Industry Committee on Oct. 7th, 2009

[Brian Masse, NDP, Windsor West, ON]

Okay, so if I had a subscription to a magazine, they couldn't send me other magazine subscriptions from their company related just to the one subscription I have?

[Philip Palmer]

That's right.

[Brian Masse, NDP, Windsor West, ON]

Okay, thank you.

With regard to number two, can you maybe give the reason for the 36-month grandfathering? That seems like a long time; it's three years. I'd like to learn the reasoning behind a three-year timeframe for a business to adjust, especially in this day and age.

[Philip Palmer]

I think you are right as far as businesses go, although you must remember there are a lot of small businesses that haven't automated their e-mail lists and those kinds of thing. So it does give people time, and presumably it will even out the demand for tech services somewhat.

The other concern was that this covers, of course, other people who may be sending commercial electronic messages, people such as your university alumni association, or your humane society that you support and that's selling chocolates or T-shirts to help raise money for a new kennel or something else. These people would also be caught in regard to these activities, and they are less apt than commercial enterprises per se to have the technological sophistication. So this gives what we thought was a reasonable time for the more disorganized organizations to get their acts together.

[André Leduc]

If I could quantify that, the 36-month transitional period only applies to existing business relationships and existing non-business relationships. So there is a quantification there. The burden of proof is still that you must have had that existing business relationship—if it's your real estate agent three years ago, for example—and we're just giving them that 36-month transition period to catch up so they are not caught off-guard by the legislation.

[Brian Masse, NDP, Windsor West, ON]

Could we not have a different categorization for small business, and also for not-for-profit organizations?

[André Leduc]

We haven't done that anywhere in the legislation. The legislation applies to commercial activity. It doesn't matter whether you're a political party, a religious group, a charity, or Sears; it's the activity that people are engaging in that we're saying you have to get express consent for prior to this.

So we haven't done it anywhere else. There hasn't been much discussion to that effect—

[Brian Masse, NDP, Windsor West, ON]

But is possible.

[André Leduc]

Yes, it is possible, but where do you cut off the line? What's a small business? Is it 50 people or 500? What if it's a small manufacturing firm?

[Brian Masse, NDP, Windsor West, ON]

We could define that through taxes too. We could use a definition of taxes, which could be a quite easy way to do it. And not-for-profits have to be registered by the federal government or the provincial governments.

I'm running out of time, so I want to ask you two quick questions to get your input on them. I'll ask the questions and then turn it over to you to get the answers so there's enough time.

The 18-month period of implied consent, post the beginning of the relationship, is going to put it all over the map. It will be hard to follow when that date falls, so I'm a little bit concerned about that.

Last, the biggest one I'm really concerned about is the one about third parties, number six, that under certain unsolicited commercial messages that are follow-ups to third party or referrals.... I have checked into your notations here, and I'm really concerned about the definition of “family” and “personal relationships” as defined in the regulations. I'm wondering whether “family” refers to a brother, sister, or cousin-in-law. Not all of us get along with all of our family, and I'm just wondering whether that gives broad consent to allow people to be approached just through their relationship. And who is defining that and who is going to police that is going to be really interesting.

I will turn it over to you for the answers.

[André Leduc]

The 18-month thing was a clarification. It came through the witness hearings--i.e., what happens if I have a subscription to House & Home magazine for two years and the subscription is about to run out, but they've also run out of the 18 months? We're saying that they get the 18 months at the end of the subscription to contact me and see if I'd be interested in again subscribing for the next two years.

It was really with regard to memberships, subscriptions. If it's a point of purchase, where I purchase something and that's the end of the relationship, at the end of the purchase, then the 18 months starts there. So it was more of a clarification for those other things.

With regard to the third party referral, we wanted to be sure that we heard....

Oddly enough, Paul Vaillancourt, the financial adviser who appeared before you, is my financial adviser.

[Voices]

Oh, oh!

[André Leduc]

I didn't know he was appearing. It was just kind of odd to see him in the room.

Actually, Paul got me through a third party referral.

[A voice]

So you're in a conflict.

[André Leduc]

Yes.

