Bill C-27 (Historical)

Electronic Commerce Protection Act

An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act

This enactment establishes a regulatory framework to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities.
It enacts the Electronic Commerce Protection Act, which prohibits the sending of commercial electronic messages without the prior consent of the recipient and provides rules governing the sending of those types of messages, including a mechanism for the withdrawal of consent. It also prohibits other practices that discourage reliance on electronic means of carrying out commercial activities, such as those relating to the alteration of data transmissions and the unauthorized installation of computer programs. In addition, that Act provides for the imposition of administrative monetary penalties by the Canadian Radio-television and Telecommunications Commission, after taking into account specified factors. It also provides for a private right of action that enables a person affected by an act or omission that constitutes a contravention under that Act to obtain an amount equal to the actual amount of the loss or damage suffered, or expenses incurred, and statutory damages for the contravention.
This enactment amends the Competition Act to prohibit false or misleading commercial representations made electronically.
It also amends the Personal Information Protection and Electronic Documents Act to prohibit the collection of personal information by means of unauthorized access to computer systems, and the unauthorized compiling of lists of electronic addresses.
Finally, it makes related amendments to the Competition Act, the Personal Information Protection and Electronic Documents Act, the Canadian Radio-television and Telecommunications Commission Act and the Telecommunications Act.

[Joanne Klineberg]

With journalists, no. But many members of this committee may recall a private members bill, C-299, from a few years ago. It dealt with identity theft, but it was tabled prior to Bill C-27. What that bill did was it said anyone who pretends to be someone else essentially commits a criminal offence. We narrowed that, because what was missing from that idea was that you have to be doing it for a criminal purpose. Lots of people pretend to be other people or engage in deception, such as journalists, for a whole range of purposes.

We did not consult with journalist associations. We were certainly aware of the practice of going undercover in order to gather information, but that's not for a criminal purpose. In developing the identity theft and trafficking offences here we absolutely were mindful of that situation, even though we didn't have direct consultations with journalists.

[Brent Rathgeber, Conservative, Edmonton—St. Albert, AB]

Thank you for that.

At some point, we're going to be asked to do a clause-by-clause examination of this bill. I wasn't part of the 39th Parliament, but I understand that Bill S-4 in its original form is substantially the same as Bill C-27. The Senate made some amendments to Bill S-4.

In your view, Minister, are the amendments appropriate? Did they strengthen the bill?

[Brian Murphy, Liberal, Moncton—Riverview—Dieppe, NB]

Thank you, Mr. Chair.

Thank you, Mr. Minister. I first want to compliment you and the Department of Justice on this legislation.

With the compliment comes a comment, of course. I've been here almost four years, and I can say that this is new legislation. It's not just tacking on a mandatory minimum to an existing law as a band-aid to make it seem as if society is safer. This is real, important work, as you know. Bill C-27 was almost up the ladder when the plug was pulled on Parliament.

So we've been through this before, and what I think is quite interesting and gratifying is to see that you've given praise to the Senate work. I hope it's not just because the Conservatives are close to getting a majority in the Senate that you have a new thought on the good work of the Senate, but--

[Konrad W. von Finckenstein, Chairman, Canadian Radio-television and Telecommunications Commission]

Thank you, Mr. Chairman, for the opportunity to meet with the committee to discuss the Electronic Commerce Protection Act.

We are here to support Bill C-27 and explain our role, as envisaged in the bill. We are glad that the government has introduced this legislation, which is essential to Canada's growing digital economy. It will also have the added benefit of bringing Canadian law in line with our peers in the G8 who have already enacted similar anti-spam legislation.

As the committee knows, the bill is designed to counter commercial spam and related online problems, such as spyware, malware and phishing. These are problems that undermine confidence in the electronic marketplace.

Under the bill, the main enforcement responsibilities for spam will fall under the responsibility of the CRTC. We will be responsible for investigating violations and ensuring compliance.

The Competition Bureau will address false or misleading representations made through electronic messages. The Office of the Privacy Commissioner will address the invasion of privacy stemming from the collection and use of email addresses by computer programs.

The CRTC will be responsible for enforcing three types of violations under the act. First, we will enforce the “no spam” provisions of the act.

The ECPA provides for an “opt-in” regime, whereby people must first consent to receive commercial electronic messages. If there is no express or implied consent, spammers are subject to monetary penalties. Consent will be considered implied under one of two conditions: (a) where there is a business relationship that has been in existence for any time during the last 18 months, or where the recipient has made an inquiry or application within the last six months; and (b) in a non-business relationship where, in the last 18 months, the recipient has made a donation or gift, provided volunteer work, or signed a membership.

