canadian authorities can cooperate with authorities offshore to try to track down who's doing this and how can we shut it down and which country is in the best position to deal with it. But without a violation in Canada, we would not be able to get to first base of saying, listen, international partner, we've got a problem here and we need your help to fix it.

It does one other thing as well, which is that it gives the TSP that is concerned about the harm that's being done to its network potentially the right to bring a private right of action against the perpetrators. While our AMP regime and a finding by the CRTC may not be enforceable abroad, normally a Canadian judgment of a Canadian court would be, and that we think is a possible important remedy for the Canadian telecommunications service providers.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

So just to clarify then, the TSP is not responsible for anything going through their network, and the only time they would actually use this legislation is if one of their clients or someone outside is shoving a massive amount of data through and basically encumbering their ability to deliver service?

[Philip Palmer]

Their regular business, yes.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

That's interesting.

I was going through some of the changes: “honest mistake”. What is an honest mistake? Is there a definition in there and I missed it? How do you define an honest mistake? Could you give me a little bit of clarification for my own good.

[Philip Palmer]

In appearances before the committee and in representations that have been made to Industry Canada over the summer, we have had a number of variants on the idea that instead of having a due diligence defence there should be a defence of honest mistake; in fact, inadvertence.

Our response to this is that in section 33 we have actually two categories of defence that are recognized with respect to AMPs, and they're equally applicable to the private right of action. These are, first of all, due diligence, which is the general standard that's applicable to any person where they may have been negligent or they may have caused harm without having intended it. The notion there is that as long as reasonable efforts have been made that avoid the actual harm that was caused--so you put in place, in our case, procedures to ensure that you don't e-mail people who haven't given permission--then you're okay, even if once in a while you make a mistake.

But the second part of it says that every rule and principle of the common law that would be a defence against a charge or offence is applicable in this situation. Through that mechanism we also bring in--and I can't think of many circumstances where it would apply--the concept of a mistake of fact, inadvertence, or any other standard of defence that's available at law.

So I think that rather than changing our standards...we've actually got a very flexible standard, the general rule being due diligence, which is usually enough for most corporate entities. But beyond that, they can rely on other defences that are available at common law. It's for the imagination of lawyers to imagine what other defences they might possibly want to bring, depending on the circumstances, if they need to.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

I would imagine that someone making one mistake or a corporation making one mistake would probably not trigger a $100 million fine, and I guess this is a question and a statement at the same time. A repeat offender would be the person you would charge, not somebody who does just the one-off. Is that how I'm to read this? Is that correct? I'm trying to put myself in the shoes of the person who's regulating this.

[André Leduc]

Philip addressed the due diligence defence and the common law principles, but we're getting to the fact where, okay, you boo-boo once, you enter into a compliance agreement, and then you do it again, and those are in the factors to be considered under clause 20. When developing the penalties, you have to take this list of factors into consideration.

Beyond the due diligence defence, this is a compliance regime. So Mr. Misener appears, he's afraid Amazon might make a mistake one day: something happens with the technology, a new employee makes a mistake. What do we do? Well, they're likely going to hear from their clientele or the people who shouldn't have received that e-mail message: “Hey, you should have taken me off your list three months ago; I asked to be off the list.” So they're going to know they've done something wrong. The first thing they should do is approach one of the three enforcement agencies and say, “We think we've had an error here; we always intend to be compliant with this legislation, and we'd like to enter into an undertaking”, which is clause 21.

Short of that, short of their recognizing the mistake, then they'll be served the notice of violation, either by the CRTC, the Competition Bureau, or the Office of the Privacy Commissioner, and they have the opportunity then for the due diligence defence. And the same rules apply for the private right of action.

And failing being able to defend themselves, if it is an honest mistake, those factors for the scope, the nature of the violation, whether they profited from it—all of the negative implications of what they've done—have to be considered before we can process the monetary penalty. So if they didn't make any money from it and they didn't really mean to do it, they're likely not going to suffer a monetary penalty. And that's the key to those factors under clause 20.

And the last thing, barring all of that, should all of those safety valves for the honest mistake fail and they don't like the decision of the CRTC, they can appeal the CRTC's decision in the Federal Court and get another day in court.

[The Chair, Conservative, Michael Chong]

Thank you very much, Mr. Leduc.

Thank you, Mr. Rota.

We're going to go to Mr. Wallace now, but before we do, one of the interesting things in this discussion is that the one factor we've not heard any testimony on or any discussion about is the IT costs associated with all the spam.

I can tell you from my previous life that we spent thousands of dollars trying to control this stuff and we were never completely successful. I don't know about members around this table, but I'm constantly bumping up against the limit on my mailbox size, which I think is about 100 megabytes of mailbox storage space. And if 90% of what we get is spam that we don't actually receive because of filters, that means that the House of Commons' IT department probably has over and above that, let's say, 900 megs of storage of e-mail clutter that they have on the back end, which they've got to clean out every so often. And the Internet connections that Parliament has to the outside world are probably, you know, 30%, 40%, or 50% larger than they have to be just to handle all the spam.

So you add it up, and if you're looking at $100 per person per year—let's say $70 a year of extra storage costs, $30 a year for extra access to the Internet through T3 or T2 pipes, you know—and 5,000 accounts on the Hill, it's half a million dollars a year in lost productivity because of all this spam that's floating out there, and that's never factored into any of the discussion here.

