First CRTC Compliance and Enforcement Decision for CASL Violation

On October 26, 2016, the Canadian Radio-Television and Telecommunications Commission (CRTC) issued its first Compliance and Enforcement decision for violation of Canada’s Anti-Spam Legislation (CASL).

The CRTC held that Ontario company, Blackstone Learning Corp., was in violation of section 6(1)(a) of CASL. It was alleged that Blackstone had sent 385,668 commercial electronic messages (CEMs) in 9 messaging campaigns to employee electronic addresses at 25 government organizations, all without the consent of the recipients.

The CRTC was made aware of Blackstone’s conduct as a result of approximately 60 complaints received by the CRTC’s Spam Reporting Centre. An investigation led to the CRTC issuing a Notice of Violation to Blackstone in January 2015, which set out an administrative monetary penalty (AMP) of CA$640,000, which, following a review by the CRTC, was later reduced to CA$50,000.

In response, Blackstone exercised its right to challenge the Notice of Violation, arguing that it had implied consent from recipients to send the CEMs, and that the AMP amount was unreasonably high. Under CASL, when a party challenges the violation claim and refuses to pay the AMP, the CRTC must decide, on a balance of probabilities:

1. whether the party did in fact commit the violation, and

2. the reasonableness of the AMP and whether to impose it or make any adjustments to its amount.

[1] Whether Blackstone was in violation of CASL:

While Blackstone didn’t deny sending the CEMs, it argued that it operated under implied consent with its recipients. According to Blackstone, it had “implied consent to send the messages at issue under the ‘conspicuous publication exemption’, based on a broad assertion that the email addresses to which it sent messages were publically available” (para 22 of the Decision), as outlined in section 10(9)(b) of CASL.

​The CRTC rejected Blackstone’s use of this exemption, stating that the public availability of an email address is insufficient. The CRTC held that CASL “does not provide persons sending CEMs with a broad licence to contact any electronic address they find online; rather, it provides for circumstances in which consent can be implied by such publication, to be evaluated on a case-by-case basis” (para 28 of the Decision).

As a result, the CRTC held that Blackstone had neither express nor implied consent to send the CEMs at issue, thus in violation of CASL on all 9 counts. According to paragraph 30 of the Decision, the CRTC reasoned that Blackstone did not provide supporting information with respect to:

• where or how it discovered any of the recipient addresses in question;

• when it obtained them;

• whether their publication was conspicuous;

• whether they were accompanied by a statement indicating that the person does not want to receive unsolicited CEMs; nor

• how the company determined that the messages it was sending were relevant to the roles or functions of the intended recipients.

Thus, the CRTC held that Blackstone’s general assertions that it complied with CASL and that implied consent covers publicly available addresses did not sufficiently address the elements of section 10(9)(b) of CASL.

[2] The Reasonableness of the CA$640,000 AMP

Inter alia, the CRTC concluded the following with respect to each of the factors listed in subsection 20(3) of CASL which must be taken into consideration when determining the amount of an AMP (paras 34-53):

(a) The purpose of the penalty:

• To promote compliance with CASL, not to punish;

• The CRTC must arrive at an amount that is representative of the violations that were committed and that represents enough of an impact on a person to promote changes in behaviour;

• If an AMP would preclude the person from continuing to operate on a commercial basis, it would also preclude their compliant participation in the regulated activity going forward.

Conclusion: a lower penalty than the one set out in the Notice of Violation would be appropriate.

(b) The nature and scope of the violation:

• 385,668 CEMs were sent, which occurred between July 9 and September 18, 2014;

• The CEMs were sent to employee electronic addresses at 25 Canadian federal and provincial government organizations;

• The CEMs did not discuss the cost of the programs being offered, but the nature of the language used, including references to various discounts and group rates, conveyed that these courses were services available for purchase from Blackstone;

• While the number of unsolicited messages sent by Blackstone was significant and the messages were disruptive, the duration of the violations in question of approximately two months was relatively short.

Conclusion: a lower penalty than the one set out in the Notice of Violation would be appropriate.

(c) Previous history with respect to any previous violations under CASL, under section 74.011 of the Competition Act, or section 5 of the Personal Information Protection and Electronic Documents Act (PIPEDA)

(d) History with respect to any previous undertaking entered into under subsection 21(1) of CASL and any previous consent agreement signed under subsection 74.12(1) of the Competition Act relating to conduct reviewable under section 74.011 of that Act

• Blackstone had no history of violations or undertakings under the relevant acts;

• CASL is a fairly new regulatory regime.​

(e) Any financial benefit obtained from the commission of the violation:

• some purchases were made that may be attributable to the violations, but there was insufficient information available to quantify or assess the extent of the benefit Blackstone may have received through committing the violations.​

(f) Ability to pay the penalty:

• Blackstone did not respond to the notice to produce financial information, therefore this factor could not be taken into consideration;

• Instead, and with full permission, Blackstone submitted unaudited income statements for the preceding two years;

• Blackstone is a small business, and the amount of the AMP significantly exceeded the company’s ability to pay and would represent several years’ worth of its annual revenues. ​

Conclusion: this factor does not appear to have influenced the assessment of the AMP set out in the notice of violation.

(g) Whether the party has voluntarily paid compensation to a party affected by the violation:

• Nothing to indicate this.

(h) ​The factors established by the regulations; and

• No applicable additional factors.

(i) Any other relevant factor:

• Lack of cooperation with respect to a notice to produce, which may speak to the necessity of a penalty to ensure compliance with the regime;

• Low likelihood of self-correction because Blackstone’s non-compliant behaviour did not change after it received the notice to produce;

• Blackstone did, however, make inquiries to the investigator following the issuance of the notice to produce about the nature of the problem, which provides some evidence of self-correction;

• Blackstone corresponded with the Department of Industry in an effort to understand CASL as it applied to its business practices before it came into force, thus showing the company was aware of and concerned with compliance;

• Some guidance with respect to implied consent was published only after the violations in this case occurred.

Conclusion: a lower penalty than the one set out in the Notice of Violation would be appropriate.

As a result of considering these factors, the CRTC imposed a lower AMP of CA$50,000, which it deemed to be proportional and reasonable in order to ensure compliance and deterrence with CASL.

The significance of this decision lies among the fact that it is the first to provide guidance on compliance with CASL in this context; before this decision, enforcement actions have been in the form of settlements reached between the Enforcement Branch and the infringing party.

Blackstone was ordered to pay its CA$50,000 AMP by November 25, 2016.

Full decision: Compliance and Enforcement Decision CRTC 2016-428