Second, the CRTC will prosecute violations involving the alteration of transmission data in an electronic message. Altering transmission data without express consent is prohibited.

Thirdly, the CRTC will enforce the prohibition against installing software or causing it to be installed without express consent. This has been a growing problem, as some spam has been designed to install software into a host computer, and this software in turn broadcasts further spam messages.

The bill provides for tools to permit the CRTC to enforce the act. The CRTC will be able to require telephone companies that provide Internet services to preserve time-sensitive transmission data. We will also be able to require telecom service providers and other institutions to provide documents and reports. Furthermore, there is a provision for searches with a warrant.

The act will be enforced on two separate tracks. The CRTC will have the authority to issue administrative monetary penalties of up to $1 million for an individual and up to $10 million for a business. We will also have the authority to negotiate binding undertakings. The second track involves the right to sue, which will allow individuals and businesses to take civil action through the courts to (a) recover damages for losses suffered and (b) to obtain additional damages for violations of the act.

However, lawsuits under (b) above will not be permitted if the CRTC has already issued a notice of violation or if an undertaking has been agreed upon. Similarly, the CRTC cannot start enforcement action if lawsuits have already been launched under (b) regarding the same violation.

One of the most important features of this bill is that it gives each of the federal partners—the CRTC, the Competition Bureau and the Privacy Commissioner—the ability to share information with one another, as well as with foreign partners.

While there is much to commend in Bill C-27, we believe there is room for improvement in two key areas.

The first concerns section 27, which provides the right to appeal certain CRTC decisions to the Federal Court of Appeal. We propose amending this section to provide a timeframe for bringing such appeals to the Federal Court, and suggest that 30 days would be sufficient. The wording for this proposed amendment can be found in the appendix to this speech.

Secondly, we would like to propose an amendment to the information-sharing provisions of the bill to strengthen the CRTC's ability to work with the U.S. Federal Trade Commission and other international bodies operating under similar anti-spam legislation.

As it has been drafted, the bill allows the CRTC, the Competition Bureau, or the Office of the Privacy Commissioner to share information with other countries provided there is an international agreement or arrangement. In our view, these provisions fall short of what will be required to effectively counter spam. We know that spammers can be very adept at locating in one jurisdiction and directing spam at another jurisdiction. Living in North America, we can expect that a good deal of spam originates or will originate from our southern neighbours.

In its 2005 report, the task force on spam recognized that international enforcement of spam is essential. It recommended that:

The federal government, in coordination with the provinces and territories, should conclude and implement cooperative enforcement agreements with other countries. These efforts should include examining and amending existing legislative provisions as required to allow for seamless international cooperative investigative and enforcement action.

We agree that cooperation with other countries, and particularly with the United States, is essential. But clause 60 of the bill allows for cooperation only on the basis of intergovernmental or interagency agreements or arrangements. From my own experience as Commissioner of Competition, I know how difficult it can be to reach such agreements and how time-consuming and complex the process has become. It is essential that once the legislation has been enacted we can move quickly to cooperate with the United States. We can't afford to wait years until there's an international agreement. The process of negotiating the agreement should not be a barrier to working together to counter spam.

In 2006, the United States passed the Safe Web Act. It gives the FTC the authority to conduct investigations on behalf of a foreign agency, such as the CRTC, that is investigating conduct that is also prohibited under laws enforced by the FTC. However, in our view, and based on past experience, the FTC will provide assistance only if the country in question has reciprocal legislation. No such reciprocal provision is found in Bill C-27.

If Bill C-27 were amended so that it would mirror the provisions in the Safe Web Act, such cooperation would not be problematic; it would be automatic, and it would obviate the need for lengthy negotiations of arrangements or agreements.

We have drafted a proposed amendment, numbered 60A. You will find it in the appendix to this speech. Subject to certain safeguards, it would specifically empower the commission to gather information and evidence on behalf of a foreign country with similar reciprocal legislation, i.e., the United States. This assistance would be provided further, through a written request, in cases of alleged civil contraventions of foreign laws regarding conduct that is substantially similar to that prohibited in Canada. The proposed amendment would also allow the CRTC to share that information with the foreign entity in question.

In essence, clause 60A would provide for mutual assistance between Canada and other countries. I would emphasize that this provision would apply only to the gathering and sharing of information. The decision regarding whether to proceed would be entirely up to the CRTC and would depend on whether the foreign agency had agreed to provide reciprocal assistance.