I can tell you from personal experience that we spent tens of thousands of dollars, in my life as an IT executive, trying to put in place systems, software on routers, software on exchange servers, increased bandwidth to the net, in order to compensate for all this junk coming down the pipe.

Without further ado, I'll go to Mr. Wallace.

[Mike Wallace, Conservative, Burlington, ON]

Thank you.

Mr. Chong was in the IT business before I got here.

First of all, I want to thank you for the work you've done on this. I'll be frank with you: I've been here only three and a half years, but often we have witnesses, and sometimes I'm not sure how effective it is, but I would say that you, as staff from the department, certainly listened and made some major changes here to try to accommodate that. I'm really, really appreciative of the work you've done in providing it to us.

So I have just a couple of really quick questions.

One, there was a question about enforcement. Do you have any issues about the three-agency enforcement? There were a few in front of us before saying that it's ineffective or could be ineffective. Do you want to comment on that now that you have a chance?

[André Leduc]

Ultimately we're just expanding the mandate of these three enforcement agencies. The Privacy Commissioner is responsible for PIPEDA and the Privacy Act and protecting the personal information of Canadians. So she is responsible for protecting electronic addresses and personal information that is accessed through unauthorized access to a computer system.

The same rules apply for the Competition Bureau. We're just extending their mandate to focus on the online environment. It's a bit of a newer mandate, but I would again argue that it might be kind of an extension of their expertise under do-not-call and telecommunications for the CRTC.

In almost every case of legitimate enforcement around the world, it is the communications authority that is enforcing the regulatory regime. So they're definitely the right pick, because they're going to be cooperating with their counterparts internationally.

[Mike Wallace, Conservative, Burlington, ON]

One other comment we heard at the last set of meetings was from the legal profession. I believe it was that organization that represents lawyers across the country that was talking about a couple of small wording changes to the Competition Act. I didn't see it in here, so I'm assuming you didn't agree or didn't think it was needed. Would you like to comment on that?

[Philip Palmer]

Yes. In my view, the issue is a very small one. It relates to the headers and address information contained in e-mails. Their suggestion relates to the materiality test, which applies to other kinds and classes of representation. So when you're looking, for instance, at the body of a message, you look at all of it and you say the representation made is material and it is false, therefore it is offside.

To our view, the information that's contained in a subject line or return address information in particular is, by virtue of how it's positioned, material. It's material if you think you're getting an e-mail from the Royal Bank instead of from We-are-robbers.com. It is material if it says, “Special program for the first 100 persons who sign up”, if that is false. It isn't that we've dropped materiality; it's just that we don't see how what is in the subject line and what is in the addresses is anything other than material.

[Mike Wallace, Conservative, Burlington, ON]

Okay, I appreciate that.

Another comment we heard often from witnesses, which surprised me a bit, was that this is a great act, except for them—you know, “Do unto others but not unto me”. Anyway, we have in here the private right to sue or to further action. I actually agree with that.

To those who didn't agree, would you like to comment on what those witnesses had to say about the private right to action?

[Philip Palmer]

Yes. Businesses have a legitimate concern. I don't pretend that any time a new source of legal worry and fret is created that it is without its costs and concerns for the business community in particular. The question is on balance, I guess, whether the evils that might arise from it are outweighed by the benefits.

The evils that are largely talked about are the evils of frivolous suits, people bringing unfounded class actions, or competitors using strategic litigation to cow or force behaviours on their competitors. These are possible, but Canadian law is such that class actions are difficult to mount, difficult to get certified, and if you lose or recover only a very slight amount, then you're likely to be paying the costs of the person you sued. So most people don't do this unless they have a really good reason to grieve.

The benefit of the private right of action is that it in fact allows people to act in accordance with the harm that's been done to them. The CRTC, the Competition Bureau, and the Privacy Commissioner have limited resources. They're not going to be able to investigate every instance of a complaint. In order that people who are not within the little set of priorities of those organizations but have, for their purposes, suffered a real loss, it gives them the opportunity to take a remedy against the person who has harmed them. I think that's a great benefit.

[The Chair, Conservative, Michael Chong]

Thank you very much, Mr. Wallace and Mr. Palmer.

Monsieur Bouchard.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

Let's talk about the issue of networking among business people. If a real estate agent meets a lawyer at a reception, speaks with him and gives him his business card, could he subsequently communicate with him?

From what I've been able to see, there would be restrictions on any exchange of e-mail and any continuation of the communication established at a social reception.

Could you tell me whether you have some opening, and whether that opening could be even bigger?

[Philip Palmer]

Yes, the opening is there. If you look at clause 10(3)(c), it reads as follows:

(c) the person to whom the message is sent has disclosed, to the person who sends the message, the person who causes it to be sent or the person who permits it to be sent, the electronic address to which the message is sent indicating a wish not to receive unsolicited commercial electronic messages at the electronic address [...]

So we have made amendments to take those exact circumstances into account. A lawyer goes to a reception and gives his card to a real estate agent. That's allowed. It's clear now that that way of communicating is legitimate.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

That means that the lawyer or real estate agent wouldn't need prior consent—

[Philip Palmer]

—expressly given—

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

—to communicate with him, to offer his services, and vice versa. Is that in fact how you interpret it?

[Philip Palmer]

Yes.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

I have another question on implied consent. A number of submissions were made concerning the 18-month time frame for business-to-consumer communications. If I understand correctly, that 18-month period has remained unchanged. You haven't increased it. A number of submissions were made on that point. Let's take the example of a real estate agent, since I just talked about that. A real estate agent sells houses. He wants to sell a house today, and in five or six years, his client may want to resell the house. So I find the 18-month time period restrictive. I would like to know the justification or motivation for that time period, which is still 18 months.

