Industry Committee on Nov. 2nd, 2010

[The Chair, Conservative, David Sweet]

I call the meeting to order.

Good morning, ladies and gentlemen. Bonjour à tous. Welcome to the 43rd meeting of the Standing Committee on Industry, Science, and Technology.

Today we have before us Department of Industry officials. Janet DiFrancesco is the director general of the electronic commerce branch, and she'll be giving some opening remarks. With her are André Leduc, a policy analyst with electronic commerce policy, and Philip Palmer, senior general counsel for legal services.

Without any further ado, Madam DiFrancesco, you can go ahead, but before you start, you will notice that we've given you some complimentary binders. These are to assist you in following the clause-by-clause consideration of this bill. You can see that they're going be a great help to you in the very near future.

Madam DiFrancesco, please begin at your convenience.

[Janet DiFrancesco, Director General, Electronic Commerce Branch, Department of Industry]

Thanks, Mr. Chairman.

I appreciate this opportunity to be here today to discuss Bill C-28, the proposed Fighting Internet and Wireless Spam Act, or FISA.

The bill before you today closely resembles the former Bill C-27, the Electronic Commerce Protection Act, or ECPA, which this committee studied during the last parliamentary session. Bill C-28 builds upon the recommendations of this committee and stakeholders in response to Bill C-27.

FISA, like ECPA, provides a comprehensive regulatory regime that uses economic disincentives instead of criminal sanctions to protect electronic commerce. The measures introduced in Bill C-28 are based on international best practices.

This regime creates new violations to address the threats posed by spam, malware, deceptive online marketing practices, phishing and spyware.

It also allows for private right of action and introduces administrative monetary penalties in order to hold those who violate the Fighting Internet and Wireless Spam Act—FISA—accountable for their actions.

It also promotes international cooperation by providing authority for the three enforcement agencies, the Canadian Radio-television and Telecommunications Commission—the CRTC—, the Competition Bureau and the Office of the Privacy Commissioner of Canada, to share information with their counterparts around the globe.

We have provided the committee with a redline version of the bill to make it easier for you to compare FISA with its predecessor, ECPA. The redline version can be found at tab three in the blue binders that you have in front of you this morning.

I can take you through that document, if you like, but I would briefly like to summarize two substantive changes that have been made to the bill.

The first change concerns a new clause in clause 3, which can be found on page 4. The Personal Information Protection and Electronic Documents Act, or PIPEDA, contains a primacy clause in subsection 4(3) that, among other things, ensures that the consent provisions in PIPEDA take precedence over other acts. However, since the scope of the consent regime in FISA is more precise than in PIPEDA, it is necessary to include this coordinating amendment, which clarifies that FISA takes precedence over PIPEDA should there be any conflict.

The second change that I would point to can be found on page 59 of the bill, in clause 83. It concerns an amendment to PIPEDA designed to address the collection of personal information when a person accesses a computer system without consent. In Bill C-27, this provision applied when access to the computer system was without authorization. Stakeholders expressed concern that the term “without authorization” was too broad, and to address these concerns the provision now applies when access to a computer system to collect personal information is “in contravention of an act of Parliament”. For example, there was concern that hackers might be able to claim that information obtained about their practices from a website could be considered to be collected without authorization simply through the use of the terms and conditions on the site.

Mr. Chairman, it is our hope that the adoption of this bill will provide an opportunity, through a concerted and cooperative approach involving the public sector and the private sector, to reduce spam and related online threats. At the same time, the bill will permit us to work more effectively with our domestic and international partners to address threats to online commerce.

I would be pleased to take the committee through a more detailed examination of the changes highlighted in the redline version of the bill that has been provided to you, or, if you prefer, we can simply be prepared to respond to questions.

Thank you.

[The Chair, Conservative, David Sweet]

Thank you, Madam DiFrancesco.

Unless there's a large consent otherwise, I'll think we'll go with questions. That way, the members can direct questions to their areas of concern, because I'm certain that some of them have done some independent study on their own.

