Industry Committee on Oct. 5th, 2017

[John Lawford]

We believe that the regulations in place and the exceptions referred to—warranty and that type of thing for contacting customers in the flow of a business relationship—are presently wide enough. If there are additional factors that have to be thought of, then doing that through a regulation is something that could be done quickly and easily. I don't believe you need to change the act or reverse the consent obligation on the consumer so that they have to opt out.

My concern is that small items will be blown up to completely change this act, and consumers then will bear the burden or the costs of pushing away spam, whereas we've decided to try to make the regime the other way. I'm not opposed to legitimate business concerns with compliance. The act has only been in place for three years. It's possible that there are some unintended consequences, but again, that would normally be done in the regulations, not by changing the act.

[Mary Ng, Liberal, Markham—Thornhill, ON]

Okay.

Mr. Sookman, you talked about how one of the unintended consequences of the legislation, particularly around cybersecurity, is the inability to help companies help create a greater digital environment in view of cybersecurity. In your view, or anyone's view, what could help in terms of any modifications to CASL that could actually help us do that better, and therefore protect consumers and people?

[Barry Sookman]

Those are good questions. If I could, I would like to spend just a minute on the question you addressed to Mr. Lawford.

One way of assessing the legislation is by comparing it to international norms. It was represented to this committee back when CASL was being reviewed that this legislation was the same as what was in Australia, the same as what was in New Zealand; that was incorrect. Although the law was somewhat modelled after that, the definition of CEM in those countries was closed, not open-ended, and the consents were not only expressed consents but included inferred consents without narrow, closed categories. If you look at international norms, even the closest norm we were trying to model was not in line with international standards. It was ratcheted up to make it even more of a straitjacket.

To get to your question, I think that is something somebody should really look at. In terms of cybersecurity, this is a problem with third parties inserting computer programs into systems and thereby hijacking systems, turning them into botnets or acquiring information, including—if you look at 142 million individuals' recent information in the Equifax case—2.5 million more. These are the kinds of things that the legislation does target, except that it doesn't permit the installation of programs where needed to combat cybersecurity.

I've always thought that, in addition to that, the legislation should actually permit the installation of counter-cybersecurity programs on the target that is attacking, in order to protect Canadians. I've also thought, as well, that ISPs should have the power to block foreign spamming sites and foreign malicious sites, to protect Canadians. It would be sort of an umbrella, if you will, to protect Canadians at large, as opposed to every ISP doing it or every organization doing it.

There's a lot that this committee could do, both with CASL and otherwise, to protect Canadians on cybersecurity.

[The Chair, Liberal, Dan Ruimy]

Thank you very much.

Mr. Masse, you have two minutes.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Mr. Chair.

Mr. Sookman, you mentioned the CNIB in your remarks. I'm a former board of directors member for the CNIB. Can you specifically give me that? How exactly, and what case are you're referring to?

[Barry Sookman]

I'm giving you an example of a situation where a charity like the CNIB—

[Brian Masse, NDP, Windsor West, ON]

Okay, so it was just an example.

[Barry Sookman]

I'm giving you an example.

[Brian Masse, NDP, Windsor West, ON]

I just want to clarify that for the record, because I think it's something that the CNIB doesn't need to be dragged into individually as a brand—

[Barry Sookman]

But I have—

[Brian Masse, NDP, Windsor West, ON]

I would move my questions to Mr. Lawford and Ms. Lau.

When we looked at the legislation in the past, there were bot spams, zombie computers, and a whole series of things that were done at that time. In fact, we had the first Facebooks at that time. We had to rely on U.S. prosecution at that time. If we reverse this and take that empowerment from the CRTC, do we then have to rely upon other prosecution for fines and penalties? What happens then?

[John Lawford]

At the moment, the CRTC is working hard with other jurisdictions to try to cross-pursue, if you will, spammers on both sides. If the legislation is changed significantly to do with insulation of programs, they'll just have that many fewer tools to go after people pushing malware in Canada. It takes time for the enforcement authorities to work up their connections with foreign counterparts. They're concluding an MOU, as I understand it, and starting new work on that. It's going to take some time, but weakening the act won't help them with that goal.

[Brian Masse, NDP, Windsor West, ON]

Do I have any time left?

[The Chair, Liberal, Dan Ruimy]

You have about 15 seconds.

[Brian Masse, NDP, Windsor West, ON]

Ms. Brown, do you have 10 seconds of Desjardins positive stuff we could...?

[Natalie Brown]

How could we narrow the—

[Brian Masse, NDP, Windsor West, ON]

Really quickly, would efficient, more well spelled-out rules be an important step forward so that it wouldn't take a big meeting to figure out the rules?

[Natalie Brown]

Absolutely, narrow the scope. There's an exemption in the law, which is a partial exemption that allows us to send without consent but requires us to have “unsubscribe”. All of those definitions should not fall under the definition of CEM.

[Brian Masse, NDP, Windsor West, ON]

Beat 'em up.

[Natalie Brown]

Beat 'em up.

[The Chair, Liberal, Dan Ruimy]

Thank you.

We still have more time for questions. We're going to do one each around the table for seven minutes.

Lloyd, I believe it is you first, and you'll share your time with Eva.

[Eva Nassif, Liberal, Vimy, QC]

Thank you, Mr. Chair.

I am new to this committee. I am replacing my colleague Frank Baylis.

I would like to thank our six witnesses for their presentations, all of which were quite informative.

Ma question is for Mr. Sookman. I am the member for Vimy, a riding in downtown Laval that's home to many small and medium-sized businesses.

Not only did you mention that CASL should not target our SMEs, you went even further.

In your post dated June 7, 2017, you said, “You should instantly sense something is wrong with a law if it could make kids promoting lemonade stands to their neighbours or trying to get a babysitting job, or a person recommending a dentist to an acquaintance, illegal.” However, the exemptions provided for in CASL and its regulations—family relationships, personal relationships and recommendations—would potentially apply to each of those cases.

In your opinion, should we broaden the scope of the exemptions provided for by the act and its regulations? Further, should we include new exemptions from the act's prohibitions?

[Barry Sookman]

Thank you very much for the question. Being from Montreal, I appreciate the question in French, although I cannot respond in French because my French is too rusty.

[Eva Nassif, Liberal, Vimy, QC]

You can answer in English.

[Barry Sookman]

With regard to your astute question about whether the exemptions apply or not, the problem is that there was a regulatory process that could have led to the exemptions applying.

There's an exemption for personal relationships. Personal relationship as it's defined as an exemption, a message from one person to another, is so narrowly confined that it really is someone who has an existing relationship and, pretty much, is exchanging views as a best friend. It doesn't include a situation where a person who lives on the same street sends a message to the friend's mother, for example. It's too narrow. It could easily have been broadened.

The family relationship doesn't permit the sending of CEMs to grandparents or cousins. It could easily have been broadened. A lot of these examples.... I did this one on whether you could actually recommend a dentist over Christmas. It just occurred to me. Could I actually recommend a dentist to somebody? Under the law as it appeared, it was impossible. It made me think it made no sense.

That is the kind of thing that could be addressed if the GIC regulations were revised. They could have a de minimis exception. They could more broadly define what is a personal relationship or a family relationship to take those kinds of situations, which should never be illegal, out of play.