The addition of clause 60A will require minor changes to the wording elsewhere in the bill to ensure consistency. For that purpose, the proposed changes to clauses 15, 17, and 19 are set out in the appendix.

In conclusion, both proposed amendments, with respect to the appeal period and cooperating on investigations, are very much in keeping with the spirit of the bill as passed for second reading in the House.

In the absence of section 60A, we believe it will be difficult to work quickly and cooperatively with foreign entities, and in particular the FTC. Without this amendment, the Commission's ability to address spam will be compromised significantly.

Thank you very much.

We will be pleased to answer any questions.

[Duane Schippers]

We did two things. First, we did a comparative study of the current legislation and the new powers we would have under Bill C-27. We also compared what is going on in the United States, Australia and the United Kingdom.

At the end of the day, in each of those countries, the types of changes made to the competition or consumer protection legislation were very similar, we think, to the types of changes being made here. Their mandates were expanded slightly, but the core focus of their mandate remained false and misleading advertising--not a huge change in the mandate.

Then we looked at our own resources and determined what we'd need to purchase in terms of additional software and other technology equipment to carry out our role, and also what additional people resources we'd need.

That's how we came to determine what our resource requirement would be.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

Thank you, Mr. Chair.

Thank you for being here this afternoon to share with us on behalf of each one of your organizations, your respective expertise.

My first question can be addressed to either the Office of the Privacy Commissioner of Canada, or the Competition Bureau. Both your organizations must work with one another, but when it comes to implementing Bill C-27, the CRTC joins forces with you.

Will your respective mandates be changed? If so, what would the changes be?

[Duane Schippers, Deputy Commissioner of Competition, Legislative and Parliamentary Affairs Branch, Competition Bureau]

Good afternoon everyone.

Thank you, Mr. Chair, for inviting the Competition Bureau to appear before the committee to discuss Bill C-27, a legislative initiative that targets spam.

It is rare that one finds an idea or a point of view that almost every Canadian can agree upon. Unsolicited electronic communication, or spam, is one of the most universally reviled features of the Internet age. While its most malicious forms may be designed to spread viruses or facilitate identity theft, a significant proportion of spam involves the false or misleading promotion of products or services, particularly in the health and financial sectors.

For those less familiar with the Bureau, our mandate is to protect and promote competitive markets and to enable informed consumer choice in Canada. Our principle statute, the Competition Act, allows us to carry out both civil and criminal enforcement against, among other things, deceptive marketing practices.

With the passage of Bill C-10, the law implementing the federal budget, the penalties for deceptive marketing practices under the Competition Act were strengthened, both in terms of the monetary penalties and through the introduction of restitution orders to get victims their money back. These amendments were designed to harmonize the act with our international counterparts and to improve the bureau's ability to promote truth in advertising.

The proposed legislation before you, Bill C-27, the Electronic Commerce Protection Act, would amend the Competition Act to allow the Bureau to more effectively combat false or misleading advertising in electronic communications and better protect the integrity of electronic commerce in Canada.

Along with the CRTC and the Office of the Privacy Commissioner, the bureau would be one of three partners carrying out responsibilities under this initiative.

The 2005 report of the Task Force on Spam established by the Minister of Industry identified “gaps in current Canadian law that must be filled”. As it stands now, the Competition Act contains both civil and criminal provisions to curb the use of false or misleading advertising.

However, Canada still has no equivalent to laws found in other industrialized countries that relate specifically to electronic commerce, such as the CAN-SPAM Act in the United States or the Spam Act in Australia.

The additions to the Competition Act outlined in Bill C-27 would help to clarify more precisely what cannot be done in electronic messaging and how competition laws would apply in cyberspace.

Specifically Bill C-27 would add more targeted civil and criminal provisions with respect to false and misleading advertising in electronic messages. It would provide authority for court injunctions to restrain conduct that falls within these new provisions and make certain that the act is technologically neutral. False or misleading representations in header information, such as subject lines or sender names in e-mails, in the content of the communication itself, or in locators, such as web addresses or URLs, would now be more broadly covered.

An example of a message that we have all received is one in which the subject line suggests that the message is a greeting from a familiar friend or trusted business, but whose content turns out to be an advertisement for a dubious product from a less than reputable source. This activity would fall under the new provisions as a false or misleading header.