We didn't want to allow third party referral to.... We understand, for financial advisers, real estate agents, and other professional or business service-type people, that referrals are key to their business, and that they have lost the ability to contact referrals through the do-not-call legislation. That said, we didn't want to let the referrals thing be anybody to anybody at any given time. So we said that in order for me to refer somebody to my financial adviser, I have to have a personal or family relationship with this person...to be defined in regulations, although “family” we're fairly solid on; we're going to follow what's in the Income Tax Act already.

So you have to have that kind of one-to-one relationship. And if you don't want to refer your cousin, don't refer your cousin.

We're going to use those definitions. Then the person who's sending the e-mail--i.e., my financial adviser--has to name, in that e-mail, the person who has made the referral.

If you fail to meet these criteria that we're naming here, you will be in violation of the act. We've tried to make allowances for business, the functionality of using this medium to contact prospective clients, but at the same time not poking a hole big enough that somebody could drive a truck through in the act and you might as well not have the legislation.

So we really did try to have a useful third party referral that didn't allow for absolutely everything to happen there.

[The Chair, Conservative, Michael Chong]

Thank you very much, Mr. Masse.

Thank you, Mr. Leduc.

Mr. Rota.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

Thank you, Mr. Chair.

Thank you for being here today.

My question goes to clause 12. I guess there's some concern around the part that says “a computer system located in Canada is used to send, route or access the electronic message”. Now, “access” and “send” I can understand--that's under our jurisdiction—but “route”? That's where I start getting concerned.

If we have a company who's dealing with an American customer or a foreign customer, and we want that processing, that routing, to go through Canada...because that is jobs that are here; it's not affecting Canadians, because it's only being routed through. Are we shackling Canadian companies by forbidding them from allowing the information to be routed through and off to another country? Or are we allowing them to...?

I just feel that our companies are being restricted unfairly. If that's the case, what's to stop the companies now in Canada from saying, “You know what? This is too strict; we can route from anywhere in the world, so we're shifting our jobs and our companies south of the border or somewhere in a third world country”?

[Philip Palmer]

That's a very good question.

The jurisdictional clause is designed to permit enforcement on behalf of Canadians. Now, as you're aware, telecommunications service providers are not liable for carrying traffic. So if there were traffic between Los Angeles and New York that is in the form of unsolicited e-mails, even if they violate U.S. law, the Canadian has not committed a contravention of the act in Canada. There is no violation.

What it does, though, is this. If the communications company is being swamped by e-mails coming into its network such that they can't properly manage traffic, it allows them to complain so that Canadian authorities can cooperate with authorities offshore to try to track down who's doing this and how can we shut it down and which country is in the best position to deal with it. But without a violation in Canada, we would not be able to get to first base of saying, listen, international partner, we've got a problem here and we need your help to fix it.

It does one other thing as well, which is that it gives the TSP that is concerned about the harm that's being done to its network potentially the right to bring a private right of action against the perpetrators. While our AMP regime and a finding by the CRTC may not be enforceable abroad, normally a Canadian judgment of a Canadian court would be, and that we think is a possible important remedy for the Canadian telecommunications service providers.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

So just to clarify then, the TSP is not responsible for anything going through their network, and the only time they would actually use this legislation is if one of their clients or someone outside is shoving a massive amount of data through and basically encumbering their ability to deliver service?

[Philip Palmer]

Their regular business, yes.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

That's interesting.

I was going through some of the changes: “honest mistake”. What is an honest mistake? Is there a definition in there and I missed it? How do you define an honest mistake? Could you give me a little bit of clarification for my own good.

[Philip Palmer]

In appearances before the committee and in representations that have been made to Industry Canada over the summer, we have had a number of variants on the idea that instead of having a due diligence defence there should be a defence of honest mistake; in fact, inadvertence.

Our response to this is that in section 33 we have actually two categories of defence that are recognized with respect to AMPs, and they're equally applicable to the private right of action. These are, first of all, due diligence, which is the general standard that's applicable to any person where they may have been negligent or they may have caused harm without having intended it. The notion there is that as long as reasonable efforts have been made that avoid the actual harm that was caused--so you put in place, in our case, procedures to ensure that you don't e-mail people who haven't given permission--then you're okay, even if once in a while you make a mistake.

