INDU Committee Meeting

     Could I get everybody to take their seats, please.

    Good morning. We have lots to do today. We really need to get this show on the road—“this show on the road”; I don't know how we say that in French.

    Welcome, everybody, to meeting 77. We're continuing our—

    Let the games begin.

     —que le spectacle commence. I like that. Let the games begin.

    We are continuing our study of the anti-spam motion. Today we have with us, as an individual, Stephanie Provato, associate Buchli Goldstein LLP. We have from the Canadian Marketing Association, David Elder, special digital privacy counsel; and Wally Hill, vice-president, government and consumer affairs. From Lighten CASL we have Andrew Schiestel, founder. From the Retail Council of Canada, we have Jason McLinton, vice-president, grocery division and regulatory affairs.

    Before we begin, Mr. Sheehan, you have something.

    Thank you very much, Mr. Chair.

    I just wanted to introduce a notice of motion to the committee. It's in both English and French. It's going to be distributed by the clerk. I'll just read it in.

    Okay.

    Can we get a copy first before you read it?

    Yes. They're being passed around right now.

    Does everyone have a copy?

    Okay. Mr. Sheehan, go ahead.

    First of all, happy anniversary, everyone, on being elected. It's our two-year anniversary.

    I'm just introducing this as a notice of motion to be dealt with later. The notice states,

    Thank you very much.

    That will go on the record.

    Mr. Masse.

    I would ask for a friendly amendment that the committee also consider additional meetings to make this motion possible.

    It's actually non-debatable because it's just a notice of motion. But when it does get introduced, you can put forward your friendly motion.

    Can I amend it before it actually is put forward?

    Maybe I will talk with Mr. Sheehan, then.

    I would prefer that we get on with studying the steel industry and not have to wait for business to come up. We could actually do this motion rather quickly by adding meetings as opposed to our regular business. I hope we've actually scheduled this as a priority coming up maybe for Tuesday. I'm just wondering when our next order of business is, as we have new orders. We could discuss this on Tuesday if possible.

    As it currently stands, we have witness testimony for anti-spam on Thursday and Tuesday. Tuesday is actually a full day. We could probably carve out 15 minutes on Thursday the 26th.

    Sure. If that works for everybody, then I'm happy.

    Would that work?

    I'm fine with that. Absolutely.

    Fair enough. Thank you. Let's carve out some time on the 26th.

    Excellent. We're going to move on.

    Stephanie Provato, you have eight minutes please.

     Thank you, Mr. Chair, and committee members for giving me the opportunity to speak to you today.

    By way of a brief introduction, my name is Stephanie Provato and I'm an associate lawyer at Buchli Goldstein in Toronto.

    My involvement with CASL to date has been evaluating the legislation from a constitutional perspective. CASL has been on my radar since before it came into force. In 2014 my paper challenging the constitutional validity of the legislation was published in The John Marshall Journal of Information Technology & Privacy Law. I think it was the first academic paper to take this up, and it garnered a lot of attention. I have since been serving as an adviser with the Lighten CASL initiative, which aims to put forward recommendations to break down some of the, in our opinion, unclear and onerous aspects of the legislation.

    However, I'm here today in my individual capacity because I've been advocating in favour of statutory review of the legislation. I think what the committee is doing is very important, and I believe that reform is necessary.

    I'd like to present to the committee the position that CASL unjustifiably restricts the fundamental right to freedom of expression, which is protected by section 2(b) of the Charter of Rights. Consequently, the legislation would not withstand a charter challenge on the basis that it would fail the proportionality element of the section 1 Oakes test, particularly the branches of minimal impairment and proportionate impact and effect.

    I have a quick charter crash course for the Oakes test branches to give to you today. Under the minimal impairment branch, a law that impairs a right protected by the charter will be deemed constitutional only if it impairs the charter right as minimally as possible. What is looked at is whether the limit being placed on this right is restricted to no greater an extent than what is necessary for the government to achieve its objective. When looking at the proportionate impact and effect branch, what is considered is whether proportionality exists between the government's objective of the law and the adverse effects of the law.

    I'd like to establish right out the gate, which is important in a charter analysis, that the definition of “commercial electronic messages”, CEMs, includes commercial activity, which case law has established falls within the scope of “expression” protected in section 2(b). CEMs qualify as a type of expression that is protected by the charter.

    To begin the charter analysis, I want to look at the definitions of “family relationships” and “personal relationships” within CASL. The definition of “family relationships” in the regulations is extremely limited. It includes only individuals related to one another through marriage, common-law partnership, or a legal parent-child relationship. This definition ignores the true reach of who in reality is family. It turns family into strangers. It ends up making completely valid communication between completely acceptable parties illegal. Basically, you can't do something like send an email to a second cousin—who many would consider to be family—offering to sell something like a hand-me-down baby crib. The other thing is that messages sent to relatives who are more than a distant lineal descendant, which is only what the act allows, are unlikely to be the electronic—quote, unquote—“threats” that the legislation was intended to target.

    I'll move to the “personal relationship” definition in the act. It focuses on factors such as the frequency of communication, the length of time since the parties communicated, and whether the parties have met in person. This is problematic because it's also very limiting. It shuts out and is naive to the reality of what people consider to be personal relationships, which includes colleagues, friends of friends, people you've been out of touch with, people you connect with online, people you have just met, and acquaintances. All of these could be personal relationships, all in different degrees.

    Looking at these two definitions shows the problematic nature of the way CASL dictates who can communicate with one another. Dictating who can communicate isn't an issue if you're talking about restricting communication between malicious spammers and an innocent person. However, that's not all that's happening here. There is a restriction on expression here, because CASL casts the net so wide that it is catching and restricting harmless communication that it doesn't need to and didn't intend to in order to achieve its objective. That can't be said to be proportional to fighting spam.

    In effect, it will discourage people from communicating and using electronic means to do so, and it will stunt social networking, especially since penalties for non-compliance are so high. It is difficult to fathom how these effects on expression are justifiably reasonable, minimally impairing, and proportionate to pass a charter challenge.

    I want to move to CASL's definition of “existing business relationship” for implied consent. It is also an example of how the legislation can have the unjustified and disproportionate effect of infringing on the freedom of expression, this time on small and medium-sized businesses.

     These businesses cannot rely on the existing business relationship exemption because, unlike larger and more established businesses, they don't have existing or ongoing business relationships to leverage. Therefore, in effect, they are being restricted from communicating with and reaching the public. This is putting them at a competitive disadvantage. They are hindered from being able to start up, grow, compete, and participate in the marketplace. It may even hinder their ability to provide better and more customized products and services for their clients, thus reducing innovation.

    Additionally, the onerous burdens to comply with CASL, along with the high monetary risk and price to pay for non-compliance, may discourage these businesses from participating in the marketplace at all, or in the way they want to, which ends up silencing their voice and their overall impact in the economy. This negative and hindering effect, both on these businesses and the Canadian economy as a whole, can hardly be seen as minimally impairing, especially since small and medium-sized businesses make up a significant portion of the Canadian economy.

    These examples highlight the importance of having intelligible standards when it comes to definitions within CASL. Failure to provide clear notice to the public as to which conduct is the subject of legal restrictions is often raised in charter challenges, and it has been held that restrictive law must provide intelligible standards that delineate the risk zone, allowing for legal guidance and accountability.

    At the end of the day, CASL has set out these categories of permitted and acceptable commercial speech, which has a chilling effect of restricting legitimate expression and beneficial commercial speech and reducing the free flow of information and ideas. CASL is a disproportionate response to fighting spam, when its adverse effects are compared to the government's objective. CASL cannot be said to be restricting the freedom of expression as minimally as possible. It restricts expression to a greater extent than what is necessary in order for it to achieve its objective. In a nutshell, CASL is inefficient. This is problematic, because an effective law is an efficient law. Even the name itself isn't efficient: “an act to promote the efficiency and adaptability of the Canadian economy...blah blah blah”. That's my eight minutes right there.

     On top of that, a charter infringement is too high a price to pay for the benefit of the law. It is important for the committee to consider the fact that CASL needs to be recalibrated so that it delineates clear standards, both on paper and in practice, because, as of right now, its effects are disproportionate to its objective in a way that cannot be justified to override what is protected in the charter.

    Thank you very much for that. It's too bad we can't just call it “an act to blah blah blah”.

    We're going to move to Mr. Hill for eight minutes.

    Mr. Chair, I have a quick question.

    Before others start, I want to get a point of clarification about the list. It's so wonderful to have everyone here. This committee, like all our parliamentary committees, looks to hear from a range of voices.

    I know, Ms. Provato, that you are speaking on your own behalf, but you are part of the Lighten CASL organization as well. I just want to be sure that we actually have two individuals speaking from the same organization, just so we know whom we have in front of us today.