[André Leduc]

I'm going to clarify that situation by citing an example. I give my e-mail address to a person and tell him to contact me in future. That may be in three, five or six years; there's no time limit on express consent. If the person to whom I give my e-mail address forgets to ask for my express consent, he has 18 months to do so by following up by e-mail.

We took the 18 months from the other bill—the Do not call list. I consider a period of a year and a half quite enough time to follow up with a client. A legitimate business should do so within four, five or six weeks. If express consent is obtained, it is valid for an indefinite period of time, but you have to set a date for implied consent.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

I'm going to cite an example. I buy a car from a dealer and I trade it in at the end of four years. At the time of purchase, I tell the vendor that he can call me in four years. In that case, would the act enable him to send me an e-mail in four years?

[André Leduc]

If you've given him your e-mail address and you've asked him to send you an e-mail in four years, if the vendor has kept a file on that relationship or a card authorizing him to—

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

The proof is my business card.

[André Leduc]

He has to keep proof of that relationship.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

All right.

I read that regulations have to be made, which supposes that this is under the minister's authority: it's he who decides when the act will be implemented.

Could you give me some clarification on that point? I haven't seen an effective date. Will the legislation be enacted after being passed in the House and going through all the stages, including reading by the Senate and publication? Is it applicable at that time, or are regulations required to make it applicable? Is it the minister who chooses the effective date?

[Philip Palmer]

The legislation is not enacted until all the regulations are ready. Royal assent is the final step in Parliament. However, between royal assent by Parliament and enactment by Cabinet, at least six months will probably elapse, perhaps more, first to allow the regulations to be put in place and, second, so that the industry can be adequately consulted and given the necessary time to react to the new regulatory framework.

[The Chair, Conservative, Michael Chong]

Thank you, Mr. Palmer.

Thank you, Mr. Bouchard.

Mr. Van Kesteren.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Thank you, Mr. Chair.

Thank you for this excellent presentation. Thank you for your hard work as well.

In your opening remarks, you answered my question about the installation of software. That was a concern. I'm glad to see that you've addressed it.

I have one other thing. I don't want you to have to talk about it for too long, but one of the concerns of one of our delegations here was that the penalties were too high. Are we going overboard?

[André Leduc]

Again—and Mike said this last time—it's to a maximum of $1 million, or to a maximum of $10 million, and I've gone through the whole process of the factors that they have to take into consideration before making a final assessment of what the monetary penalty in fact should be. But we can tell you about international cases, such as a case going on in Australia, for example, where two brothers had one very small shop and a few computers. They had this spam outfit going where they were changing the labels on herbal remedies to call them penis enlargers and sending them out all over the world. In a matter of three and a half months, these guys raked in over $3.5 million of net profit.

So the reason we need penalties in this amount is to address the business model. These guys are making a ton of money, and if we throw a $15,000 fine at them, they'll pay it and go merrily about their business and just keeping doing it and doing it. We have to go after their finances.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

When we had the Canadian Bar Association here, there was a suggestion that this may not be able to sustain a charter challenge. What is your opinion? We had another group here that disagreed. Have we looked at this?

[Philip Palmer]

We recognize that any limitation on speech—and that includes commercial speech—has to comply with the charter. Based on our analysis, we believe this meets the requisite charter tests. We think it's charter-compliant.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

You mentioned earlier—and this is incredible—that 75% to 90% of e-mail is spam. You're absolutely right, Mr. Chair, we're very fortunate. Maybe the thing to do to get politicians behind this is to allow the spam to come through.

[The Chair, Conservative, Michael Chong]

Mr. Van Kesteren, just to make the point, my wife uses Hotmail. If you log in to your Hotmail account and you look at the spam folder, that will give you an idea of the amount of spam coming in. For every message she receives, she's probably getting 20 spam messages. It's all being filtered out, but somebody has to pay for the cost of storage. Somebody has to pay for the bandwidth, and that all gets passed along.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

I understand that this will protect us from spam inside the country, but we won't have that protection from outside the country. How much will the percentage change once we enact the bill and get this thing rolling? What can we expect to see? Can we expect to see 50%, 40%?

[André Leduc]

The legislation is quite similar to that which was enacted in Australia a few years ago. They saw an immediate reduction in the amount of spam that originated from Australia. They dropped out of the top ten spam-originating countries almost overnight. We know—because we lack legislation—that there are some fairly significant spam operations running within our borders. We expect that this legislation will address them. We have attempted to put into this legislation the necessary tools for enforcement agencies and a private right of action. This will allow the enforcement agencies to cooperate with their counterparts on investigations, and the private right of action could be exercised outside our borders.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

I don't quite understand this. What protection do we have against these operations setting up umbrella companies to bypass all this? Is there a part of the legislation that deals with this problem?

[André Leduc]

Clause 6 requires people to identify themselves when sending out a commercial electronic message. They also have to identify the company on whose behalf they're sending the commercial electronic message. For example, if The Bay hires an e-mail marketer to send out an e-flyer, the message has to identify The Bay—who they are, where there head office is, all that fun stuff. Some of this would be determined in regulations. It also has to identify the e-mail marketer. You know not only who you're getting the message from, but also who's represented in the message. We thought that was important.