But the second part of it says that every rule and principle of the common law that would be a defence against a charge or offence is applicable in this situation. Through that mechanism we also bring in--and I can't think of many circumstances where it would apply--the concept of a mistake of fact, inadvertence, or any other standard of defence that's available at law.

So I think that rather than changing our standards...we've actually got a very flexible standard, the general rule being due diligence, which is usually enough for most corporate entities. But beyond that, they can rely on other defences that are available at common law. It's for the imagination of lawyers to imagine what other defences they might possibly want to bring, depending on the circumstances, if they need to.

[Anthony Rota, Liberal, Nipissing—Timiskaming, ON]

I would imagine that someone making one mistake or a corporation making one mistake would probably not trigger a $100 million fine, and I guess this is a question and a statement at the same time. A repeat offender would be the person you would charge, not somebody who does just the one-off. Is that how I'm to read this? Is that correct? I'm trying to put myself in the shoes of the person who's regulating this.

[André Leduc]

Philip addressed the due diligence defence and the common law principles, but we're getting to the fact where, okay, you boo-boo once, you enter into a compliance agreement, and then you do it again, and those are in the factors to be considered under clause 20. When developing the penalties, you have to take this list of factors into consideration.

Beyond the due diligence defence, this is a compliance regime. So Mr. Misener appears, he's afraid Amazon might make a mistake one day: something happens with the technology, a new employee makes a mistake. What do we do? Well, they're likely going to hear from their clientele or the people who shouldn't have received that e-mail message: “Hey, you should have taken me off your list three months ago; I asked to be off the list.” So they're going to know they've done something wrong. The first thing they should do is approach one of the three enforcement agencies and say, “We think we've had an error here; we always intend to be compliant with this legislation, and we'd like to enter into an undertaking”, which is clause 21.

Short of that, short of their recognizing the mistake, then they'll be served the notice of violation, either by the CRTC, the Competition Bureau, or the Office of the Privacy Commissioner, and they have the opportunity then for the due diligence defence. And the same rules apply for the private right of action.

And failing being able to defend themselves, if it is an honest mistake, those factors for the scope, the nature of the violation, whether they profited from it—all of the negative implications of what they've done—have to be considered before we can process the monetary penalty. So if they didn't make any money from it and they didn't really mean to do it, they're likely not going to suffer a monetary penalty. And that's the key to those factors under clause 20.

And the last thing, barring all of that, should all of those safety valves for the honest mistake fail and they don't like the decision of the CRTC, they can appeal the CRTC's decision in the Federal Court and get another day in court.

[The Chair, Conservative, Michael Chong]

Thank you very much, Mr. Leduc.

Thank you, Mr. Rota.

We're going to go to Mr. Wallace now, but before we do, one of the interesting things in this discussion is that the one factor we've not heard any testimony on or any discussion about is the IT costs associated with all the spam.

I can tell you from my previous life that we spent thousands of dollars trying to control this stuff and we were never completely successful. I don't know about members around this table, but I'm constantly bumping up against the limit on my mailbox size, which I think is about 100 megabytes of mailbox storage space. And if 90% of what we get is spam that we don't actually receive because of filters, that means that the House of Commons' IT department probably has over and above that, let's say, 900 megs of storage of e-mail clutter that they have on the back end, which they've got to clean out every so often. And the Internet connections that Parliament has to the outside world are probably, you know, 30%, 40%, or 50% larger than they have to be just to handle all the spam.

So you add it up, and if you're looking at $100 per person per year—let's say $70 a year of extra storage costs, $30 a year for extra access to the Internet through T3 or T2 pipes, you know—and 5,000 accounts on the Hill, it's half a million dollars a year in lost productivity because of all this spam that's floating out there, and that's never factored into any of the discussion here.

I can tell you from personal experience that we spent tens of thousands of dollars, in my life as an IT executive, trying to put in place systems, software on routers, software on exchange servers, increased bandwidth to the net, in order to compensate for all this junk coming down the pipe.

Without further ado, I'll go to Mr. Wallace.