Industry Committee on Oct. 26th, 2017

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Okay.

Mr. Leroux, that brings me to the issue you raised. Unless I am mistaken, you said that the vast majority of businesses were aware of the legislation, but that they did not know how to comply with it. Is that what you said?

[Philippe Le Roux]

Yes. Companies heard about the legislation in 2014, before it came into force, because it received extensive media coverage. They even talked about a syndrome similar to the Y2K. Everyone expected to be hit with fines as of July 1 or 2. There was a wave of panic. In reality, not much happened and the syndrome faded away.

In May 2014, the CRTC published a newsletter that outlined specific requirements that had to be met in order to be able to use the due diligence defence, as set out in subsection 33(1) of the legislation. That provision stipulates that any business that establishes that they did what was necessary to comply with the legislation is safe from penalties in case of violation. In that newsletter, the CRTC specifies that, by “necessary measures”, it means a compliance program with eight requirement categories. The problem is that the newsletter was buried deep within the CRTC's website. It took most lawyers who specialize in the area two years to discover it. Fightspam.ca, the website that explains the legislation, makes no mention of that newsletter, and neither do the CRTC's public communications.

People know that they must comply with the legislation, but when they are told that they must have a compliance program, they wonder what that is.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

From your comments, I gather that there is some confusion.

Many people who have appeared before us talked about the very definition of “electronic messages”. Mr. Schaper just said that even the charitable organization he represents has trouble understanding to what types of electronic messages the legislation applies and to what types it does not apply.

Aside from volunteer organizations, other businesses are having the same difficulty. For example, Rogers' representatives told us that some emails they had to send to their clients fell under the general definition and that it would be worthwhile to take the time to clarify that definition.

Do you agree with that?

[Philippe Le Roux]

I partially agree. However, I would like to make a nuance.

There are actually two issues here, one of which was raised by Rogers. I completely agree with Rogers, and that is part of our recommendations. Subsection 6(6) of the Canadian Ant-Spam Legislation stipulates that transactional messages or personal messages—so those that are not of a commercial nature—must contain an unsubscribe mechanism. That creates a great deal of confusion and complexity for businesses, but also for consumers. They receive a transactional message for which they don't have to give their consent, the message contains an unsubscribe mechanism, but they don't understand why they can unsubscribe when they did not give their consent to begin with. They figure that, if they try to unsubscribe, the system will not work because they did not subscribe in the first place.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

That's exactly what we have been told.

[Philippe Le Roux]

However, Mr. Osborne talked earlier about putting individual messages, so messages sent to an individual....

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

We will come back to this question soon. Right now, I would like to understand the arguments we have heard.

So you agree that the idea of including an unsubscribe option in a transactional email only creates confusion and that we should amend subsection 6(6), so that it would not apply.

[Philippe Le Roux]

I think that subsection 6(6) could even be removed.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

It could even be removed?

[Philippe Le Roux]

That is Rogers' recommendation, and we fully support it.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Okay.

You can now comment on emails sent to an individual compared with mass emails.

[Philippe Le Roux]

This is where it's important to have a marketing perspective rather than a legal perspective. The current prevalent trend in email marketing is what is referred to as marketing automation. Those are systems that make it possible to automatically generate individual emails based on consumers' actions. If individual emails were removed from the legislation, it would be like saying that the use of marketing automation is giving businesses free rein.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

I know that I don't have much time left, but I will still ask one last question.

I understand your point about automated systems. That said, Mr. Osborne talked about a situation where he would want to send an email not generated by a computer to someone he knows. How could the distinction be made?

[Philippe Le Roux]

As I am not a lawyer or a legal drafter, I don't have the necessary expertise to tell you how we could do it. However, I can tell you that proving whether the email was written by an individual or generated by a machine seems very complicated to me.

The examples Mr. Osborne provided earlier involve situations where the legislation allows a message to be sent. If I have a personal relationship with someone, I already have the right to send them a message. If I send a message to someone to offer services to their company and not to them as a consumer, the legislation already provides an exception and gives me the right to contact them.

I have heard a number of witnesses at different meetings talk about situations where they said they did not have the right to send a message. In reality, in 80% of the mentioned cases, the legislation allows them to send messages. The issue is that the CRTC's restrictive interpretation of the legislation and the regulations makes it extremely dangerous to do so, and....

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Thank you very much, Mr. Le Roux.

[The Chair, Liberal, Dan Ruimy]

I have to stop you here. Thank you very much.

Monsieur Jeneroux, you have five minutes.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

Thank you.

Is that a generous five minutes, Mr. Chair, as for Mr. Baylis? I'll take it.

[The Chair, Liberal, Dan Ruimy]

It's a quick five minutes.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

It's a quick five minutes, and I'm eating up my own time here anyway.

I want to talk to all of you about the cost to local business. Perhaps you can give us some examples of that.

But first of all, I would like to start with Mr. Le Roux.

As you were talking, I was trying to visualize how Certimail works. I'm hoping you can describe it in a bit more detail. Is it adaptable to all types of businesses? Is there a particular type of industry that it works well with? I'm hoping you can briefly describe some of that for us.

[Philippe Le Roux]

We offer our services to businesses of all sizes—with up to 300 employees—in a variety of sectors. We have worked with NPOs, museums, associations, as well as with businesses in the fields of insurance, marketing, media and road transportation. This applies to any situation.

We begin by making a presentation to the company on the CRTC's compliance requirements. We conduct an audit, which is generally done by telephone or video conference, using Skype or another similar program. We then gather all the information on the way our client operates.

We carried out a research and development project with researchers from the Université de Montréal's Faculty of Law. We modelled the legislation and electronic means of communications, and we came up with a grid that lists about 100 compliance issues an SME could face. We review those 100 potential problems for each business, and we then provide them with a report of 20 to 30 pages, depending on the situation. We analyze the way the business operates, its processes, its systems and its policies in order to identify all compliance issues. For each issue, we provide an optimized recommendation that will help the business comply with the legislation and meet the compliance requirements, and improve the effectiveness of its email marketing in the process.

After that, we give the company the report and support it remotely—over the telephone, by email or by video conference—in the implementation of our recommendations. We provide the company with a custom draft policy, a potential training program for its employees, as well as all the necessary records. Finally, we provide the business with certification, which has no legal value and is not sanctioned by the CRTC, but which proves that the business has a compliance program in place. That enables us to receive consumer complaints on the company's behalf and, if necessary, we can take away its certification.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

I'm sorry, but you said you provide a certification?

[Philippe Le Roux]

Yes.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

What would be the overall cost of some of this?

[Philippe Le Roux]

It's commercial accreditation, not legal.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

I'm sorry. I didn't hear the translation on that.