[The Chair, Conservative, Michael Chong]

Thank you, Mr. Leduc. Thank you, Mr. Van Kesteren.

Mr. Masse.

[Brian Masse, NDP, Windsor West, ON]

It's really a privilege for somebody else to be able to use your Internet service, your equipment, to send you a message. I almost thought that people should be getting a fee for getting an advertisement sent to their system.

You've made some changes here. I want to get an idea of what you think the difference will be between the existing legislation and the new version. What's going to be the difference in the amount of advertisements or spam? There's a very thin line between the two. What's the difference between enacting it with your changes or without them?

[André Leduc]

To be honest, from my point of view we're not going to lose much. I think most of what we've put in there are allowances for legitimate businesses to carry on and use this platform to communicate with clients and prospective clients. In terms of getting after the actual spammers, we're not really losing anything.

Make no mistake, this is the most advanced, in terms of the consent regime, anti-spam legislation anywhere in the world because we did take the time--it took us a little too long--to educate ourselves from the best practices elsewhere in the world and the mistakes that they made. We talked to the Aussies, we talked to the New Zealanders, we talked to the Americans, we talked to the EU and the U.K. and asked, what works best and what doesn't work; what isn't working, and how would you suggest we address it as we develop our legislation?”

Again, most of the amendments here are stuff that will enable the legitimate enterprise, but we're still getting every one of the bad spammers.

[Brian Masse, NDP, Windsor West, ON]

There has been discussion about the process from here on. The bill, if it passes through the House of Commons, then goes to the Senate. If there's an amendment, it comes back to the House of Commons for that amendment, and then royal assent. You're talking about six months worth of regulations to finish off. I'm a little bit concerned about the extra time you've provided--the three years--and then reversing the 18 months. Will that compromise some of the ability to get at some of the spam right away? Because that's a long time. Can you reassure us or provide some evidence that it's not going to get away from us?

[Philip Palmer]

I would dare say that there is not one of the horrible spammers out there who even pretends to have had any kind of a pre-existing relationship with the consumer.

[Brian Masse, NDP, Windsor West, ON]

Okay, that's critical. Otherwise, we're lengthening this out to an unbelievable time.

I didn't see it, and I could have missed it, but usually legislation has a suggested time to come back to Parliament. I didn't see it in here. Did I miss it? Why is that not in this legislation?

[André Leduc]

To be frank, we were advised not to put it in there and that the committee would do it.

[Some hon. members]

Oh, Oh!

[André Leduc]

In most other legislation that we've seen, they'll come back and report after either two or three years to see, as was the case in Australia.... They reported in 2005 and they've recently gone through a parliamentary review of their legislation. We're absolutely open to doing the same. I'm not saying we've got a piece of legislation now that's 100% perfect, and we may need to make changes five years down the road, absolutely.

[Brian Masse, NDP, Windsor West, ON]

That's fair enough. I always say that if I was perfect I wouldn't be working here.

I do want to have a parliamentary review again, and I think three years would be appropriate, because the technology moves rather quickly. But I guess the difficulty we have now is that if it's 36 months it's hard to measure the business to business that's going on. So if we reduce that to, say, two years, how much of a compromise do you think that would be in terms of a stress on the industry, instead of the 36 months?

[André Leduc]

Do you mean in terms of limiting that transitional provision? Again, it's a provision for legitimate businesses that have an existing business relationship. It's really about the small and medium sized enterprises: the real estate agents, your insurance broker. It's to give them a little bit of time. They don't have lawyers and offices and the adaptive technology to be able to adapt to this. So it allows them to catch up to the technology.

What's important about that 36 months is that the clock starts ticking upon coming into force, so the window gets shorter and shorter until those 36 months are up. Then the 18 months is the vehicle that stays in the legislation.

[The Chair, Conservative, Michael Chong]

Thank you, Mr. Leduc.

Thank you, Mr. Masse. Perhaps that might be an amendment of yours to the bill.

I'd ask members, if they have amendments, both additional amendments from the government or amendments from the opposition, that you first consult with legislative counsel--our legislative clerk is here and legislative counsel as well--that you get your amendments to the clerk by end of day next Wednesday. That's not to preclude you from tabling amendments from the floor when we go clause-by-clause the first Monday we get back, but in order to be efficient, if you have amendments, get them to the clerk by Wednesday of next week. That will allow her to order them, to translate them, and to have them all together for us when we go clause-by-clause two weeks from now, on Monday, October 19.

Without further ado, we'll now go to Mr. Lake.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Thank you again, Mr. Chair.

I'm just going to take a moment to thank all the departmental officials, the ones at the table and the ones not, who have put so much time into this. I know this is a fairly technical bill and there are a lot of considerations in this, and I know you've put a lot of time and effort into it. So thank you for that.

You have addressed referrals in here. In my previous life I was in sales and I know how important referrals are. When the witnesses who spoke about it were talking about it, it was one of the things that raised a bit of an alarm bell for me. So I'm glad to see you've addressed it here.

It is a little circuitous, as I look through it trying to figure out exactly who we're referring to here in subclause (5.2). Maybe you could put it in practical terms and give an example of how it would work under this change.

[André Leduc]

Basically the idea is that we put a box around referrals. We're allowing them, but we're saying they have to following the following rules. The following rules are these: for anybody to make a referral, they have to have that family or personal relationship with the person they're referring.

I apologize, as this is going to get circular because of the language.