    Correct, I serve as an adviser with the Lighten CASL committee, but I believe that Andrew's submissions today—

     I can speak to it. Stephanie is not speaking in an official capacity on behalf of Lighten CASL. She is an adviser. There are lots of advisers to Lighten CASL.

    I am speaking as an official representative of Lighten CASL.

    Thank you.

    Mr. Masse, go ahead.

    On this note, we had that happen in the last meeting, too. We should probably have a special notation in our notes, because it's important for these things to be very clear so that the crossovers aren't misinterpreted.

    That's a good point. Thank you.

    Mr. Hill, you have eight minutes.

     Mr. Chairman, thank you to the committee for the invitation to present the Canadian Marketing Association's views on this important review of Canada's anti-spam law.

    CMA's membership includes most major financial institutions, major retailers, large technology companies, and of course, many marketing agencies and related suppliers across the country. CMA was a member of the 2004 federal task force on spam, and we have long supported some form of regulation to encourage good electronic messaging practices and to deter spam. Our requirement for email marketing, including proper identification of senders, unsubscribe links and lists, opt-in for sensitive communications, all predated CASL by at least a decade.

    CMA commends the government and Minister Bains for listening to stakeholders and recently suspending the private right of action. We believe these hearings are an important opportunity for parliamentarians to review the law to see if it's working as intended.

    What effect has CASL had in the marketplace and is it well crafted to promote a positive e-commerce environment for both consumers and businesses? On the positive side, the law has encouraged wider adoption of good marketing practices. Companies are more aware and taking steps to ensure CASL compliance. Some surveys also indicate that many users feel they're getting less spam, although the filters provided by our own organizations and Internet providers do much to protect us from both the dangers and inconvenience of spam.

    On the other hand, CASL has had very limited impact on the most damaging forms of spam: botnets, phishing scams, fraudulent product claims, malware, and the like all seem to be as prevalent as ever. Yet most CASL enforcement efforts seem to have been focused on legitimate companies sending messages to customers or prospects.

    In addition, certain features of CASL have also created confusion and uncertainty for organizations, a concern compounded by the potential for the enormous penalties resulting from something like a broken unsubscribe link.

    These uncertainties have a chilling effect on electronic marketing in Canada. Many businesses are avoiding legitimate email marketing campaigns out of fear of inadvertently running afoul of CASL. This effect is directly counter to CASL's stated objective of promoting the efficiency and adaptability of the Canadian economy.

    Scott Smith from the chamber appeared here a couple of weeks back, and he mentioned that the chamber, Canadian Marketing Association, the Retail Council, and some other associations are surveying our members about CASL. Interim results are showing that over 40% of respondents indicate they are doing less electronic marketing since CASL took effect, that over 65% say that CASL has put their competitive edge at risk, and over 80% say that CASL is too complicated and confusing. We will be providing the committee with the complete survey results in another 10 days or so.

    CMA has a number of suggestions to improve CASL, which we will capture in more detail in our written brief to the committee, but today I want to focus on six key issues and suggestions.

    The first is business to business. CASL has created unnecessary barriers for businesses prospecting for new customers in the B to B environment. These limitations on email prospecting create inefficiencies with businesses resorting to more expensive and time-consuming contact methods. Particularly in the B to B environment, the issue of gaining consent, checking lists, and keeping detailed records becomes an impractical nightmare for organizations dealing with groups of salespeople who daily make any number of one-off communications.

    We would suggest that CASL should be amended so it does not apply to B to B messages. This approach would be in line with the telemarketing regulations and the national do not call list.

    Subsection 6(6) you've heard about already in some detail. It's created a lot of confusion as to what CASL is intended to cover since the messages described in subsection 6(6) are commonly referred to as transactional service security-type messages. Businesses aren't sure how to comply with that subsection. They are at risk if they don't, and if they do, they are likely to confuse their customers. The solution here is to amend CASL to make it very clear that it doesn't apply to transactional or service messages.

    Like many others, CMA has argued that CASL should have used the PIPEDA approach to consent, with express consent required in relation to sensitive matters of communication, and valid implied consent required for most other commercial electronic communication and backed up, forcefully, with the unsubscribe offer on every message.

     We hope the committee will consider looking closely at consent, but in the absence of such a fundamental change to the law, it should be noted that the current rules for implied consent are challenging for many organizations. The two-year and six-month rule that was mentioned a moment ago creates a systems and data entry headache for many small and medium-sized organizations. Every customer must be tracked so that a two-year clock starts ticking after their latest transaction.

    When the two years expire, the organization loses the implied consent to message that customer, but there's an “unsubscribe” on every message and the consumer can opt out at any time, whether it's at two weeks, two months, 24 months, or 30 months. Why create a cumbersome 24-month rule for organizations? It's rather arbitrary, and it creates a serious data management challenge for organizations. Our solution to this would be to simply remove the unnecessary six-month and two-year definitions in the EBR and, where there's a customer relationship or interaction, permit messages to be sent based on implied consent unless or until the consumer signals otherwise.

    We're also concerned about the burden of record-keeping. Some organizations are not even using the exemptions in the law because of the related record-keeping requirements, which are too onerous. You have examples. For example, if you obtain express consent from a customer at a retail counter, the CRTC has suggested that you should have a voice recording as evidence of that. The solution here is that the government, as opposed to the CRTC, should develop regulations indicating what are acceptable records and, we would hope, endorse reasonable, ordinary business records.

    On the private right of action, I won't revisit the points of concern, because you've heard about them from many others. We simply propose that the private right of action is unnecessary. There are three regulators enforcing this law. The private right of action should be removed from the law or significantly narrowed so as to eliminate statutory damages and/or restrict its availability to ISPs.

    On enforcement and penalties, the CMA considers that to date the penalties imposed under CASL are not proportional to the nature of the violations to which they relate. Massive penalties against legitimate companies that made minor errors while attempting to comply with CASL are creating a chill on legitimate marketing activity.

    I'm going to ask David Elder to bring his legal expertise to bear and comment on the CRTC enforcement structure.

     In the limited time I have, in addition to those two points that Wally raised about disproportionate penalties and perhaps the wrong target audience, I would say that part of the problem with CASL enforcement is that we don't know where the lines are being drawn when enforcement decisions are made and put out. We only get vague summaries, and we don't really know what sorts of decisions are being made and how this is being interpreted.

    The other point I would make is that I think there's a structural flaw within the law, in that all of the powers—the enforcement investigation powers—are given to staff members of the CRTC. The GIC appointees of the commission don't have a role and can't provide any guidance or input unless and until a notice of violation is actually issued and a party decides to effectively appeal that to the commission.

    Thank you very much.

    We're going to move to Mr. Schiestel.

     Thanks, Dan.

    Committee, Dan was very kind before this and said he'd pinch his fingers when I'm coming up to eight minutes, so I appreciate that, Dan.

    My name is Andrew Schiestel. Thank you for having me.

    By way of background, I'm the current president and chair of the London Chamber of Commerce, and president of tbk Creative, which is a web design and digital marketing agency based in London, Ontario with 20 staff members. I'm the founder of Lighten CASL, which is a not-for-profit organization committed to seeing CASL improved to be easier for companies to comply with while still protecting consumers. In 2015, through the London Chamber of Commerce, I was one of the authors of the Canadian Chamber of Commerce policy paper on CASL reform, which was delegate approved at the 2015 Canadian Chamber AGM. I currently serve on the Canadian Chamber of Commerce policy task force on CASL reform, and articles I've written on CASL have appeared in the Financial Post, The Globe and Mail, and The London Free Press.

    I don't think anybody is denying that CASL had good intentions in its creation. We need anti-spam legislation that thwarts harassing CEMs, people who ignore unsubscribe requests, malicious spam, and cybersecurity threats. We need strong legislation to stop those malicious actions, but CASL overextended its aim, and it has left our Canadian companies in a situation where it's anti-competitive to comply with when they're competing against foreign companies. It's excessively expensive to comply with as well, and I'll give examples of both.

    It's anti-competitive to comply with, so let's take a Canadian retailer for instance. They are going to run a sweepstake, which they will oftentimes do as part of thriving as a business. When they're setting up that page, they need to do a lot of things financially. They need to pay money to set up the page with web design costs. They have to spend money on a prize. They could be giving away a vehicle to a consumer. They spend money on legals. If they're in a certain province, like Quebec, they might register the contest with the proper regulator. There are human resource costs, advertising costs, and the list goes on.

    What they'll then do is have an opt-in mechanism, a check box that's unchecked, and in my experience in the digital marketing profession, I find that, give or take, 50% of consumers, when they're entering these types of sweepstakes, will check that box. So then what the business is left with is a situation where they have expressed consent under CASL for the 50%, but then, for the other 50% who don't check the box, they don't have expressed consent, but they also don't have implied consent because the provisions of applied consent under CASL are too narrow. But that would be kind of a practical situation where consent may be implied, since the consumer gave the business their contact information in the first place.

