CAUCE

Comments on proposed Industry Canada regulations for Canada's Anti-spam Law

Mr. Bruce Wallace Bruce.Wallace@ic.gc.ca

Director, Electronic Commerce Policy Electronic Commerce Branch/SITT

Industry Canada

Ottawa, Ontario

CANADA

 

Regarding : Canada Gazette, Part I Vol. 145, No. 28 — July 9, 2011

The Coalition Against Unsolicited Commercial Email (CAUCE North America Inc.) thanks you for the opportunity to submit our comments on the draft regulations, below.

CAUCE (http://cauce.org) is an all-volunteer Internet end-user advocacy organization. CAUCE has moved beyond its original mission of advocating for anti-spam laws, to a broader stance of defending the interests all users in the areas of privacy and abuse in all its forms on the Internet.

CAUCE is led by a Board of Directors with a cumulative century of experience in the field of Internet advocacy who are active in consulting with governments, law enforcement agencies, and Industry associations.

CAUCE is a participant in many industry initiatives including the Messaging Anti-abuse Working Group (MAAWG), the Anti-phishing Working Group (APWG), the Microsoft Digital Crimes Consortium, the National Cyber-Forensics & Training Alliance (NCFTA), the U.S. National Cyber Security Alliance, the Stop Spam Alliance and the London Action Plan (LAP) and has participated in The Canadian Task Force on Spam, the U.S. Federal Communica­tions Commission (FCC) Communications Security, Reliability And Interoperability Council (CSRIC) and the Anti-spyware Coalition (ASC).

 

Industry Regulation : PERSONAL RELATIONSHIP AND FAMILY RELATIONSHIP

 2. For the purposes of paragraph 6(5)(a) of the Act

(a) “family relationship” means the relationship between individuals who are connected by

 (i) a blood relationship, if one individual is the child or other descendant of the other individual, the parent or grandparent of the other individual, the brother or sister of the other individual or of collateral descent from the other individual’s grandparent, 

(ii) marriage, if one individual is married to the other individual or to an individual connected by a blood relationship to that other individual,

(iii) a common-law partnership, if one individual is in a common-law partnership with the other individual or with an individual who is connected by a blood relationship to that other individual; and

(iv) adoption, if one individual has been adopted, either legally or in fact, as the child of the other individual or as the child of an individual who is connected by a blood relationship to that other individual; and

(b) “personal relationship” means the relationship, other than in relation to a commercial activity, between an individual who sends the message and the individual to whom the message is sent, if they have had an in-person meeting and, within the previous two years, a two-way communication.

 

COMMENT: We feel that the ‘in person’ requirement is overly proscriptive; we can envision numerous instances of not having met our correspondents face-to-face in many years or ever, but yet would be on a sufficiently friendly basis to be able to fall reasonably within the context you are attempting to describe. We ask that you consider amending this to be written as “reasonably frequent 2-way non-business communications".

Industry Regulation : CONDITIONS FOR USE OF CONSENT

3. (1) For the purposes of paragraph 10(2)(b) of the Act, a person who obtained express consent on behalf of a person whose identity was unknown may authorize any person to use the consent on the condition that the person who obtained consent ensures that, in any commercial electronic message sent to the person from whom consent was obtained,

(a) the person who obtained consent is identified; and

1.  (b) the authorized person provides an unsubscribe mechanism that, in addition to meeting the requirements set out in section 11 of the Act, allows the person from whom consent was obtained to withdraw their consent from the person who obtained consent or any other person who is authorized to use the consent.

(2) The person who obtained consent must ensure that, on receipt of an indication of withdrawal of consent by the authorized person who sent the commercial electronic message, that authorized person notifies the person who obtained consent that consent has been withdrawn from, as the case may be,

.    (a) the person who obtained consent;

.    (b) the authorized person who sent the commercial electronic message; or

.    (c) any other person who is authorized to use the consent.

(3) The person who obtained consent must inform, without delay, a person referred to in paragraph 2(c) of the withdrawal of consent on receipt of notification of withdrawal of consent from that person.

(4) The person who obtained consent must give effect to a withdrawal of consent and, if applicable, ensure that a person referred to in paragraph 2(c) gives effect to the withdrawal of consent, in accordance with subsection 11(3) of the Act.

 

COMMENT: In our current experience, data aggregation services often sell email addresses and mobile telephone numbers (with the ability to send SMS spam) to dozens or hundreds of third parties unknown to the consumer, requiring the registrant having to unsubscribe from each mail stream individually, in effect completely losing control over the use of his or her address.

CAUCE would like to see an additional regulatory obligation to affirmatively prevent data collectors from attempts at transferring consent to any other parties. In particular we would like an explicit rule that is not possible to obtain blanket third party permission (“our carefully chosen marketing partners.”).

Data aggregators must be regulated to main­tain records of the parties to whom each address is sold or rented, to maintain an effective process so that if a recipient opts out from any of the third parties, the recipient is opted out from all of them, and these third parties must be regulated to indicate where they obtained the address in the first place, in each message. In other words, a single opt-in at the original point of collection should be readily reversible by a single opt-out.

Thank you again for allowing us the opportunity to submit these comments, and wish you success in this commentary process

 

 

John Levine

President
john.levine@cauce.org
CAUCE North America
5284 St. Joseph
Lachine Québec
CANADA H8T1S2
Tel: (514) 664-5037

 

***End of document***

 

 

Comments on proposed CRTC regulations for Canada's Anti-spam law

The CRTC (Canadian Radio-television and Telecommunications Commission) is one of the agencies that will implement Canada's anti-spam law. We filed these generally supportive comments in response to their proposed regulations for the law.

e360 vs. Spamhaus is over, e360 wins three bucks

Four years ago a bulk mailer called e360 sued the Spamhaus Project for a broad range of alleged evils interfereing with e360's allegedly highly successful email marketing business, which most of the rest of us considered to be spamming to sell junk. Due to a variety of unfortunate legal moves on both sides, it's dragged on for years. I blogged about it last year when the trial court decided that of the three causes for damage that e360 had alleged, two showed nothing, so he got a nominal $1 each, but for the third, for lost business, he awarded $27,000. Spamhaus, now ably represented pro bono by Jenner and Block, appealed on the basis that the judge had misinterpreted e360's numbers, which were in any event not credible.

Today the appeals court ruled in Spamhaus' favor, reducing the third award to $1, for a total of $3, which Spamhaus (or more likely their friends in the US) will pay. In appeals cases, the loser has to pay the winner's costs, so Jenner and Block will presumably be going after e360 for that.

For more analysis see Laura Atkins' Word to the Wise, Mickey Chandler's Spamtacular, and Venkat Balasubramani at Circle ID.