But the important thing is that we are limiting the referral to the family and business relationship. The person who is sending out that e-mail to the person who is referred to has to name the person. So if Mr. Masse here is a good friend of mine and you're my insurance broker and I tell him I've got a buddy he might be interested in and I provide you with his e-mail address, when you send Mr. Masse the e-mail you have to name me in that e-mail so he knows who referred me and where this is coming from, so it is not just out of the blue.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

To clarify then, what kind of relationship is required of you and me at that point in terms of that? So you and I have an existing business relationship, or could you be my brother and not have an existing business relationship?

[Philip Palmer]

You two have a business relationship and those two have a relationship based on friendship or family.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

I just want to clarify, because that's the way I read this too. My concern is that as a former salesperson--I sold Oilers hockey tickets--if my brother and I didn't have an existing business relationship, he might very well say to me that he has a friend who is a huge hockey fan and wants me to send him an e-mail. But that's not covered under this change here. I just want to clarify that.

[André Leduc]

Not the way we've boxed the case. You have to have an existing and ongoing business relationship, so you have to be either my insurance agent or you have to have that expressly consented-to relationship for me to refer somebody to you.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

So then the second part of my question is this. And I'm not prejudging this; I'll have to go away and think about how I feel about it. The second part of the relationship is that customer and prospect relationship--so now the relationship between you and Brian, in your example. I think the way this change is made refers to you guys as having to have a personal or family relationship but not a business relationship; it doesn't use the word “business relationship”.

[Philip Palmer]

No, it does not.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

So you couldn't refer someone with whom you have a business relationship?

[Philip Palmer]

Yes, you can. The answer to that is simply that you can take advantage of the conspicuous publication provisions or the giving of the business card type of thing so that in the business context it is easier to draw the situations in which--

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

It could be assumed that if you have a business relationship you have a personal relationship. Is that fair enough?

[Philip Palmer]

That's very fair to say as well.

[André Leduc]

Based on the way it's drafted, you don't, because it's just a discussion you had. You don't have a personal or family relationship or an existing business relationship. You don't really have a relationship of any kind, outside of the phone discussion you had with this person.

The answer to a specific case like that is to just tell the brother to buy the season tickets.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

If what we're trying to capture is the spirit of referrals, as it was articulated by the witnesses who were before the committee, I want to make sure I'm clear about what we're trying to do here so we can go back and think about it in that context.

[André Leduc]

To be honest, we wanted to make allowances for it but were afraid of putting this type of thing in the bill. On the idea behind the breadth and scope of it, you have to think of this as a balloon. If we keep poking holes in it, at some point it's going to explode. The whole idea behind the referral issue is to allow for legitimate contact, where there's an existing business relationship or family relationship, without allowing me to refer 250,000 of my friends. We're trying to say that we should consider something for referrals, but we have to put it in a type of box to make sure we're not poking a big hole in it.

[The Chair, Conservative, Michael Chong]

Thank you, Mr. Lake and Mr. Leduc.

Madam Coady.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

Thank you very much.

I have a couple of quick questions, and one that might take you a little longer to answer. The quick question is about the unsubscribed requests.

A number of witnesses who came before us asked for the opt-out period to be increased from 10 days to 31 days. If you look at the bankers' submission, they said the CRTC's unsolicited telecommunications rules provide a 31-day timeframe. Others have said they have a 31-day marketing cycle and it's very difficult to do it in 10 days.

Would you comment, please?

[André Leduc]

The biggest difference between telemarketing and e-mailing is that there's a two-step process for telemarketing. If I'm on the phone with somebody and they tell me to never call again, I have to write down their name and input it into the computer. In 99 cases out of 100, if I send an e-mail to 100 of your friends and somebody asks to be taken off the list, it's a click of a button. For most larger enterprises this is automated through their websites.

So we don't think this is overly onerous. It should be done without delay, and that's the way the legislation is drafted. In any event, it should take no longer than 10 business days, as we've drafted it. Regardless of the size of the enterprise, we don't think it's overly onerous to be responsible with your e-mail contact list versus your telephone contact list.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

The bankers also talked about the Telecommunications Act. Their concern was access to information, because documents may be produced and then kept by government agencies, particularly the CRTC. They're concerned that under the Access to Information Act information might be transferred to others. They suggest that the bill be amended to specifically protect the information from disclosure by the CRTC, in response to an access to information request.

Would you comment?

[Philip Palmer]

There are certain exemptions within the Access to Information Act on materials that are used for judicial or investigative purposes. I can't say that we've done a full analysis of how broad those exceptions might be. We did not provide in this for a sweeping exemption of this material from the Access to Information Act. It is something we'd be prepared to look at or entertain, because there is legitimate reason for concern in some circumstances. I think most of the information before the CRTC would be on transmission data and be horribly uninteresting.

[The Chair, Conservative, Michael Chong]

Madam Coady, that might be a good Liberal amendment to bring forward by next Wednesday.

Go ahead.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

The other question is on the national do-not-call list. As you know, section 86 of the bill, if proclaimed into force, will repeal sections 41.2 to 41.7 of the Telecommunications Act, which basically authorize the establishment of that list. There are those who have been before us asking why we're putting that in this bill. We understand it's so there can be some modification to the list framework to allow future flexibility.

Could you comment on whether there are issues? Witnesses have told us that if there are issues with the do-not-call list or if administrative changes need to be made, maybe we should do that under the list and not in the legislation.