    All that might sound fine if Canada were in a vacuum, but we're not. We compete against companies around the world. In the same situation in the U.S., a retailer, a competitor to our Canadian company, is running a sweepstake. Under the CAN-SPAM Act, 100% of the leads that they get in they can send to them what CAN-SPAM calls commercial electronic mail messages, which are essentially the same thing as a CEM. When you break that down, a Canadian company in that situation can send CEMs to 50% of the leads they get in, and the U.S. company can send to 100% of the leads they get. The consumer is always protected because they can unsubscribe at any time. That's one of the instances that puts our companies at a competitive disadvantage.

    Number two is that the act is excessively expensive for companies to comply with. I'm going to bring up—and this was brought up by Wally, with the CMA—the two-year and six-month rules. I think Stephanie also brought this up earlier. I'll give a real, pragmatic example of how a company can go about implementing this, because I've worked with companies who are grappling with this situation.

    If you're a company, and you have a lead coming into your website—say it's a home renovation company—under CASL, you have two years from the date of last purchase and six months from the date of inquiry if the consumer doesn't provide express consent. Here's where it gets tricky. You need to spend money on a software solution that will know to purge that user after six months from the date of that inquiry. If the consumer purchases a product, you have to reset the timeline to purge them in your system two years from the date of that purchase. If they purchase again, your software solution has to reset it again. If they provide express consent during that two-year period, then you change the label, and now it's express consent. If they buy another product, it has to have the intelligence not to reset as two years, though, because they provided express consent. Is anybody confused yet?

    That's one of the fundamental issues with CASL. The real cost of that is minimum five figures, and definitely six figures in a lot of instances, to build and maintain software to do that. You have to integrate it into your CRM or ERP, communicate through a bridge with your email marketing software, and vice versa. It has to go back and update accordingly. It's a big software project.

    Take that one instance and scale it out now to the approximately 1.17 million companies in Canada, and you're looking at a very problematic situation for our economy and our Canadian businesses.

     On September 26 the INDU committee had CRTC in and the conversation kept coming up about more education. Businesses don't need more education on spam. CRTC has probably done a very good job on the balance of things with education. I think businesses, on the balance of things, are very capable people. What we need is legislation that's improved to be easier for businesses to comply with while still protecting consumers. I think fundamentally it's an issue with the act itself. That's why we're still doing all this training after three years.

    Also, what I've just said above isn't theoretical. It's actually happening every day in our businesses. I'm going to give two examples.

    Earlier this year I spoke with a financial services company with 600 employees based in southwestern Ontario. They sell RRSPs, mortgages, bank account services, etc. I chatted with a vice-president and a marketing manager there. They told me that when somebody inquires on their website, they do not send out any group CEMs to that person even though that consumer provided them their email. They said that they do not want to take the risk of violating CASL with the six-month rule so they would rather not send out group CEMs at all in that instance. But this is a situation where the consumer has actually provided this company their information in the context of receiving services down the road. Again, if Canada were in a vacuum, that would be fine, but they compete against fintech companies all over the world that are emailing Canadians all the time ignoring CASL, or not even aware of CASL.

    As a second example, earlier this year I spoke with a software company. They have 100 employees, and they sell globally. I spoke with the director of marketing. She told me they went through a recent web design project where they had to build a form for users to contact them from around the world and they had a decision to make. With option A they needed to have a form that would be dynamic, so if a Canadian put in their information, it would switch the information so that it complied with more stringent consent requirements under CASL. With option B the form would be static so it's universal, but they won't send CEMs to Canadians to fill out the form. They'll only use the phone. Guess what option they chose? Option B. They chose to have it static and they won't send CEMs to Canadians for filling out that form. They'll only use the phone in that case. It's not worth the risk to them.

    What can be done? Number one, I would recommend expanding the circumstances in which implied consent is present. Here are some examples. If one party gives their information to another party, call it consent. Two people mutually connected on a social networking or instant networking website call that consent as well. As other witnesses said, remove the two-year and six-month rules. A consumer might not be ready to buy another house from the realtor within two years, but there still might be an affinity there and they can unsubscribe at any time. Remove those rules. Google and Shopper Sciences did a study and some purchases take over one year to actually complete, especially when it comes to tech and appliances.

    In the coming weeks, look for the Canadian Chamber to provide some additional recommendations on some of the nuances of CASL reform and some of the software recommendations.

    Thank you to the INDU committee for the important work that you're doing. CASL can be improved to be easier for companies to comply with while still protecting consumers. By finding the right balance with this policy, we can set Canada up to thrive in the digital economy.

    Thank you, and thank you, Dan, for the extra 30 seconds.

    Thank you very much.

    We're going to move to Mr. McLinton.

    You have five minutes because he ate up your time. No, you have eight minutes.

    I would like to personally thank Andrew for that.

    Mr. Chair and members of the committee, thank you for the opportunity to talk about Canada's anti-spam legislation.

    I'll start by saying that members of the Retail Council are very supportive of anti-spam legislation that actually targets fraudulent malicious spammers—the Nigerian prince who is asking for money and that sort of thing. What it does ultimately is it raises confidence in the digital economy. It raises confidence in legitimate marketing activities, but unfortunately, I think CASL has gone far beyond its original intent, and as many of the other witnesses have expressed just now, in the end has had limited success in targeting the Nigerian princes. I shouldn't pick on that, but I just personally received that email myself.

    Unfortunately, this costs businesses significantly, not only in terms of systems to comply with the legislation, but also in terms of the ability to do certain types of marketing because they're erring on the side of caution given the way that CASL has been drafted. But that's all right because RCC has a five point plan to solve all of this. I will, without further ado, get right into that.

    However, before I begin, I would just like to quickly introduce the Retail Council of Canada (RCC).

    The retail industry is the largest private employer in Canada. Over 2.1 million Canadians work in our industry. In 2016, the sector generated wages estimated at more than $73 billion, and the sales of the sector reached $353 billion. The RCC is a not-for-profit, industry-funded association representing small, medium and large retailers in communities across the country.

     One of the things that perhaps differentiates the Retail Council from some of the other witnesses here and some other associations is that it is uniquely retail. It represents all sizes, from general merchandising to grocery to hardware to apparel, and from family-owned independent businesses all the way to the largest retailers that you would all recognize.

    RCC has a five-point plan to remove the unnecessary red tape in CASL, help contain costs for retailers, and offer the most competitive prices to Canadian consumers:

    Number one, only cover activities that are clearly intended to engage the recipient in a new commercial activity.

    Number two, provide common-sense clarifications to CASL's unsubscribe provisions.

    Number three, allow for additional flexibility in the definition of “express consent”.

    Number four, include a consideration of intent.

    Number five, repeal the private right of action provisions permanently.

    On the first point, covering activity that is clearly intended to engage the recipient in a new commercial activity, the definition of “commercial electronic activity” or CEM should be amended to include only messages that are principally intended to engage the recipient in a new commercial activity.

    The challenge here is that many of our members—again, erring on the side of caution and sometimes based on the guidance and advice of the CRTC and on jurisprudence—are concerned about some of the normal emails they send. For example, their message might be providing a receipt or confirmation of purchase, or something along those lines, and then at the bottom it happens to have a caption, as part of the signature block, that says, “shop at our store”. It might contain a link to their website, where, as a separate activity, the consumer may or may not purchase something. Our members worry that it might constitute a commercial electronic message and therefore be covered by CASL.

    Clearly, the legislation wasn't meant to cover that sort of thing. The RCC respectfully requests that the committee consider making a recommendation to clarify the legislation to ensure that kind of messaging is not covered.

     To the second point, on common-sense clarifications to CASL's unsubscribe mechanisms, most consumers identify by brand and may not be aware that a certain company owns several retail outlets or several brands. I won't name any specifically, but if a consumer were to sign up for a specific brand's messaging, and then wanted to unsubscribe from that messaging, the way that the legislation is currently written it is unclear. Certainly, many of RCC's members err on the side of caution, which means they are unsubscribing consumers from all of the brands that the company owns, which is neither in the business interest of the retailer nor in the interest of the consumer.

    For example, I subscribe to CEMs from a toy store, and that toy store happens to be owned by a hardware store that has a number of other stores. I want to unsubscribe from that toy store's messages. Right now, the way that it's being interpreted by most of our members is that they are unsubscribing from every message, every brand, that the hardware store owns, and that's not in the interest of business nor in the interest of the consumer.

    The same thing goes with the type of messaging. Perhaps I want to receive a newsletter from that toy store, but I don't want to receive another type of messaging from that store. There should be a clarification in the legislation to allow consumers to unsubscribe specifically from brands or types of messaging for which the consent was given in the first place, and it should be clarified that they're not inadvertently unsubscribing from everything.