An e-mail or text message advertising a bogus fuel additive, for example, falsely claiming to double your car's fuel efficiency, would be an example of a false or misleading representation made in the content of a message.

Similarly, a Canadian website that chooses a domain name or search terms to suggest that it is a source of job opportunities when it is merely a collection of links and vague advice would be caught under the “false or misleading locator” provisions.

While these examples may be covered to some extent under the current act, Bill C-27 would make it clear that they are, thus making it simpler and faster to take enforcement action against these forms of misleading advertising.

In addition to administrative monetary penalties and potentially even criminal prosecution, Bill C-27 proposes to expand court injunctive powers. The bureau will be able to seek court injunctions against spammers based in Canada or using Canadian equipment to engage in false or misleading advertising, and also against those persons and businesses supplying the spammers with the equipment and services used to carry out false or misleading advertising.

To ensure that the Competition Act remains in step with technological innovation, Bill C-27 amends definitions in the Competition Act to ensure that the act applies broadly to new technologies. For example, voice-over-Internet protocol, or VoIP, and text messaging would now clearly be within the scope of the Competition Act.

Furthermore, the framework provided for in the new Competition Act civil provisions serves as the basis to empower those affected by false or misleading spam to launch private actions under the remedial scheme in the Electronic Commerce Protection Act.

This means that enforcement will be coming from all angles, not just the Bureau or its government partners. In addition to a statutory per-message amount of damages, this scheme also allows plaintiffs to sue specifically for losses incurred as a result of the deceptive communications, ensuring that victims of scams, false advertising claims and other forms of deception have a potential way to get their money back.

In these difficult economic times, we can expect to see an increase in messages targeting not only consumers but also small and medium-sized businesses, which may suffer serious financial harm if they fall prey to misleading or false advertising messages contained in spam. It is the job of the Competition Bureau to protect Canadians from this kind of activity in all economic environments and to foster confidence in an honest marketplace.

The Competition Bureau has decades of experience in conducting investigations into false and misleading advertising and working with our domestic and international partners to achieve common enforcement objectives. For example, the bureau recently launched Project False Hope, an education and enforcement initiative that targeted false or unproven cancer cure claims found online. The project has resulted in 98% of those websites targeted by the bureau changing or removing the claims at issue in order to comply with the Competition Act. As part of the initiative, the bureau worked in collaboration with the Canadian Cancer Society to produce an awareness campaign and an informative pamphlet that has reached tens of thousands of individuals.

In other collaborative efforts, the bureau has worked with domestic and international partners, such as Health Canada, the U.S. Federal Trade Commission, and the U.S. Food and Drug Administration, to combat false or misleading claims surrounding weight loss and diabetes treatments. The bureau successfully took action against almost 100 Canadian-operated websites, with the vast majority changing or removing the claims at issue in order to comply with the Competition Act.

Cooperation is key to ensuring deceptive marketers cannot hide from authorities, in any jurisdiction. Experience conducting investigations, in both the on and offline world, combined with established cooperation networks, provides the right foundation to take action against spam.

Technological progress is a positive and powerful economic driver, but it comes with new ways to engage in deception, and Canadian law must keep pace. The new provisions, combined with the current provisions in the Competition Act, will provide a more complete framework to facilitate more effective and timely enforcement against deceptive conduct in the electronic marketplace in all of its forms.

Canada has been without anti-spam legislation and is lagging behind our major international trading partners. These changes allow the bureau, together with its partners, to more confidently and effectively enforce the law in an undeniably problematic but complex area.

We at the bureau are enthusiastic about the prospect of Bill C-27 becoming law. I welcome the opportunity to discuss the bureau's role and respond to any questions the committee members may have.

Thank you.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

Thank you.

My second question is for the Canadian Chamber of Commerce representative.

Judging from your comments, you are rather critical of Bill C-27. You alluded to the thousands of spam messages that would be considered illegal and to the prohibition of business relationships. You say that the bill needs to be improved.

What provisions of the bill do you find acceptable? Are there sections of the bill that you would be prepared to defend and that you would like us to go forward with?

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

Thank you, Mr. Chair. I would also like to thank each and every witness for their testimony.

My first question is for Mr. Hill, the Vice President of the Canadian Marketing Association.

You have proposed a number of changes or amendments. You have even suggested that certain clauses of the bill be amended. You also talked about the spam that circulates between the United States and Canada. Which brings me to this question: are you at all concerned about spam originating from country's other than Canada?