[Philip Palmer]

The main motivator here is that technologically we are getting true convergence. That is, voice is digitized. Skype and other applications like that now mean that spam travels not just by mail. Telemarketing is not just done on telephones. They're converging. They're using the same media, the same technology. Our concern is that any valid distinction between telemarketing and spamming will cease sometime in the next few years. It was a matter of ensuring that the tools were available, when that moment came, to switch regimes.

Now, the aspect of it that has come up—and I've listened to and heard those discussions—is that the government has always said it would not bring this into force on day one; it would be proclaimed later, if at all. But it does allow the government to respond to a situation where there is a collapse, for instance, of the do-not-call mechanisms. The do-not-call list is maintained by a private company. If it's unprofitable for it to do so, it might terminate that contract. The CRTC doesn't have the money to maintain that.

[The Chair, Conservative, Michael Chong]

Thank you, Mr. Palmer.

Mr. Wallace.

[Mike Wallace, Conservative, Burlington, ON]

Thank you, Chair. I'll share some of my time with Mr. Warkentin. I have really only one question.

I thought the bells weren't coming until 5:30.

Anyway, I appreciate the parliamentary secretary's discussion on referrals. In my view, as long as he's selling tickets and he says his brother gave my name in the e-mail he sent, I'm satisfied with that, or whatever the wording needs to be.

I just want to be clear when you make the change to conspicuously publishing the e-mail address. I used to be in the sales business. I used to sell racking systems to those IT guys who are sitting at the end of the table here. If I look up their website, I find their e-mail address. It's published on their website. I send them an e-mail saying, “Hey, I have this racking system that you might be interested in.” There's nothing illegal with that in this system. As long as it's published and it's out there, I'm entitled from a business standpoint to chase that potential client. Is that not correct? Is that what this means when you say “conspicuously”?

[Philip Palmer]

That is essentially true, with the caveat that the e-mail you send has to relate to their business or their functions. For instance--

[Mike Wallace, Conservative, Burlington, ON]

Right. So I can't sell him Viagra just because he works in the IT department.

[Philip Palmer]

That's right. He might need it, but you can't do it.

[Mike Wallace, Conservative, Burlington, ON]

I won't tell you what I send to the lawyers.

That was my question, so I'll give the rest of my time to Mr. Warkentin.

[Chris Warkentin, Conservative, Peace River, AB]

Thank you, Mr. Wallace, for giving me some of your time.

In terms of pre-existing business relationships, I want to talk about implied consent. As we move from the regime as it is now, where all e-mails are fine and where a realtor might be able to correspond with past clients on any given day and no matter how long it was since they made the last transaction, a lot of realtors and car salesmen--anybody who actually is engaging in a type of business where a relationship has a long period of time before there would be a necessity for a business transaction to take place again--are very concerned about, number one, trying to get something more than implied consent at this point. Up until now, of course, they've been able to operate simply on implied rather than explicit consent. Was there any consideration to making a longer phase-in period for certain types of people, especially in situations where they have this type of relationship?

My concern is that we're going after the whole group of people in any business, but I don't think the average person is really concerned about the spam that piles up from past realtors or past car salesmen—and maybe there are people who get frustrated by that. I wonder if there has been any consideration given, because I am concerned about how this might impact these folks.

[André Leduc]

We did consider it, but before we put anything forward in the legislation we also considered the adverse. Let's say that instead of an 18-month existing business relationship, we set it at 36 months. Two years ago, I was a Bell customer. If we stretch this out too far, it's going to allow Bell to contact every customer who they pretty much know went to Rogers, because that's the main competition, and send out, under the existing business relationship, commercial electronic messages in an attempt to lure back their customers.

We looked at those periods. That was really the reason. It was for the legitimate folks, such as car salesmen, real estate agents, and insurance salesmen, who might be caught off guard by this legislation. That's what the 36-month transitional period is for. As long as they can prove that they had an existing business relationship previously, they have the first three years of this act to contact those individuals and say, “I was your car salesman” or “I was your insurance broker”. Where they don't have that ongoing business relationship, they can go back and ask if you mind their contacting you again in the future; and if you say yes, well, that's good enough. That's express consent.

[The Chair, Conservative, Michael Chong]

Thank you, Mr. Leduc. Thank you, Mr. Warkentin.

Go ahead, Monsieur Bouchard.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

I would just like to make an additional comment on the issue that was just raised.

When the consumer or customer of a business buys a car or conducts some transaction, such as the purchase of a house, and gives implied consent, that means that it's limited in time.

[André Leduc]

In that case, it is the consumer who is responsible for telling the company, for example, that he no longer wants to receive electronic business messages from it.

If you have express consent, there are no limits. So if I give my real estate agent that consent and he contacts me for the first time six years later, that's quite legal, and that is fine. It is then the consumer who is responsible for opting out, for removing himself from the electronic message list.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

So it's the consumer or the client who is responsible for saying whether he agrees to give his tacit consent. The business can suggest it, and it's entirely legal for it to suggest it.

[André Leduc]

That's correct.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

Thank you.

[Robert Vincent, Bloc, Shefford, QC]

I would like to continue in the same vein, to be more sure.

Unless I'm mistaken, once the bill is passed, a business that is already in operation will have more opportunities than a new business because it already has customers to whom it can send e-mails asking them whether they want to receive information concerning it for the next 100 years. Yes, no?

On the other hand, a new business that decides to do that after the bill is passed wouldn't be able to do it because it would not already have established relations. It is looking for new customers and the easiest and simplest way to do that is through the Web.