    To my third point, on additional flexibility on the definition of “express consent”, the current definition appears to require that every conceivable purpose for consent be included in the request, which is unwieldy and very bulky. The way it's being worded now by many of our members is very lengthy and refers to emails and whatever other types of messaging. I think the legislation should be amended to specifically allow for reasonable, similar types of messaging so that it's in the best interests of business and consumers that the consent request is very simple and straightforward, and not this big legalistic blurb. My apologies to the attorneys on the panel that it be easy to read.

    Include a consideration of intent. Companies that are trying to comply and that are 99% compliant, that may have inadvertently made a mistake and sent one message, are not the same as that nasty, fraudulent, malicious spammer, and therefore should not be subject to the same compliance and enforcement actions and penalties. The legislation should include a consideration of consent. Finally, the private right of action provisions should be repealed permanently. Canadian retailers need to operate in a certain and stable environment. I think that would only serve to benefit litigators.

    There is one final thing I'd like to flag to the committee, although it's not part of the five-point plan. I love my loyalty programs. Most Canadian consumers and businesses love them. Loyalty programs are challenging right now. It's a bit of a grey area in terms of whether you can send messages to members of loyalty programs. I just wanted to flag that and let you know that the Retail Council will be working with members of former Industry Canada, now ISED, and CRTC to solve that problem.

    In conclusion, thank you once again for the opportunity to share with you the retailers' perspective on Canada's anti-spam legislation.

    Thank you very much.

    Thank you to all of our presenters. I'm sure we're going to have lots of good questions today.

    We're going to move right into questioning starting off with Mr. Baylis. You have seven minutes.

    Thank you, Chair.

    We've had a lot of different witnesses here and there seems to be a real theme that no one is against the original intent of the legislation, which is to attack the malware, or let's call it the fraudulent or malicious spam that's out there. We did hear that there's been no concrete action taken against those players in the market, and the people who are getting swept up are the people who you represent, the legitimate business operators.

     I understand the corrections that are needed to make your business work smoother and better. Do you have any suggestions with respect to how we should be doing that or what we should be doing to focus on those bad players?

    I'll start with you, Mr. Hill.

    Well, I think clarify in the law, for starters, how the penalties are set up. The penalties section just applies broadly to messaging, malware.

    The government really could send a strong message, and I think this needs to be done by government, by putting in place the necessary regulations that would instruct the business community and the enforcement agency how they are to apply penalties. I'll let David Elder speak—

     Pull it in to say where you have the private right of action...I know that nobody would like to see the private right of action, because the people who would be targeted are the legitimate businesses—

    That's correct.

    —because the illegitimate businesses, as I've said before, don't come and testify before us, and if you do try to get a right of action against them, they're going to disappear.

    Right.

    If we were to change the penalty section—and maybe I'll move it to Andrew.

    You also touched on the same issue. Would looking at the penalty section and tweaking that or directing it such that the heavy penalties and the enforcement part were really directed more at those malicious players be an approach we should look at?

    Yes, and I would add that if Canada has some of the most stringent anti-spam legislation in the world, I think one of the problems with that is that oftentimes companies and regulators in different countries prefer that regulations match each other so that they're more universal. Maybe one thing to look at would be to try to get CASL more in alignment with what may be common, more international standards.

    For instance, I think it would be very hard for our Canadian regulators to go to the U.S. right now and to try to fine a U.S. company up to $10 million for sending out commercial electronic messages to Canadians that perfectly comply with the CAN-SPAM Act. I don't think that would happen.

    Essentially, if I understand correctly, we haven't attacked people who are on Canadian soil, and certainly, you're saying, it's going to be hard to go after people who are not on Canadian soil and who are sending out malicious spam.

    To my knowledge, based on CRTC's and ISED's testimony, there have been no fines to date against foreign entities under CASL. To date there have been eight fines and they've all been against Canadian entities. Something needs to be done to go after more foreign entities. I think one of the ways to do that is to create better alignment with the legislation where those foreign entities are so that regulators are going to be more willing to actually enforce our laws or their own laws against those spammers.

    As an approach though, before we start going after people who are not on Canadian soil, we should at least make sure our own backyard is cleaned up. My understanding is that we have not gone after malicious players in our own backyard. Have you seen us do that or not?

    I think in the September 26 meeting someone cited a Toronto malware takedown. Some of my other colleagues may know more about that. There was one citation that I'm aware of.

    So out of the eight actions, only one has actually been against what this was originally targeted for?

    I would say that's so to some degree. I would say there have been probably a couple of instances in which it looked as though some people may not have been following unsubscribe mechanisms. I think the legislation should be improved so that it's properly thwarting the harassing type of CEMs. That includes when somebody is ignoring unsubscribe mechanisms, as well as malicious spam and malware types of stuff.

    Thank you.

    I will turn to Mr. McLinton.

    You represent all our retailers. You said that you would like the legislation to be targeted at certain players.

    You gave an example. I will not name the country, of course. You gave the example of a place where there are still problems, but the real problem of malicious spammers is not being tackled.

    In your view, how could we change the legislation to target those people?

    Thank you for the question, Mr. Baylis.

    I would give an answer similar to the one I would have given to your first question, and what I think is an excellent suggestion, which is to amend the provisions having to do with the administrative penalties and compliance and enforcement with that consideration of intent, so that those really stiff fines are focused on those fraudulent and malicious intentional spammers. Doing that would do two things. It would not only get at the real issue and clean up, as you correctly say, our own backyard, but it would also create a more stable and certain business environment that would allow Canadian retailers and other Canadian businesses to prosper. It's a win-win, and my suggestion would be to amend that section and include a consideration of intent.

    Thank you.

    Mr. Elder, I think you had something you wanted to raise.

    I did, just briefly. I just want to make something clear. We're talking about it being aimed at damaging and deceptive types of spam. I want to make it clear that the electronic messaging provisions of CASL don't target those. The sections in CASL aren't about the Nigerian princes and aren't about phishing scams. They're about marketing messages. They're about messages that encourage—

     That's an issue we've heard many times, which is about the commercial messages. First of all, everybody has told us it's way too broad, and it's capturing necessary communications as commercial communications. We understand that. But you're also saying we might want to look at putting definitions specifically about malicious communications, and if we have a definition on malicious communications, linking it to penalties in that light.

    If it is, or—

    Very quickly.

    I guess the answer is I think those are illegal. This is criminal behaviour. I think the solution maybe is directing resources there to go after them, but the CRTC is not going to bring down the Nigerian prince over a phishing scam because it's not even within their authority or their jurisdiction.

    Thank you.

    Mr. Eglinski, you have seven minutes.

     Thank you, Mr. Chair.

    I would like to thank all the witnesses for coming again. I'll start off with Stephanie down there at the end because everybody has left her alone so far.

    It was very interesting what you were saying about where they cut off the line of the family. I wonder if you could explain that in a little more detail. Is that just a presumption on your side that if I was to telemarket my cousin, and he was mad, he could lay a charge against me? Is it a presumption or has that happened?

    Could you clarify the family situation a little bit more, please?

    I think it came to that because I looked at what the definition actually laid out. I think that's what a lot of people, businesses, and individuals are having a difficult time with, looking at the law and seeing what it's actually laying out.

    It's being specific in the sense that it's saying that people are considered family if they fall under a marriage, common-law partnership, or any legal parent-child relationship. That doesn't leave open any room for people who do consider second cousins to be family, for example.

    Although my example was hypothetical, I do think it is relevant, and I think there are situations where you are reaching out to somebody who would be technically your family member, but CASL doesn't consider them to be your family so I think there's a disconnect there.

    I think everybody brought up the two-year and the six-month situation. I come from a rural area. All the businesses are basically in rural areas. Some of them have international connections with forestry companies and that stuff, but the managers probably know each other, and most of the businessman know each other in each one of the communities.

    With the rule regarding two years and six months, does it specifically say in CASL that the contact has to be recorded information on the computer? I'm thinking about my hometown of Edson. We're all at the hockey rink on Saturday, and half the businesses are there. They may have verbal contact back and forth. Their kids might be playing on opposite teams. The verbal contact might not be the best. In the smaller rural communities, we have that interconnect all the time because everybody knows everybody.

    Can you tell me if that would apply or not apply? Does it specifically say it has to be recorded on your computer?

    It doesn't say it has to be recorded on a computer, but the law is very stringent in saying that it gives implied consent to contact people where you have an existing business relationship. That is defined as where there's a transaction that takes place, or an inquiry, or request for a quote, which could happen at the local arena.

    In that case, in an inquiry you have six months, but it's very stringent that way. You don't need to put it in your computer, but the reality is there's a clock ticking, and the penalties under this act are huge. Frankly, if you get it wrong, and you go beyond the two-year period, and you're still messaging someone, you could find yourself in difficulty.

