Business owners will likely recall the turmoil that set in as they readied themselves for the coming-into-force of Canada's Anti-Spam Legislation ("CASL") on July 1, 2014. For many, it was a mad scramble to ensure that their e-communications did not land them in hot water with the Canada Radio-Television and Communications Commission ("CRTC"). Years later, business owners are similarly concerned about the coming-into-force of CASL's private right of action ("PRA") on July 1, 2017.
What is the PRA?
The PRA, set out in section 47, states that, "a person who alleges that they are affected" by a contravention of CASL "may apply to a court...for an order against one or more persons who they allege are liable for the contravention". In other words, while the CRTC is currently the only entity with the ability to enforce the legislation, as of July 1, 2017 when the PRA comes into force, private individuals will gain the right to sue businesses for violations of CASL.
How does this affect me as a business owner?
Section 51(1)(b)sets out the damages that a court may award where a business is sued under the PRA. Leaving aside recovery of damages for actual harm suffered, businesses may be ordered to pay a maximum of $200 in statutory damages for each contravention of CASL, not exceeding $1,000,000 in total for each day on which a contravention occurred. A large company can be expected to send out thousands of emails per day to its customers, and if even a small percentage of those communications are found to be in contravention of CASL, millions of dollars in damages can accumulate in a very short period of time. This becomes especially concerning to business owners where plaintiffs choose to sue as a class in order to aggregate their damages into a much larger figure.
Why is the PRA only beginning to apply now, three years after CASL came into force?
Back in 2014 when the federal government was about to enact CASL, the Canadian business community was worried about the uncertainty that would come with CASL's enforcement and, in particular, the very large damages that could be awarded under the PRA provisions. There was a strong lobby for a "grace period", so that businesses would have enough time to adjust their practices without facing private lawsuits immediately after CASL came into force. As a result, legislators delayed the coming-into-force of CASL's PRA, allowing businesses three years to bring their conduct in line with the act before private individuals could sue them for violations.
Can someone sue my business for violations that occurred between July 1, 2014 and July 1, 2017?
Because the PRA is not yet in force, we cannot be sure exactly how the courts will interpret the PRA provisions. However, there are some strong arguments that weigh in favour of the PRA applying only after July 1, 2017. For example, there is a common law doctrine which states that statutes should not apply to actions that occurred before they came into force unless there are specific words in the act which make it clear that the statute is meant to apply retroactively. There are no suchwords promoting retroactive application of the PRA provisions. Therefore the better, but not certain, view is that the three year grace period is to be interpreted robustly. However, plaintiff's counsel can be expected to be aggressive and creative, withthe result that it is very likely that the counter-argument, that private individuals should, following July 1, 2017, be able to sue for all violations occurring since July 1, 2014 will be advanced.Given that the July 1, 2017 deadline is fast-approachingprudent business owners should act now to ensure that their communications and software installation practices are in line with CASL. Lawyers at Fogler, Rubinoff LLP are knowledgeable about CASL and able to assist.
Co-written with Hailey Abramsky