Why Legislating Permission is Stupid: An Illustration
By Ken Magill
As Canada prepares to put its anti-spam law C-28 into effect in September, an official summary of it offers a nice—nice being a euphemism for mind numbing—illustration as to why legislating permission is a bad idea.
When the government decrees permission is necessary by law, government must define what exactly constitutes permission.
And sure as night follows day, when government defines permission, we get monstrosities like the following lifted verbatim from a legislative summary of the bill—legislative summary, mind you, not the bill itself:
[Editor’s note: Don’t attempt to read the whole passage. Just read a few sentences here and there and marvel at the sheer density of Canada’s summary of its legal definition of consent to send commercial email.]
Clause11 defines express consent and implied consent for the purposes of FISA. Express consent is what is known as “opt in” consent – commercial communication may not take place unless the person or corporation in question first consents to be contacted. Implied consent is what is known as “opt out” consent – commercial communication may take place with persons or corporations under circumstances where it can be deemed that they might be interested, but the recipients of the communication must be able to “opt out” of such communication. In the case of FISA, implied consent can be assumed in cases where there is an “existing business relationship” or an “existing non-business relationship” between the sender and recipient – clauses 11(10) and 11(13) provide a detailed definition of what constitutes each type of relationship. In the absence of either of these relationships, express consent must be sought for sending any unsolicited commercial electronic messages.
Where express consent is sought, the party seeking it is required under clause 11 to set out “clearly and simply” the purpose(s) for which the consent is being sought, the prescribed information identifying the party seeking consent, and any other information that may be prescribed by the regulations.
FISA incorporates some amendments that were added to its predecessor bill at the Committee stage to provide extra instructions to those seeking consent on behalf of someone whose identity is not known. Under clause 11(2) of FISA, the only information that is required to be provided is the prescribed information identifying the person seeking consent. Other conditions that govern this kind of consent relationship will be detailed in the regulations.
[Editor’s note: a passage outlining permission to install computer programs has been removed.]
The definition of “implied consent” in clause 11(9) of the bill, which again incorporates amendments made to the predecessor bill, now includes a “conspicuous publication” exception, a concept borrowed from Australia and New Zealand. Under this exception, if a recipient has conspicuously published their e-mail contact information, for instance on a business web site, and has not posted with it a disclaimer that it is not to be used for unsolicited electronic commercial messages, then it may be used to contact them on matters relevant to their business or official capacity (clause 11(9)(b)). This exception also applies if the recipient has provided their e-mail contact information to the sender without indicating they do not wish to receive unsolicited commercial messages, and the message is related to their business or official capacity (clause 11(9)(c)). Further exceptions may be specified in the regulations (clause 11(9)(d)).
Those who can assume implied consent because of a business relationship must meet the one of the following criteria (clause 11(10)):
They sold, leased or bartered a product, goods, services, land or an interest or right in land to the message’s recipient within the 2 years before the message was sent.
They provided a business, investment or gaming opportunity that was accepted by the recipient within the preceding 2 years.
They entered into a written contract, which is still active or which expired within the preceding 2 years, with the recipient for any reason.
They received any kind of inquiry from the recipient within the previous 6 months.
Any purchaser of a business is considered to have inherited its existing business relationships for the purposes of the bill (clause 11(12)).
Businesses that may take advantage of this kind of relationship include cooperatives as defined in the Canada Cooperatives Act, cooperative corporations as defined in the Cooperative Credit Associations Act, and any similar organization that is federally or provincially incorporated (clause 11(11)).
Those who can assume implied consent because of a non-business relationship must meet one of the following criteria (clause 11(13)):
The recipient made a donation or gift to them or their organization in the 2 years before the message was sent, and they are a registered charity, or a political party, organization or candidate.
The recipient performed volunteer work for them or their organization or attended a meeting organized by them within the preceding 2 years, and they are a registered charity, or a political party, organization or candidate.
The recipient has been a member of their organization during the 2 years before the message was sent, and they are a club, association or voluntary organization, as defined in the regulations.
Where the existing business or non-business relationship is connected to a membership or an ongoing use or purchase under a subscription, account, loan or similar relationship, the 2-year period is considered to start on the day of its termination (clause 11(14)).
Even where consent of some kind for receiving an unsolicited commercial electronic message is given, the recipient must be able to “opt out” by unsubscribing from the communication. Clause 12 lays out the technical requirements for the mechanism to unsubscribe. It must allow the recipient to indicate, at no cost to him or her, using either the same electronic means by which he or she received the message or any other electronic means that are practicable, the wish not to receive any further messages, and it must specify an electronic address or provide a link to a World Wide Web page by which this indication can be given. The address or link must be valid and work for a period of 60 days following the sending of the original message in which it is contained (clause 12(2)). Any unsubscribe notification received by the sender must be put into effect within 10 business days (clause 12(3)).