    The reality is every single message that is going to someone as a result of an interaction includes an unsubscribe. The consumer at any point can indicate that he or she doesn't want to hear from you anymore. This six-month, 24-month component of the law was just thrown in there arbitrarily. Someone sat around and asked when they are going to cut this off. The answer should have been that we don't need to, that the consumer will do it.

    Thank you.

    I have a two-part question. I'll start with Stephanie, and then I'll go to Andrew.

     Stephanie, you mentioned during your evidence clean notice to the public. I wonder if you could clarify that because Andrew came back with a statement in his evidence that we don't need to educate businesses. I was surprised by that because I brought it up at the last meeting where I was with a group of businessmen, and when I asked how many knew about that, it was almost zero.

    Could I have clarity on where you were going with clean notice to public?

     For that, I think I was getting at the fact that there are definitions that are very broad, like that of CEMs. Although people understand what the act is saying, they don't necessarily see the effects that it's having. I think there's a difference between what's written on paper and what's happening in practice.

    All right.

    Going to you, Andrew, I realize that you are in a larger centre, but I'm a rural cowboy MP, and we sometimes don't have the luxury of having large organizations to back up the small businesses. I wonder if you would clarify a bit more what you were talking about in terms of not needing to educate businesses more, because I believe we do.

    Yes. To your first question about the hockey rink, you might be able to lean on a personal relationship in some of those instances, but one of the common complaints from businesses is that the litmus test for what is a “personal relationship” is not defined well enough yet. You really don't know, and it hasn't been proven in the courts. The CRTC has gone as far as to say in one of their bulletins that—I'm paraphrasing—“liking” each other on Facebook is not enough to form a personal relationship. There's a concern that the act doesn't take into consideration that the behaviour of people has changed. A lot more people connect and interact online.

    To your thing about the education, the point I was making is that you always want to provide education, but at some point it's not the teacher and it's not the student: it's actually the legislation. For instance, for the driving laws in Ontario, you spend six months on learning how to drive. You don't keep getting educated on how to drive, because the regulatory regime works. That's the point I'm making.

    You're telling me that when we started CASL three years ago. I believe it was three years ago. How many years ago was it?

    Mr. Andrew Schiestel: It was 2014.

    Mr. Jim Eglinski: So we did a great job right off the bat and everybody in business knows the program?

    I'm getting a headshake over there—

    Probably no, but I know that the CRTC has made an effort. Because the act is obtusely complex to understand, I think that if we put more resources into education that won't be the answer. What we should focus on is improving CASL to make it easier for companies to comply with, while still protecting consumers.

    Thank you.

    How much time do I have?

    None.

    Mr. Andrew Schiestel: You missed a pinch, Jim—

    Voices: Oh, oh!

    The Chair: No, he didn't get a pinch. We're going to move to Mr. Masse.

     You have seven minutes.

    Thank you, Mr. Chair, and thank you, Jim. That's one of the reasons I coach hockey: so I don't have to engage in those conversations. I'm behind the bench.

    Voices: Oh, oh!

    Mr. Brian Masse: Mr. Schiestel, I really appreciate your website. It's very good, but I think we all need to understand some of the connections that we have going on here. I think perhaps it's evident. We had Mr. Sookman here earlier. He's also on your board. Is it a board of directors or advisers?

    Yes. It's a set of advisers who advise the not-for-profit organization Lighten CASL.

    Okay. It's a not-for-profit. I know that Ms. Provato is also here in that same capacity, so we have three witnesses from the same organization.

     Your website says, “In 2014, lawyers Stephanie Provato (Buchli Goldstein LLP)”—Ms. Provato, you can correct me on the names later—“and Dr. Emir Crowne (KPA Lawyers) published a seminal paper that contends that Canada's Anti-Spam Legislation...is unconstitutional.”

     You say, “This opinion is shared with many Canadian lawyers including Barry Sookman (McCarthy Tétrault LLP)”. Mr. Sookman was a witness here.

    You continue, “A portion of all #LightenCASL membership dollars that #LightenCASL raises will be held in a fund to potentially support a charter legal proceeding which will challenge CASL's constitutional validity.”

    Are you going to actually bring that forth? What's the status of this? That's been on there since 2014, so what's the status of the actual constitutional challenge that you're going to bring forth?

    Lighten CASL was launched in May 2017, I believe. It wasn't 2014. At this time, there are no public announcements in terms of any funding that's going to be put towards a specific constitutional challenge. There's nothing public at this time.

    Have you just been fundraising since 2017? The constitutional seminal paper was published in 2014. Is that correct?

    I think that's right in terms of the date for the seminal paper. Stephanie would know better.

    Yes, that's correct.

    What's the status of that? Is that happening? I think we know whether or not there is intent. What's the community out there saying? We're interested in knowing that if this is a serious issue that fundraising is going on for on the issues around CASL, is it to the point where that's really going to happen? I know it's speculation, but we're dealing with hypotheticals, just like the cousins scenario. How big a concern is it?

    I might speak to it initially. To my understanding, there is a constitutional challenge currently in front of the CRTC, so you may want to defer to them to provide information regarding that.

    Also, David might be able to speak more about the parameters on which he might suspect that a constitutional challenge would happen moving forward.

    The sense I get in speaking to lawyers is that especially if private right of action had been implemented in July and if there were a legal proceeding against a company under private right of action, that probably would have been the appropriate time as the defence to take a run at a constitutional challenge under the Charter of Rights and Freedoms in Canada.

     I'm trying to separate what's really serious and what's not. Tony Clement was the author of this legislation, and he used the situation of the census, saying that you would go to jail. There was a sensational element to that. He's used hyper language in the past related to legislation, but this is his legislation.

    I've heard at the table here about girls running a lemonade stand being affected by this. Cousins,,,. Mr. Sookman brought in a not-for-profit association, and named one that I was a former board member of, that had no connection that has been brought up through this. That's not fair because that not-for-profit association didn't ask for that. It was separated.

    I'm trying to separate the elements of what I consider unconstitutional. Is it...? This language over cousins, lemonade stands, and using not-for-profits without their consent, is that the appropriate way of being able to argue something here?

    Ms. Provato.

    Fair enough. I think constitutional arguments are being put forward to the CRTC. I'm happy to provide more information on that after today's meeting, if that's something the committee wishes to look at further.

    My point today is really to focus on—yes, I know it was not the priority of the lawmaker to run into these sorts of situations. It is to try to get it right and not create situations where the public is going to feel a charter challenge is necessary.

    My point today is we don't want to see an increase in charter challenges. We don't want to create something that makes people feel as though their freedom of expression is being infringed in any way. Charter challenges shouldn't be used by the government to work out kinks in the legislation. We can't expect the public to undertake this and resort to this every time their rights are infringed or they feel that things are not working out fairly.

    Fair enough. I'm trying to sort out which scenarios are real, what's hypothetical, and what's imagined.

    In a memo you presented to the Canadian Chamber of Commerce, we have more overlap as well. The specific concerns that are raised, the legitimate ones that are out there.... I mentioned Compu.Finder and Plentyoffish, and the CRTC rulings against them and the fines versus that of Rogers saying they never got any notification.

    Does anybody here have any opinions as to whether the CRTC overstepped its bounds on Compu.Finder, for example? I'm just throwing one out.

    Mr. McLinton or Mr. Schiestel, anybody.

    I think Compu.Finder is an interesting case, because by all accounts they were what a lot of people would consider to be a spammer. They were sending out commercial electronic messages fairly indiscriminately and repeatedly ignoring requests to be taken off the list.

    In a way, it's difficult to say if they went over the top on that within the confines of the legislation. They didn't go as far as they could have, but if there is this basic underlying constitutional issue.... To go back to your earlier question, charter challenges are very expensive. If you're an organization in the CRTC's sights, they've come forward to you and want to fine you, do you just pay your fine and try to get on with life, or do you run the gauntlet of taking it in front of the commission and eventually before the Federal Court, and maybe, probably, eventually in front of the Supreme Court?

    That's all very expensive to do.

    I agree, and I don't think that's the way to do legislation, but the reality is that happens all the time, unfortunately.

    Mr. Masse, I'm going to have to cut you off there. We're over time.

    We're going to move to Mr. Longfield. You have seven minutes.

    Thanks, Mr. Chair.

    Thanks, everybody, for coming here prepared. It's great to have actual suggestions for us to consider. A tough part of our job is coming up with recommendations.

     I liked the line of questioning Mr. Masse was going down as well, in terms of consumers.

    I want to table a motion for future consideration:

    My line of questioning has to do with fintech and e-commerce, and the changing nature of commerce.

    Mr. Schiestel, you mentioned we're not in a bubble. We're in an international market. When it comes to—

     Go ahead, Mr. Masse.

    Mr. Chair, on a point of order, is that an official tabling right now during testimony?

    I am just getting this now. Yes, it is.

    Can we suspend? I'll get a copy. Is that going to be taking time from me at the end, or is it going to be taking from...?

