Industry Committee on Sept. 26th, 2017

[Mark Schaan]

I'll start, and then I'll turn it over to my colleagues from the CRTC.

To the point that was made earlier, in general, because the law was framed as technology neutral, by and large it has been able to keep up. I think our own sophisticated understanding of the tools and techniques that are being used by entities requires quite a bit of constant study and work on our part, but the law itself has generally been able to continue to allow for enforcement to be carried out.

I would say, with respect to the notion of consent, that even the Privacy Commissioner in his own report just last week indicated that obtaining meaningful consent has become increasingly challenging in the digital age, where data is ubiquitous, commodified, and maybe processed by multiple players, totally unbeknownst to the individual to whom the data belongs. I think that is something that we continue to examine and analyze and understand. It's something that is changing, as we say. Your point about 2004.... It allowed people to share both very personal information about themselves as well as pictures of their dinners, but also created quite an interesting conceptual issue around consent.

I think from a legal perspective, by and large, we've been relatively successful in keeping up with the technological advancements.

With regard to enforcement, I'll turn to my colleagues.

[Steven Harroun]

I'll build on what Mark has been saying.

From an enforcement perspective, the opt-in regime is actually very helpful, because we are able to understand very clearly if someone has given their permission to receive information or emails, etc. That's a very helpful piece.

On the international front, I stand by the fact that we are very active in the international sphere. For example, I've mentioned UCENet, which is an international network of enforcement agencies. Just last year, we held a workshop with the International Institute of Communications on nuisance communications. The importance of that venue was that they are the policy folks, and there are people and countries involved in the IIC who had never met the enforcement side of the piece. We brought those two sides of the puzzle together at a workshop to look at the varying ranges of legislation available to these countries, so that the developed and the developing countries could exchange with each other their lessons learned. We can learn from the enforcement side of the house about what works and what doesn't. If you're about to institute legislation, how can that help?

We at the CRTC took it upon ourselves to sponsor this workshop and bring those two worlds together, and we'll be doing a follow-up actually, later in October, to discuss the next steps, how we can get everybody on the same page moving forward, and who can pick up the ball on particular pieces to ensure that we keep furthering the elimination of nuisance communications to everyone around the world.

It's ironic that you say you get calls from everywhere else. I know we've cited good stats. We still get calls from international partners asking us to help them against the servers in Canada. It's interesting. They see it from the other side of the fence. Across the pond, they say it's over there in Canada. They're the ones doing the spamming. They may not be spamming Canadians, but they're spamming someone else around the world.

[Terry Sheehan, Liberal, Sault Ste. Marie, ON]

Is there an international agreement that most countries belong to, or should there be?

[Steven Harroun]

I would say no. I definitely think UCENet as an enforcement network is very helpful, and Mark had mentioned the M3AAWG and malware analysis group, which also includes countries from around the world.

There is certainly no one central point and that is why we, as the CRTC, branched out to get the policy folks in. Now we've included the IIC. There are certainly other fora, for sure, in which we could participate. The challenge, of course, internationally is that the legislation differs in different countries. The commitment by certain countries is different from what we would suggest. We have a strong commitment here in Canada. There may not be the same level of value in other countries. So one-stop shopping is probably not the way to go. I think it would be challenging, and we might never get anything done because no one would agree.

[Terry Sheehan, Liberal, Sault Ste. Marie, ON]

Thank you very much. That's very informative.

[The Chair, Liberal, Dan Ruimy]

You're bang on for timing.

We are now going to go to Mr. Eglinski. You have five minutes.

[Jim Eglinski, Conservative, Yellowhead, AB]

My first round of questions goes to Mr. Harroun.

I notice in your report that you say the CRTC has entered into agreements with enforcement agencies in the United States, the United Kingdom, Australia, and New Zealand. Then two paragraphs down—I'm a little confused—you say the CRTC has signed memorandums of understanding with 12 enforcement agencies from eight different countries.

Is this a different set of parameters than the first set of parameters? Can you clarify that for us, please?

[Steven Harroun]

Absolutely, and I apologize if there was any confusion.

Our memorandums of understanding with Australia, the U.S., and New Zealand are with the government departments responsible for spam legislation. The 12 enforcement agencies in the nine different countries are the enforcement side of the house, so more the RCMP or public safety kind of officials in the UCENet space. They are two different organizations, two different sides of the house, if you will, referring back to my policy side versus enforcement side.