In Canada, Bill C-27 sets out the rules which allow for a certain amount of control. At the very least, it provides for measures that are applied within Canada. However, have you looked at what is happening outside Canada? If so, have you any recommendations to make on ways of curbing, eliminating or reducing spam originating from outside Canada?

A considerable amount of spam is indeed generated outside of Canada.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

Okay.

New Zealand put it on the website that they could not send commercial electronic messages and that got around this. Bill C-27 hasn't addressed that. Do you think there's something that we should be doing in this regard? It would capture Mike Lake's point about having his e-mail address published. Also, on Facebook, your e-mail addresses are published.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

Thank you.

I want to talk to two issues. One goes back to Mr. Lake' s point about having his e-mail address on the web. I was CEO of my company and I had my e-mail address on the web; luckily, it went to a different box than my inbox. That is a concern for this particular bill as well, and I think Bill C-27 should look at it. We have a lot of precedents around the world, so we can draw on the best approaches.

To go back to Mr. Lake's point, I'm going to draw your attention to a case in New Zealand. New Zealand had an issue when they had their school addresses published on the web, which is a very common occurrence here in Canada. They ended up having a challenge. E-mails were being sent from businesses offering them goods related to education and they weren't being allowed to go through. The ministry added a note to the web page saying that the addresses could not be used to send commercial electronic messages. Are you familiar with this?

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

Mr. Chairman, I am going to share my time with my colleague. But first I would like to ask another question.

Let us talk about coordination. Three agencies have a role to play under Bill C-27: the Competition Bureau, the CRTC and the Privy Council. When the minister last appeared before the committee, he told us that a coordination agency would be set up and that it would not be very large. I would like to hear your views on this. You mentioned that each organization should have a specific mandate. I understood you to say that it will be important to assign a clear mandate to each organization. Is Bill C-27 clear enough in terms of coordination?

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

Thank you, Mr. Chairman.

My question is for Mr. Geist. You stated that legislation is effective when there are penalties. If I understood you correctly, without penalties, enforcement is just about nil or in any event weak.

Are you happy with the penalties included in Bill C-27? What can you tell us about the penalties under this bill?

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

Thank you, Mr. Chair.

Thank you for being here today.

I'm looking at the areas of resourcing and enforcement of the law. In 2002 the Utah legislature passed an anti-spam bill in an attempt to stem spam from being in the inbox of its citizens. The law classified spam as unsolicited e-mail sent to someone who was without a prior business relationship with the company, and the definition is very similar to that in Bill C-27, from what I understand. In their bill, they provided for a right to civil action for violation, much as clauses 47 and 51 of Bill C-27 do. Any spam sent to a person gave that person the right to file a civil suit against the company.

Although damages were limited to $10 per e-mail, the law also allowed for attorney's fees to be paid if the spam recipient was successful in court. Utah's anti-spam law resulted in a flood of anti-spam suits in the court. By the end of 2003, two Salt Lake City attorneys had filed more than a thousand lawsuits under Utah anti-spam law against companies such as Verizon, eBay, and Columbia House. These are clearly larger corporations.

In December of 2003 the U.S. Congress passed the federal anti-spam law, the CAN-SPAM Act, which trumps the state law, and in 2004 Utah's anti-spam law was repealed, but not before the Utah courts were basically clogged with anti-spam lawsuits. Many legal experts have said that it was because of the civil action for violations that this particular law was struck down.

That concerns me when I look at our legal system, and how backed up it is. When I look at this, I see this mad influx of civil lawsuits against companies that normally wouldn't be sued and that seemed to be doing the right thing. As Bill C-27 includes that private right-of-action clause, how do you see this affecting our legal system?

[Prof. Michael Geist]

I do know that one of the recommendations that came out of the spam task force was on the resource side. One of the barriers that we consistently encountered was that there were agencies or enforcement agencies that were willing to take action, or said they were willing to take action, but there was a resource problem.

Are the enforcement provisions deficient? I think on paper they are. I will tell you that throughout the process of the anti-spam task force, we consistently looked for action from some of these enforcement agencies, and frankly we had a hard time getting it. In fact it hasn't come up, but I launched the first anti-spam privacy complaint under PIPEDA with the Privacy Commissioner's office. It was a successful complaint in the sense that it was found to be well founded, but it didn't really get much further than that.

I realized from that, and I think other people realized throughout that process, that it's going to take a clear mandate so that enforcement agencies understand that this is a priority of government. It became very clear that the way you do that is you pass legislation that really targets it, and then you resource it appropriately. That's clearly what Bill C-27 is trying to do.