    For now, it's on Mr. Longfield's time.

    It's on my time. It's a notice of motion. That's all.

     I just want to make sure that it's in both official languages.

    Yes, it is.

    Thank you, Mr. Longfield.

    You're welcome. No sweat.

    In the London Chamber of Commerce, Gerry Macartney is an awesome rock star in terms of policy. I was the president of the Guelph Chamber of Commerce. We did a lot of work together.

    With the idea of e-commerce and how we compete in a global market, we have two things we're trying to balance here. One that's very hard for us to balance is the consumer's take on all this. We're getting businesses' take on it, but I want to try to find.... Maybe in future witnesses, we can get this.

    Mr. Hill, I'll start with you on whether you have received any consumers' input on what they think of CASL from your organization.

    We receive complaints from consumers about marketers' activities. The principal concern that you hear from consumers is that they want to have control over the communications they're receiving.

    Typically, the complaints that we will receive are situations where an unsubscribe request is being ignored. The example that was mentioned, Compu.Finder, fell into that category. That is what consumers really want, and it's a legitimate concern. They should be able to control the nature of the marketing communications they're receiving.

    This is all about how you put together a structure to make that happen, that works for everyone, that doesn't become unwieldy for the businesses while allowing consumers to exercise choice. And that's why we're talking about the two-year and six-month rule, because the consumers don't need that. They have the unsubscribe option. They can unsubscribe. They can look after themselves. They don't need that provision in the law.

    Thank you.

    Turning to Mr. McLinton with the Retail Council, with respect to the relationship between the consumer and the retailer, when consumers get upset by anything, they can take their business elsewhere. Do you have any sense of the volume of consumer push-back on CASL? It has been very helpful today to get suggestions. We're not throwing CASL out, but there are some areas that maybe we could do better. Do you have anything from the consumer side of things on CASL?

    Yes. Thank you, Mr. Longfield.

    I'd like to think that the Retail Council and its members can offer a unique perspective on this, in that our members have the direct interface with the consumers. From what I'm hearing from the members, the consumers' knowledge of the actual legislation is limited to non-existent. But as Mr. Hill has suggested, consumers want what they want and they want it now, and they don't want what they don't want and they want it gone right away. So it is not in our members' best interests to be doing marketing when the consumer doesn't want it. Just from a business self-interest perspective, it's about giving the consumers what they want.

    I think what I'm hearing from the members is that today's consumers are more knowledgeable and more tech savvy than they have ever been before, and they want that kind of control. So maybe I'm repeating what Mr. Hill said, it's the ability to subscribe, and to refer to my earlier comments, by brand and by type of message, and to unsubscribe by brand and by type of message. That's what we're hearing they're looking for.

    That's helpful. Thank you.

    Mr. Schiestel, coming back to the global opportunities, as you were speaking, I was thinking of reversing things, of Canadian businesses exporting and how this legislation could impact our export opportunities, where we're trying to get SMEs to do more export. Maybe you could give us a piece on that, just from the business standpoint.

    I don't know if I have anything material to add. I believe the act states that if a Canadian is sending a CEM to a company that has its own legislation, then essentially it needs to comply with that legislation.

    Immediately to your question, I don't think I have anything material to add beyond that.

     I didn't know about your not-for-profit business before now. How has CASL affected your business?

    I have a for-profit company called tbk Creative, which is a web design and digital marketing company. Is that the one you're speaking about?

    We could go there for sure. I was thinking of CASL inc.

    How I got interested in this topic is that we build a lot of websites at our company. Back before July 2014, our clients were actually coming to us asking how to comply with CASL. I needed to understand the act, and that's when I realized we really have a problem here. It's a very complex act to be able to go and read. It costs a lot of legal money to figure out. That's how we got into it. A lot of businesses grapple with it on a regular basis, on how to build websites to properly comply with the act.

    When legislation creates an industry unto itself, it's something that I always have questions with.

    Thank you.

    Thank you very much.

    We're going to move to Mr. Jeneroux.

    You have five minutes.

     Thank you.

    Thank you, guys, for being here today. It's an important topic. I know that taking time out of your day is also challenging, so I appreciate all of you coming up to the Hill.

    I want to start with a question that I'll put to Mr. Elder, first of all, around the enforcement of the act. We know that in a lot of cases CRTC commissioners only become involved after a notice has been issued, and only if the company then elects to incur further expenses and appeals the notice. We've also heard that several companies have elected to settle with the CRTC staff and to pay the substantial fines just to avoid the issuance of a notice of violation. You talked about it a little bit indirectly through a number of other questions, but could you go into a bit more detail on how you think these issues should be addressed?

    Sure.

    I think the point about staff that I was making and the allocation of the powers to staff without oversight directly from the CRTC is problematic when you have a new law with very vague provisions and very vague standards. You're putting it all on the shoulders of front-line staff to interpret that, to deal with the companies, to issue notices of violation. Even if there is a question that comes up, as it has in several of the investigations in which I've been involved on behalf of clients, there's a question of legal interpretation. Does the law really say that? Am I guilty of something? If I'm a business, before I want to settle, I want to know that I've done something contrary to the law. There can be a live question, and there's no mechanism. If staff doesn't agree with you, you're going to get a notice of violation, which has its own consequences in terms of adverse publicity, and there's no mechanism where you can even ask for a ruling on it from the commission, the appointed GIC members of the commission, so you can get a bit more certainty about how it's enforced. I think that's part of it.

    The other part of it is the way it works. The CRTC tries to get undertakings. Under the act they can get an undertaking settlement essentially from an organization without having to issue a notice of violation. Organizations are in a situation where the CRTC staff approach them and say that they think they're guilty of this and the CRTC thinks they should pay a penalty of x and agree to the following things. If they don't agree with that, the CRTC staff are going to issue a notice of violation for x plus 25% or 50%. Companies are really in a bind, and they have to gamble about running the gauntlet and bothering to appeal it to the CRTC or just cut their losses, take their lumps, pay the fine and move on with life. In many cases, they're choosing the latter. In some cases, even for issues where it wouldn't have stood up, the law didn't apply in that way, the company just says it's worth paying a few tens of thousands of dollars to get out of it and have it done.

    In follow-up to that, what about the ability to pay aspect of the law?

    Rogers was in here recently and they said that because they have a higher ability to pay, they're fined a separate amount. Do you have any comments on that? Have you seen any of that?

    That is certainly set out as one of the factors to be taken into account when assessing fines. Properly applied, it makes some sense. If you have a violation for a single flyer publisher, which we've had one of, you're not going to fine them to the same amount as a multi-million dollar company. You're going to assess fines based on that. But it shouldn't mean that you automatically prefer going after the larger companies and that you hit them as hard as you can just because they're larger and they can afford to pay.

     Even in the finding in the Blackstone case, the initial fine was $650,000 or something. They had to appeal that to the commission. The staff hit them heavily. The commission reduced it to whatever it was, $25,000 or $50,000, a twelfth of the original.

    That's some of what's going on. People are feeling they need to settle. But if there's absolutely no way you can afford it, then you're going to run the gauntlet.

    Yes.

    I have about 20 seconds left, Mr. McLinton, so just quickly, what type of businesses are you hearing from most in terms of CASL?

    I'm hearing from a range of members. What I'm hearing from the larger members is that their legal counsel is being very risk-averse, and is advising them to interpret the law in a very strict way. They're avoiding marketing campaigns, and campaigns to recipients that are probably legitimate, but—

    Is this significantly from grocers, or is it...?

    All of them—grocers, hardware, and then large merchandisers.

    What I'm hearing from the smaller members, though, from the hardware stores in the rural areas that Mr. Eglinski mentioned, is how can we possibly have the clerks trained to document this stuff? Where do we even hire someone to put a new database in place or buy a filing cabinet for this stuff? I'm hearing from the smaller members a lot of frustration about how onerous it is to demonstrate that they've gotten consent.

    Thank you very much.

    Mr. Jowhari, you have five minutes.

    Thank you, Mr. Chair.

    Thank you to the witnesses.

    I'll give a bit of a preamble, and then I'll ask a question about something that's been somewhat confusing to me.

    In general, we've heard that CASL has worked by reducing the number of malicious communications. In general, we are also hearing that the legislation may have cast the net too wide. A number of concern areas have been identified, and over the last three or four sessions we've had some good recommendations. These recommendations specifically say what should be excluded from CASL, or how it should be clarified.

    Here comes my question. We can start with Andrew, and then go to Jason and Wally. By excluding those areas of concern, do we by default address the issue that the intent of CASL was to go after those specific malicious communications, or do we need to make certain changes to be able to specifically do that? By implementing the recommendation, do we by default now clearly focus on those malicious communications or not?

