CRTC Assesses Conspicuous Publication Basis of Implied Consent in CASL Enforcement Decision

November 03, 2016

Written By Martin P.J. Kratz, QC

The CRTC released a compliance and enforcement decision, CRTC 2016-428, October 26, 2016, in which it found that Blackstone Learning Corp. committed nine violations of paragraph 6(1)(a) of Canada's Anti-Spam Legislation (CASL) by sending commercial electronic messages (CEMs) without consent, and imposed a penalty of $50,000 on Blackstone.

The decision is noteworthy as it give more details and analysis than the CRTC's prior press releases of enforcement action. As a result, it give a glimpse into the process used by the CRTC in an enforcement action. Importantly, it also confirms the CRTC views on the requirements to use conspicuous publication as a basis of implied consent and provides details of factors that may impact the amount of a penalty under CASL.

The issue arose because the CRTC received numerous complaints through its spam reporting centre that Blackstone had sent unsolicited CEMs offering educational and training services. The majority of the CEMs were sent to government employees.

The CRTC investigated and then issued a notice of violation identifying nine messaging campaigns consisting of almost 400,000 CEMs sent without consent of the recipients. That notice set out a penalty of $640,000. Blackstone responded with representations including disputing due process in respect of a notice to produce (NTP).

The NTP was served November 7, 2014, and required Blackstone to provide certain documents by November 21, 2014. Blackstone requested a review of the NTP but did so outside the applicable time limit. The CRTC noted the requested review was made despite Blackstone being made aware of the procedure and deadline and without any argument as to the late compliance and no grounds or argument to support a claim that the NTP was unreasonable. As a result the CRTC denied the review of the NTP and provided a new deadline, January 29, 2015, to produce the requested documents. Blackstone purported to appeal this decision to the Supreme Court of Canada (notwithstanding that the Act provides a right of appeal of CRTC decisions to the Federal Court of Appeal). No proper appeal was filed. The CRTC found that Blackstone's efforts at an appeal raised no issues relevant to the notice of violation.

The CRTC noted it had to decide on a balance of probabilities, whether Blackstone committed the violations and, if so, what the penalty should be and what conditions might be applicable.

In its representations to the CRTC Blackstone argued that it had implied consent to send the CEMS allegedly based on guidance it received from officials at the Department of Industry and that the amount of the asserted penalty was unreasonably high.

Blackstone claimed implied consent on the basis of the conspicuous publication of the electronic addresses of the recipients under Section 10(9) of the Act. In support of this position Blackstone shared an email exchange with an official at the Department of Industry which it asserted supported Blackstone's view.

The CRTC decision commented on the conspicuous publication basis for implied consent:

The conspicuous publication exemption and the requirements thereof set out in paragraph 10(9)(b) of the Act set a higher standard than the simple public availability of electronic addresses. In particular, the electronic address to which the message is sent must not be accompanied by a statement indicating that the person does not want to receive unsolicited commercial electronic messages. The requirement that it be relevant to the recipient's role or functions creates the condition that the address be published in such a manner that it is reasonable to infer consent to receive the type of message sent, in the circumstances.

For example, if a business conspicuously publishes on its website contact information for an employee at an address held by that business, this publication could create implied consent to send messages relevant to that person's role. If that business chooses to advertise through a third party and provides that employee's contact information for the purposes of that advertisement, this could also create implied consent to contact that person in relation to that advertisement, or their role, because the account holder caused the publication. However, if a third party were to reproduce this address or sell a list of such addresses on its own initiative, this would not create implied consent on its own, because in that instance neither the account holder nor the message recipient would be publishing the address, or be causing it to be published.

Paragraph 10(9)(b) of the Act does not provide persons sending commercial electronic messages with a broad licence to contact any electronic address they find online; rather, it provides for circumstances in which consent can be implied by such publication, to be evaluated on a case-by-case basis.

The CRTC noted that its notice of violation had requested Blackstone to produce information with respect to how it obtained consent (express or implied) to send CEMs. Blackstone did not respond to the notice.

Blackstone did not provide this information in its representations to the CRTC and provided no supporting information to the CRTC with respect to (a) where or how it discovered any of the recipient addresses, (b) when the addresses were obtained, (c) whether their publication was conspicuous, (d) whether they were accompanied by a statement indicating that the person does not want to receive unsolicited CEMs, or (e) how Blackstone determined that the messages it was sending were relevant to the roles or functions of the intended recipients

Rather, Blackstone's position was a general assertion that implied consent covers publicly available addresses. In the absence of establishing the elements required for implied consent under CASL the CRTC found that Blackstone had committed the violations.

The CRTC did a careful assessment of the penalty, originally $640,000, and found that among other factors Blackstone was a small company and their efforts to reach out to Industry Canada showed potential for self-correction. As a result the CRTC ordered a penalty of $50,000 due by November 25, 2016.

The learnings for other potential defendants include:

• Understand CASL. The legislation is complex and has contradictory provisions. A potential defendant should carefully assess the legislation.
• Develop a compliance program. Development of a policy and actions to support the compliance efforts mean that an organization is more likely to understand the scope and limitation of the implied consent regime under CASL.
• If served with a Notice of Violation take it seriously and take the opportunity to provide representations and develop those representations based on an understanding of CASL and the organization's compliance efforts.
• If served with a notice to produce that an organization wishes to appeal, do so in the applicable time frame and provide reasons to support the appeal.
• If relying on the conspicuous publication basis for implied consent then provide each of the elements necessary to establish the basis for that consent as required by CASL.
• If faced with a large penalty then factors that may tend to reduce the penalty should be evaluated. The CRTC noted negatively the lack of compliance with the process and lack of cooperation as factors tending to increase the penalty.