Does that limit new businesses?

[André Leduc]

No, nothing here prevents those companies from having a website.

[Robert Vincent, Bloc, Shefford, QC]

Then how do they go about making themselves known?

[André Leduc]

That's it, spam.

How do you make yourself known?

What is the difference between a legitimate business and an individual who is trying to sell viagra? That's not a way to... Trying to contact everybody on the planet in one shot: ultimately, that's what spam is.

[Robert Vincent, Bloc, Shefford, QC]

Let's take an American business that isn't subject to Canadian laws. If it sends an e-mail across Canada saying that it has a new product—that it's translated into French—it will face no penalties and will continue doing business?

[André Leduc]

No. In our bill, there are penalties for those companies, even though they are American.

As Philip said earlier, they could be liable to civil actions—in the private sense—because Quebec consumers would say they didn't expect to receive that. Decisions made by the civil courts in Canada can often be given effect in the United States.

[Robert Vincent, Bloc, Shefford, QC]

Will they apply in all countries?

[Philip Palmer]

Perhaps not in all countries, but in the developed countries. There is a committee consisting of representatives of those countries.

[Robert Vincent, Bloc, Shefford, QC]

So if I have a business and I decide to go to another country to have my advertising circulated by another business, I can do that.

[Philip Palmer]

Perhaps, yes.

[Robert Vincent, Bloc, Shefford, QC]

Then what's being eliminated?

[Philip Palmer]

Perhaps I didn't understand correctly. It's illegal to send spam to Canada from a foreign country.

[Robert Vincent, Bloc, Shefford, QC]

If I go through another country that isn't subject to the act, I can do what I can't do right now, that is to say contact people whose names appear in my bank of names. If I have a business in Canada and I decide to have a new customer data base, I'll have to use the postal service to advertise. I can't do that?

[André Leduc]

That's not necessarily the case. I can create a website and enter into partnerships with other websites. I can also put advertising on other websites to refer people to my website, if there's no indication that should stop. Ultimately, the purpose of this bill is to promote that kind of activity.

[Robert Vincent, Bloc, Shefford, QC]

That seems complicated.

[The Chair, Conservative, Michael Chong]

Thank you, Mr. Vincent.

Thank you, Mr. Leduc.

Mr. Rota.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

Thank you, Mr. Chairman.

I'm going to continue on this question. What could prevent anyone from hiring someone in another country to send e-mail or spam to Canada? What are the consequences of sending something to Canada from another country?

[André Leduc]

As in any other act, there are jurisdictional problems. As described in the bill, the spam has to be sent to Canada.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

For example, I receive e-mails from Romania that I can't read. I know they don't come from Canada, but what are the consequences for that company?

[André Leduc]

That depends. If Romania has a similar act, the three agencies can coordinate an investigation with Romanian authorities.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

You've answered my question.

I want to look at clause 86 of the bill. It basically would repeal subsection 41.1 and subsection 41.7 of the Telecommunications Act, and that would eliminate the do-not-call bill.

That would put everything that falls under the do-not-call provisions under this bill and it would be subject to changes within the government bureaucracy. Now, a lot of time went into the do-not-call list, and it will be substantially revised. Would there be substantial consultation, or is there some process in place so that it's not haphazardly changed at the whim of either the minister or the bureaucracy or the leadership within that--

[Philip Palmer]

Nobody can do it by whim. There would have to be a regulation to adapt certain of the rules that wouldn't necessarily fit terribly well with the voice communications. So we would expect that, again, there would be significant consultation before anybody contemplated proclaiming this provision.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

Okay, very good. Thank you.

I'd like to ask a question on two basic scenarios. I have a Bell account and I have a Hotmail account. The Hotmail account is not based in Canada, it's based in the United States. How does it affect these two accounts differently? Will my Hotmail account still continue to get everything in it? This is an extension of the first question I asked. Again, foreign spammers or American spammers will continue to send stuff to my Hotmail account. It won't affect my Bell account.

[André Leduc]

Well, it also affects your Hotmail account. Nowhere in the legislation does it say where your account is set up; it's whether or not you're accessing your e-mail in Canada. The jurisdictional link is that it's sent to you, and if it's the case that you're in Canada, then that's our jurisdiction.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

Okay.

We're bouncing back and forth here, but to go back to the other question, changes to the legislation will have to be done by the bureaucracy. Mr. Palmer, we have new technology being introduced on almost a daily basis. Based on your 30 years within the federal bureaucracy, how responsive is this legislation?

One of the concerns in the legislation is that it is too broad and picks up everything and the only stuff that gets through is the stuff that we allow. Now, what if we have something new that comes up today and would allow our Canadian companies to compete at a certain level, but they can't use it because it hasn't opened up yet? Based on your past experience, what do you foresee as a reasonable time? Or is there a reasonable time?

[Philip Palmer]

I think the main thing to be said is that this certainly attempts to be a principles-based piece of legislation, and it sets out very broad, principled guidelines for business. It is not technology specific; it is permissive of any technology. It is permissive of any networking system, of any kind of web contact system, etc. So I personally don't think we're going to find problems in terms of technology posing a problem to the integrity of the legislation.

I think the main concerns are going to be that there are unanticipated problems on the business end of things. The human interface is where I think we'll probably be finding the greatest difficulties. There may be a few on the technological side, but it's not a technological bill, so I don't think we're locked into a construct that is built on a specific technology.