Mr. McTeague, did you have a comment?

[Dan McTeague, Liberal, Pickering—Scarborough East, ON]

Yes, I do, and perhaps a brief one. Thank you, Mr. Chair and colleagues.

Obviously we're satisfied with this bill in its form. I do have one concern with respect to the first change you made. I think you've cited it here on page 4, “in the event of a conflict between PIPEDA and this Act”.

Has this been vetted, agreed to, and understood by the Privacy Commissioner? Have there been any discussions? Have we her authorization? I'd hate to see a situation where we pass something, and six months after, regulations are gazetted, and suddenly we have a conflict.

[Janet DiFrancesco]

Absolutely. Thank you.

Yes, we have consulted with the Office of the Privacy Commissioner, and they are completely supportive of the change to FISA to ensure that in specific situations covered by this act, the consent provisions do take priority and precedence.

[Dan McTeague, Liberal, Pickering—Scarborough East, ON]

You appreciate that in 2002, when I wrote the first bill dealing with spam, it wasn't as involved. How flexible and adaptable is this legislation to new and rising and different unanticipated or unknown challenges, in circumvention, for instance?

[Janet DiFrancesco]

We think that the bill is very adaptable. We've taken a very careful approach to ensure that the legislation is technology neutral, in that it doesn't specify any specific type of technology. It uses broad language to capture electronic commercial messages, for example. We have also incorporated into the bill, though, where appropriate, regulation-making authority.

To the extent that we are aware of a challenge or a concern on the Internet today, we've enumerated that into the bill, but we've also allowed for regulation-making authority to permit us to accommodate new things or new threats that might come up that are consistent with the intent of the legislation as you see it before you today.

[Dan McTeague, Liberal, Pickering—Scarborough East, ON]

Finally, before I pass this on to Mr. Rota, if I could, Mr. Chair, many of these problems originate territorially outside of Canada. What is the scope of the legislation as it deals only with domestic threats, dealing with partnerships with other nations? Are we working with other countries? Will we be using this as a model, in your assessment, to work with other nations to ensure that we're able to provide an international network to rid consumers and Canadians of this problem?

[Janet DiFrancesco]

Yes, absolutely. The bill has specific measures to allow the CRTC, the Office of the Privacy Commissioner, and the Competition Bureau to collaborate internationally with their counterparts in other countries. It is a very important element of the bill. That is something that's been considered and something we look forward to seeing an improvement in once the legislation is in place.

[The Chair, Conservative, David Sweet]

Thank you.

Just for the members, I think we're just going to continue with the regular rounds. If I see that there are no questions, then we'll go in a more casual manner. For now we'll do the regular rotation, so that means, Mr. Rota, you have about four and a bit minutes left, then we'll go to the Bloc, the NDP, and the Conservative Party.

Mr. Rota.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

Thank you, Mr. Chair.

Thank you for being here this morning.

Some businesses and non-profits have commented and suggested that some provision was made for commercial e-mail. It just seems to have tied.... I guess one of the groups I've heard from the most are real estate agents and sales people, who base their business on referrals. One of the areas they are worried about is, okay, say they're referred to a certain person by a family member or by a friend, and they were impeded from actually going through with an e-mail to that person.

What response do you have to that criticism, or what can I tell them we've done that would actually solve that problem?

[Janet DiFrancesco]

I think the bill recognizes that third-party referrals are a difficult area and certainly are something that could be used by those who want to spam individuals. We recognize that the legislation does require, perhaps, a change in business models for the kind of situation you described, but would suggest that kind of situation could be handled by having the family member contact the real estate agent, as opposed to the real estate agent contacting the family member.

Clearly, what the legislation is trying to do is not allow a third party to give express or implied consent on behalf of another person. In the situation you described, someone might say that's a very legitimate marketing practice, but you can imagine that if the bill allowed someone else to give consent on my behalf, it is wide-open, from a spam perspective, to allow that to be widely used.