    It's a good question. I would look at identifying what are harassing communications—for example, ignoring unsubscribe requests, malicious spam, and cybersecurity threats—and go through a lot of consultation to really understand that. That's on one side. On the other side, look at what would be a reasonable situation in which a business would send out a commercial electronic message given the context—for instance, if somebody provides their information to the business, which in a lot of cases might not meet the current implied consent rules. Draft provisions around that. In other words, on the latter, loosen up when implied consent would be present. Then make sure that the act is still catching the malicious stuff.

     I understand that piece. I think by now we've got that piece. The key thing is what specifically do we have to do to laser-focus on those malicious communications? Are you saying that by amending and by excluding, then by default we are lasering in on or focusing on the malicious, and therefore the act is kind of complete—i.e., just exclude it, amend it, and by default it will focus it?

     I think so in general, because the act really broadly catches almost every electronic message under its purview. I think you're already catching a lot of the stuff where consent is not present. If you can do a better job in the act of defining when it's practical to send a commercial electronic message, that's probably fine.

    Great.

    Jason.

    The answer to your question, Mr. Jowhari, is a resounding “yes”. If the committee were to make the five recommendations that the RCC has put forward, by default the enforcement, energies, and resources would target those areas where they should be targeting. In addition to that, as I mentioned before, you have the secondary benefit of actually promoting the type of e-commerce we want to see in Canada.

     Okay.

    Wally.

    I'm going to let David respond.

    I think you might have to do a little more there. Part of the problem is what the act targets and another part is what the enforcer targets and where they put their resources. One of the possible mechanisms we have seen in other statutes is the authority of the department. In this case you could have a direction to the CRTC that says that it should be prioritizing certain types of cases. Michael Geist says there are still two out of the top 100 ROKSO-rated things here. If you look at the CRTC decisions and activities, they're looking at reputable, well-known Canadian brands.

    Let me come back to that. Let's say we amend and now we have laser focus. Do you still suggest then that we should repeal the PRA? Now that we are getting to malicious communication and those responsible, should we repeal the PRA or should we keep it and perhaps adjust the penalty?

    If there is a way to laser target only malicious types of spam, which would be a huge change to the act, then I don't think we would have that concern with the PRA.

    How much time do I have?

    None.

    Sorry. There may be another round.

    Mr. Bernier, you have five minutes.

    Thank you for being with us. The work we are doing is very important, and we know we need to change that legislation. I want to ask you about the private right of action. As you know, it is not enforced. We had people in committee who told us that we must not have this in the new legislation.

    What do you think about that private right of action? Do we still change it? Must we have a way to use it more precisely? Do you have any ideas about that from the legal side? I don't know if Ms. Provato has any ideas about the private right of action.

    We should approach the private right of action the way Mr. Elder was saying in answer to the previous question. If we are able to target the most malicious forms of spam, which is what CASL was intended to do, then the private right of action can come in the way it is. I don't think we'll be running into the issues we're having with the private right of action as it stands right now.

    Yes.

    As long as CASL applies broadly to the issue of regular messaging to consumers, and it does that to provide a backstop that enforces good marketing practices, the danger is that unless the private right of action is either removed or narrowed, it is a perfect vehicle for class action lawyers to go after some company that made a small error and sent out 100,000 messages to people they shouldn't have. It's not damaging to those people, but there are statutory damages in the law that could result in enormous fines. This is the kind of chilling effect.

    I don't think we're going to see CASL change to the point where it's only focused on malicious activity. It would be nice to get it set up so that it's largely focusing on malicious and negative activity, but it's still needed to enforce good marketing practices. The private right of action must be dealt with, either narrowed substantially or removed from the law. When I say “narrowed”, I am saying to either take out the statutory damages and force plaintiffs to demonstrate they've been damaged and incurred costs, or narrow it so only ISPs—as has been done in other jurisdictions—would be able to use that part of the law to go after players who are abusing their customers, their whole network. It's important to deal with the private right of action no matter what.

    You had a discussion about this being anti-competitive to Canadian business. I think it was you, Andrew, who had a discussion about that. What can we do to make the legislation less anti-competitive?

    When a business is collecting information from a consumer who provided that information, you could call that “implied consent”. That's not spam in most people's definition. Spam, in most people's definition, is when you don't know the sender and it's kind of a bulk email. If an accountant is providing an e-report on a website and a user has to put in their information, whether they check a box or not, just call that “implied consent”, because the user can always unsubscribe and still be protected. That's the first thing.

    A second recommendation would be to call it “implied consent” in the case of any two people mutually connected on a social networking website or an instant messaging system. Bring all practical situations that make sense under “implied consent”.

     Okay, great.

    I have a last question, maybe for Mr. McLinton.

    Do you have any idea of the compliance cost for small businesses under that legislation?

    I don't have figures in terms of the compliance costs. It obviously depends on the size of the business and what they're involved in, and every business is different. What I am hearing from the independent members is that it is very onerous. A lot of these are family-owned, family-run businesses. Retail is a very competitive environment. Rather than taking that time to be dealing with buyers or doing additional marketing, they're using their valuable time to fill out forms, or using what scant resources they have to pay people to help them with databases and stuff.

    I don't have a figure, but what I'm hearing universally is that the cost is high in dollars and in effort and time.

    Wally, did you want to add something?

    Yes. We are a small business with approximately 20 or 22 employees. It cost us $20,000 to amend our database system, and over and above that, I had a project team working on this quite a few hours to create policies and procedures for our organization. I've said to people that it has cost maybe $40,000 for our little organization, but millions for big organizations.

    Thank you, Mr. Chair. I have what I wanted.

    Just for you, Mr. Bernier.

    We're going to move to Ms. Ng for five minutes.

    Thank you.

    It's great to be in the last round, because a lot of ground has already been covered. It is such a challenge for the work that we need to do, because on the one hand, we totally want to make sure that we have an environment and a climate where businesses are able to do business and to do it with ease and be competitive, and to be competitive internationally. At the same time, we need to make sure that this piece of legislation that was created in the first instance is actually intended to do what it needs to do: to get rid of the bad players and protect people. We haven't heard a whole lot from groups or individuals.

    I'll give you an example. My riding is perfect. I have a proliferation of amazing businesses ranging in scale from small and medium-sized, or SMEs, to multinationals, and I have a whole range of people who are seniors, who are regular people. They cover the gamut of diversity, so you're not necessarily looking at people whose first language is English. I'm looking for practical solutions that don't throw the baby out with the bathwater but can help achieve that balance, as almost every single one of you said. I'm just going to go to a couple of them.

    Mr. McLinton, on the point, if simplified, could there be technological tools that will then help people comply with greater ease? You said it costs $40,000 for your little organization. Have your clients or your members told you that this is what we could do to comply?

    Thank you for the question. Yes, there are many tools out there, and by its very nature, technology is constantly changing. With anything we put into legislation now, within a year or two there will be other tools there to assist.

    Our members are easy to find. They have stores in your riding. Whatever brand the consumer has subscribed to, you know where to find them. They're not difficult to find. If I can allude to a point I made earlier, it is not in their business interest to be providing marketing materials to consumers who don't want them. In terms of the level of oversight and the amount of compliance and enforcement required for these bricks and mortar brands that we all shop at every day to get our necessities and some luxuries that might not be a necessity, it's not in their business interest. Therefore, in terms of actually putting in tools and legislation and that sort of thing, they're policing themselves because it's just good business.

    Mr. Schiestel, you said to me that through your chamber, or whomever, you're actually putting out potentially some suggested technologies or practices that will help other member organizations to comply. Can you talk a little more about that? Did I get that right?

     The example I used was what a company would have to do to properly comply with the two-year and six-month rules if they wanted to automate that.

    That's a very difficult thing in practice to have happen. One reason is the cost. In the example I gave about the CRM/ERP that tracks the moving purge dates, it's going to cost five to six figures at a minimum for a company to implement that, including ongoing maintenance. The other practical problem with that is the scale. You have 1.17 million companies across Canada that would then have to implement that. There's no universal CRM or ERP that exists—there are hundreds—so there's no silver bullet out there that if implemented would be fine across those 1.17 million companies, because there are hundreds of different CRMs and ERPs that are integrated into these businesses right now.

    Okay. Is the removal of the six months or two years something that is a practical solution that everyone supports?

    Yes.

     I think that would be a huge improvement to this law. It would simplify the consent provisions of the law, especially for small and medium-sized businesses.

    Thank you very much.

    We are going to move to Mr. Masse.

     You have two minutes.

    The private right of action was created basically to allow people to deal with the economic loss they have from malware and other types of things that they have received on their own personal devices and so forth. If that's suspended now, do you have any suggestions as to how we can allow people to protect their own devices during the payment for services that they make on a regular basis, as an investment? Again, I view receiving information on my device and through my service as a privilege, not a right.

    What could we do to protect people from those things, to protect consumers so that they get the proper stuff they want, and then if they're affected and have economic loss....