[Jim Eglinski, Conservative, Yellowhead, AB]

What kind of teeth does that have with the other countries? Do you have good working relations? Are other countries positive in getting back and working both ways?

[Steven Harroun]

Absolutely. I would suggest the MOUs are drafted in such a way that we can share. From a very simplistic perspective, we help them and they help us. We get calls, I won't say every week, but definitely every month. We are probably more in contact with our colleagues in the FCC and the FTC than other countries. We receive requests all the time for assistance.

[Jim Eglinski, Conservative, Yellowhead, AB]

I have a question for Neil.

Neil, you stated something about doing 30 active investigations, and there are no monetary penalties when someone asks that question here. At some other committees I've been on, where I've asked questions about enforcement policies by different directives, I've heard about directives where they'd rather negotiate, work with the client, educate the client, and hopefully get the client compliant.

Do you have a similar policy? You definitely didn't include any monetary actions taken.

[Steven Harroun]

Just to clarify, we do have the ability to impose administrative monetary penalties, and we have on several occasions.

Overall, we have a broad suite of tools. In each case it's dependent on the facts of that investigation and our assessment of what the best outcome is to produce compliance. In some cases that is a negotiated agreement with the party, where it voluntarily agrees to come into compliance, and sometimes it pays a prescribed amount as part of that agreement. In other cases, parties might not be willing to negotiate with us, and in such a case we might pursue a notice of violation, including an administrative monetary penalty.

[Jim Eglinski, Conservative, Yellowhead, AB]

So you have had several monetary penalties imposed?

[Neil Barratt]

Yes.

[Jim Eglinski, Conservative, Yellowhead, AB]

Okay, thank you.

I have a further question. It deals with the section on the private right of action. It has been suspended. Is that correct?

[Neil Barratt]

That's correct.

[Jim Eglinski, Conservative, Yellowhead, AB]

How is our portion—it's not there right now; it's suspended—working or comparing in relation to our partners', say, the U.S., Australia, New Zealand? Do they have legislation in there for private parties to proceed?

[Mark Schaan]

I'll ask my colleague to chime in on that one.

[Charles Taillefer, Director, Privacy and Data Protection Policy Directorate, Digital Transformation Service Sector, Department of Industry]

Yes. For example, the U.S. has a private right of action, but it's only available to Internet service providers, not individuals. There are other jurisdictions. Australia and New Zealand have similar private rights of action, but for example, Australia talks about application for compensation and civil liability events. So there are similar provisions in allied countries, basically. The U.K. has similar provisions as well.

To what extent they mirror exactly the provisions of the Canadian legislation, I would have to....

[Jim Eglinski, Conservative, Yellowhead, AB]

Thank you.

I have about 30 seconds left, and I have another quick question.

You mentioned that you have done study sessions in Toronto. Everybody talks to us about Toronto. I'm worried about the rest of Canada. Toronto can be on its own. What have you done?

[Steven Harroun]

Absolutely. I was going to say I could pull out a list, but even just last year we travelled from P.E.I. to Victoria. We do this across the country.

[Jim Eglinski, Conservative, Yellowhead, AB]

Thank you.

[The Chair, Liberal, Dan Ruimy]

Excellent. Thank you very much.

We're going to move to Mr. Baylis. You have five minutes.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

It's nice again to see you, Mr. Schaan. I'm starting to see you an awful lot, so I assume you're an expert in a lot of fields.

When we look at spam, there's obviously the great work you're doing internationally and then there's work that's being done in Canada. I'm very happy to see the international work, but I also think we should always get our own house in order before we start getting things done internationally.

I want to focus this part on what we're doing in-house.

Mr. Schaan, you mentioned that the amount of spam within Canada has been reduced by 30%. Is that acceptable? I'm asking this to Mr. Schaan and Mr. Harroun. Is that what you would have liked to see, or would you have liked to see more? If you want to see more, what tools do you need to get more done within Canada?

[Mark Schaan]

With respect to the first question, as I said in my opening remarks, the origination for CASL in and of itself was Canada's appearance on the top five countries for origination of spam. As I said, we are now out of the top 10, so in terms of whether it was the result we were aiming for, I'd say that in general, it's a positive outcome as a whole. I think it's a double-edged sword or it's a two-headed challenge in some ways.

With respect to what we would like to see, I think the degree to which organizations in Canada have the capacity to understand and thereby comply with CASL should be at its maximum, to be able to ensure that no one is receiving a message that they haven't consented to, and that the expression of that consent was understood by both parties. To that degree—