[The Chair, Conservative, Michael Chong]

Thank you very much, Mr. Palmer.

Thank you, Mr. Rota.

Mr. Masse.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Mr. Chair.

I'll be really quick. I'm still a little concerned with the referral scenario here, so I just want to make sure about this. Is there an obligation on the part of the company such that, once the referral goes to the company, they have to make sure that where the referral came from is in their database and that it is an existing customer before they actually contact the person who's been referred? Is there a provision in there so that if it is abused they can be fined?

What I'm worried about is that somebody could do large spams out there saying that they know somebody and then referring. It may not be the normal situation, but you could have somebody do that and inundate someone that way. Does the company have an obligation to make sure that where it comes from is an existing client? Last, if they abuse it, is there a fine in place on that company?

[Philip Palmer]

On both, the answer is yes.

[Brian Masse, NDP, Windsor West, ON]

Thank you.

Thank you, Mr. Chair.

[The Chair, Conservative, Michael Chong]

Thank you very much.

We're going to take a brief question from Mr. Lake and then one from Monsieur Vincent.

Mr. Lake.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

The main question, I guess, is this. There has been some concern raised over the last few days by individuals. They were concerned that through this amendment process we might wind up watering down the legislation. Are you confident that with the amendments you've put forward we're not overly watering down the legislation here?

[André Leduc]

Yes. We're still quite confident that what we have here is the right piece of legislation.

The amendments that were brought forward are meant to address legitimate concerns brought forward by witnesses over the course of the committee hearings, but we still feel very comfortable that we have the most advanced anti-spam e-commerce protection legislation literally in the world. This is world-leading stuff and will get after the spammers and those who are implanting malicious software on computers. We still have the right tools here.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

As we consider additional amendments, would there be a caution that you'd give us against particular amendments that might significantly water down the legislation?

[André Leduc]

That was the concern with the third party referral. To be completely honest, I didn't feel 100% comfortable with doing it, but that was my personal view. Understanding that it is a legitimate practice for a number of legitimate commercial entities out there, we did feel compelled to try to address it and to try to make it work within the legislation, without watering down the legislation.

Again, this legislation, although we think it's still fairly solid even after we've addressed a number of concerns, is quite fragile. The wrong wording and the wrong amendment could be something that is taken advantage of by spammers, and if that's the case, well, what's the point?

So yes, I would caution you to try to not create something that a spammer might take advantage of and drive a truck through.

[The Chair, Conservative, Michael Chong]

Thank you very much, Mr. Lake.

Monsieur Vincent.

[Robert Vincent, Bloc, Shefford, QC]

Earlier you referred to civil proceedings. So that means consumers who would sue a company, wouldn't it?

[André Leduc]

Not necessarily. Any person, in legal terms, can institute a civil suit. It could be a person, but also a business, like Videotron, for example, which would sue those who do not comply with the new act.

[Robert Vincent, Bloc, Shefford, QC]

I think we're essentially trying to protect consumers from spam. If consumers receive spam, it's up to them to sue the company when they receive 20, 25 or 30 and they don't want any more.

[André Leduc]

No, the purpose of the bill is to protect networks as much as consumers, as well as small and medium-size businesses.

[Robert Vincent, Bloc, Shefford, QC]

Give me an example because I don't understand.

[André Leduc]

We're talking about, for example, about Bell, Videotron or any company that has a network. The network has a certain bandwidth. As Mr. Chong said, spam currently represents 90% of all traffic on those networks. So that's very costly for Videotron, Bell and Rogers. That spam is transmitted here through the information technology services of the House of Commons. They have to eliminate all spam, put filters in place, which results in costs. There are also costs for the network when it transmits all those messages that are in fact spam. No one wants them. So there's a cost, and it's quite high when you think that 90% of all communications are spam. It's a problem. The bill should solve it somewhat, or at least reduce it.

We think that our case in Canada should be resolved almost instantaneously. Canadian spammers should be neutralized quickly. The bill also contains provisions for suing spammers outside our country, either through a civil proceeding or through partnerships that will develop through the CRTC, the Competition Bureau or the Office of the Privacy Commissioner of Canada.

[The Chair, Conservative, Michael Chong]

Thank you, Mr. Leduc.

I'll allow Mr. Bouchard one final question.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

I'd like to go back to the enactment of the legislation. You mentioned a six-month time frame, and you also referred to consultations. I assume those consultations mean that there will be information.

Will those consultations be conducted within a six-month time frame or will they be held after that time frame, which will mean that could take nine months to a year before the bill is in effect?

[Philip Palmer]

That will be done over the six-month period. As we develop the regulations, we'll consult the industry and consumers. Education programs are planned and so we'll use the time at our disposal quite efficiently.

[The Chair, Conservative, Michael Chong]

Thank you, everyone, for your questions.

Just to wrap up here, I was doing some research last night on this, and I read that over the last five years spam as a percentage of e-mail traffic has gone up from about 30% or 40% five years ago to 90% today. Clearly it's an issue. There are some fascinating statistics on the cost this is all causing corporations and citizens themselves.

I have just one final reminder. If you have amendments, please consult with the legislative counsel to this committee either tomorrow, Friday, or next week, Monday and Tuesday, and submit your amendments to the clerk by end of business day Wednesday of next week so that we can expeditiously deal with this, as we go clause-by-clause on Monday, October 19.

Without further ado, the meeting is adjourned.