We do recognize that in some instances business models will have to change to accommodate the new legislation, but we think it's practical, reasonable, and necessary to obtain the objectives of the bill.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

Again, I want to clarify, because I do have quite a number of people who have approached me on this.

If they ask, then they cannot directly approach someone. Even if it's a one-off and it's a personalized e-mail to that individual, they cannot approach them without breaking the law.

[André Leduc, Policy Analyst, Electronic Commerce Policy, Department of Industry]

That's accurate. In the first instance, the bill clearly notes that the sending of the first commercial electronic message, even if it's just seeking consent, counts as an unsolicited commercial electronic message.

This is one of the clauses that differentiates us from the American model, which is an opt-out type of regime. Everybody gets that one-off. Every spammer, as much as every legitimate business, is permitted to send that first commercial electronic message.

We're saying that's not acceptable; that's just another form of spam.

The business model for the real estate agent, in this case, is that if the real estate agent would like to contact me through a friend, the friend can provide me with the real estate agent's card and I can contact the real estate agent, rather than the other way around.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

How does the American model work?

The real estate agent, for example, in this case, would have the right to send one personalized e-mail to that person upon a referral.

[André Leduc]

One commercial electronic message.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

Why did we not go with something like that?

[André Leduc]

I know we've said it at committee before, but the Americans are the last remnants of the opt-out regime; everybody else in the world has gone opt-in. Basically it's a “you can spam” act. It permits spamming, ultimately.

The marketing lobby in the United States was successful. That was not their original intent, but they were very successful in lobbying our American counterparts to put that in the legislation. Over the next few years, I'm sure we'll see the American folks having a look at moving to an opt-in regime.

A couple of countries have already started with an opt-out regime and transitioned to an opt-in regime on a similar model, like Japan.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

Okay. So that was Japan, and who else? You said a couple of different....

[André Leduc]

Jurisdictions have moved, yes.

On first look, it seemed that the opt-out might work. It created too large of a loophole, so countries then migrated to an opt-in regime.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

Okay, very good.

[The Chair, Conservative, David Sweet]

Are there any questions from the Bloc?

Mr. Cardin, go ahead.

[Serge Cardin, Bloc, Sherbrooke, QC]

Thank you, Mr. Chair. I will be sharing my time with Mr. Bouchard.

Ladies and Gentlemen, good morning and welcome. I have a question.

On page 15, at line 30, clause 12(3) talks about the delay in these terms:

(3)The person who sent the commercial electronic message and the person —if different — on whose behalf the message was sent must ensure that effect is given to an indication sent in accordance with paragraph (1)(b) without delay, and in any event no later than 10 business days after the indication has been sent...

I will not bother reading clause 12(1).

Do you think 10 business days is a reasonable deadline? There may be a whole host of reasons why people might feel that this 10-day deadline is a bit tight. We have already discussed the possibility of changing this deadline to 30 days. The same goes for clause 12(4)(b), which also sets a 10-day deadline. That was my question for you. What was your reasoning behind setting this 10-day deadline, instead of a possible 30-day deadline?

[André Leduc]

The 10-day deadline was set for withdrawing a person's consent with regard to an activity mentioned in clauses 7, 8 or 9. The process by which a person's consent is withdrawn is often automated. It could be someone requesting that their name be removed from a marketing list, which is normally done through an automated process.

A deadline of 10 business days gives enough time to small and medium sized businesses that traditionally do all this manually. For example, the business might make the change to their list manually and finish the work later. Ten business days equals a minimum of two weeks—maybe longer if we consider the Christmas holidays. That is enough time.

The text clearly says without delay and no later than 10 business days.

[Serge Cardin, Bloc, Sherbrooke, QC]

Pardon me, but when this was being studied, I was not a member of the Standing Committee on Industry, Science and Technology. Is it mandatory to strike a person's name from a list electronically under the legislation?