    If it seems like a sledgehammer approach, what else could we do?

     Mr. McLinton, you might be able to start with this, and then Mr. Schiestel could answer.

    Thank you, Mr. Masse, for the question.

    Our members' primary focus of concern is not as much around the botware and the malware and that sort of thing and those provisions; it's primarily around commercial electronic messaging. They're seeing a big flashing red light of the possibility of litigators coming up when a mistake has been made, where they've invested millions of dollars in trying to comply with the legislation but have accidentally sent some messages out and then there is this sort of situation. I'm not hearing a lot from them about malware and botware and that sort of thing. I'm hearing a lot from them about them trying to comply. What ends up happening is that they err so far on the side of caution that consumers are not getting the messaging that they actually would like to get, and it's hampering the digital economy in Canada.

    Thank you.

    Thank you. You will have five more minutes.

    We have some time. We're going to keep going.

    Mr. Baylis, you have five minutes.

    I'm going to share all my time with Mr. Lametti.

    Thank you, Frank.

    Thank you to members of the committee.

    As fate would have it, this morning, the CRTC ruled in Compu.Finder and found it constitutional. I want to ask the lawyers on the committee for their comments. I'll read a couple of paragraphs from the judgment:

    Then they hold it to be proportional under section 1. Those are paragraphs 182 to 185 of the decision.

    I would ask for your comments. This was a case brought by another McCarthy lawyer, Charles Morgan, in the Compu.Finder case. I'm just curious to hear, particularly from counsel.

     That, of course, would happen today. I find that interesting. I'm definitely going to take a look at that and read it for myself, just based on what you brought to us today.

    I still stand by my position. I do disagree with that. I do think that the points we brought up today, especially when we're talking about small and medium-sized businesses.... It's having a pretty significant impact. I think that it's disproportional for the reasons that we talked about today, which I don't want to get into again and beat a dead horse.

    I think that it's ignoring the impact that it's having in restricting businesses, especially small businesses, from being able to comply, from being able to understand the legislation, and for imposing such onerous standards on these businesses that can't stand up on the their own legs, let alone with this kind of heavy burden on them. I think that's naive to ignore. I'm curious to read more about how they came to their decision.

    Obviously, I haven't seen this yet. This would have come out at 11 o'clock while we're sitting here, right? I was paying attention to you.

    My question is, what was the evidentiary basis for making that finding? Certainly, in a proportionality analysis, you would look at what the public benefit is. You would assess what the efficacy of the law has been versus the costs to business. I think those are very difficult questions to answer. I don't know what evidence was produced before the commissioner, for example, to assess the impact on businesses or even to draw a causal link between CASL and a perceived reduction in spam.

    As we've heard from a number of people, a number of things are going on, including much more sophisticated filters and an overall drop in commercial email traffic that have affected the amount of spam. It's very difficult to draw those causal links.

    I expect that we haven't heard the last of it.

    There are statistics that they cite. I would imagine that Maître Morgan would have provided much of the same information as you have. He's with the Sookman group at McCarthy's.

    But there are statistics provided from another survey. Here's paragraph 180 indicating,

     There is some interpretation of the statistics.

    Mr. Lametti, could you clarify if that's a CRTC decision or if that's a court decision?

    That's a CRTC ruling.

    I think that statistic, to the 37%, is the Cloudmark study that gets loosely referred to. That also measured something like a 27% or 28% reduction in overall email traffic. One really needs to be careful with statistics. What's causing the reduction in spam? Is it just that everyone's emailing less?

    There's no question one needs to be careful with statistics.

    I would love to see that one keep going, but we're out of time.

    We're going to move to Mr. Eglinski.

    Thank you, Chair. I'm going to share my time with Mr. Jeneroux.

    I'm going to ask a really quick question.

    There was a comment made earlier about a penalty assessed by bureaucrats then reduced twelvefold by the commission. Are we maybe missing something in this act where we might have a penalty set schedule to put the level of importance on a certain action that might take place?

     You seem to be nodding.

    Thank you, Mr. Eglinski.

    Yes, it goes exactly to the point about intent and to how the penalties should be proportionate to intent. Going back to that example of the rural hardware stores, somebody who is really trying to comply and accidentally sent an email, or can't demonstrate that the one person whose record they lost, that's different from the person who's intentionally and maliciously breaking the law. A provision in the legislation about intent, and then scaling compliance and enforcement accordingly, I think would really help give certainty to the business community.

    Thank you.

    I'm going to turn it over to my friend, Matt.

    That's very generous, but I have no other questions for you.

     Don't you have any more questions? You could have told me. I still have a few minutes, and I don't know what to ask.

    Let's continue the debate on the challenge.

    Does anybody have any further comments?

     To have it noted for the record, based on what Mr. Lametti said, that's a CRTC decision, not a court decision, and certainly not a Supreme Court decision, in terms of the constitutional validity of CASL.

    I have something to add as well. I don't have the statistics in front of me.... It does not surprise me one bit that retailers are seeing more online sales, but to draw that specifically to legislation.... That's the way the world is moving. Our members are very competitive in that e-commerce environment. The ones who do it best are the ones who have that interplay between e-commerce and the physical store, and who can do that well. They're very active and competitive in that area. To draw that link to the legislation would be an interesting way to draw causality.

    I'd like to get a little clarification from Mr. Elder or Ms. Provato.

    Has there been a court challenge yet? I believe you only said there was a challenge to the commission.

    That's right.

    Not that I'm aware of.

    Nothing has gone further.

    No. The lawyers I've spoken to have said that likely would occur if PRA were instituted and a legal proceeding starts, as a defence.

    We could move on. I'm sure Mr. Masse has some time.

    I appreciate that.

    At home, how much do I feel my day is improved when my mailbox is filled with more ads? I guess it's good for Canada Post, but when I canvass and I am talking to Canadians, they don't tell me, “I need more direct mail in my mailbox”, or “I need more spam”, or “I need more advertising on my device”. That's what we're getting at here.

    What we're getting at is a discussion related to the privilege and right to actually disperse information. The fact of the matter is that some of the ways of dispersing it—in this case, whether it be by legitimate or non-legitimate businesses—have an actual economic effect on people, as well as a privacy effect that they didn't ask for.

    Why do you think so many people are actually complaining about this, if that's the case? Hundreds of thousands of people complain each year to the CRTC. Why do you think they're complaining about receiving information, legally or illegally solicited, to their devices?

    Does anybody have an answer for that?

    Mr. Hill.

    It's because there is an issue with spam. There are networks of spammers out there, filling our mailboxes day after day with garbage. It is important to have an anti-spam law to go after those activities, in particular the bad players. We support that 100%. It's just a question of getting the mechanism for doing that right, not unduly burdening honest, hard-working businesses that are making our economy work, and giving consumers choice at the same time.

    A hundred per cent, and that's what I think consumers' choice should be about. The consumers' choice should have that. When you pay on a regular basis—I say this ad nauseam—you are paying for these devices that can actually get contaminated, can get ruined and cause significant problems for your daily activity—your business activity. I have plenty of businesses that have told me they're glad this legislation has actually been put in place, because they're not bogged down by a bunch of crap and viruses where they're having IT specialists come in and clean out a bunch of garbage.

    I agree that we can't control the foreign ones to the fullest degree, unless we get actual international agreements. That can be done through trade agreements, maybe, in the future. In Canada, we can control this part. We can make a difference.

    Consent is the primary thing for most people. Again, it's a privilege, not a right. My devices, expenditure, intrusion, and potential exposure of privacy can be affected just because somebody might have the next best deal for me and they presume that I need to know that. That's the thing we're getting at here. It's the mere fact that this activity, which is unsolicited, is affecting people's daily lives and businesses.

    I know the private right of action has now been suspended. It's been suspended, basically, because of theoretical arguments. I have concerns about that, because it was well delivered in terms of part of this legislation, and we're actually suspending it right now. The private right of action was the counterbalance for that. If it's a constitutional challenge, I find it interesting that lawyers can't afford to bring the constitutional challenge to the Supreme Court, if that's the case. If any group actually had pro bono expertise in a pro bono activity, it would be a group of lawyers. I've seen constitutional challenges for different things.

    At the end of the day, how do we get to making this more efficient for business? Do we scrap it and go back to zero? Do we look to amend it to make it more efficient and fair for consumer protection as the number one thing, and to allow access for businesses that are legitimate, and then see? Then, how do we go after the international?

    I'll start with Ms. Provato, and then quickly go across, if we can.

    You have one minute.

     I don't think completely scrapping it will be efficient. I think the legislation does have good bones. I think it's the guts that need to be focused on. I think that can be done by targeting on the definitions, looking at the parts that are really restrictive, comparing it to the objectives, and going back to really what it was supposed to be about.

     I think that involves looking at what I talked about today, which is personal and family relationships and the effect it has on small businesses. I think that if those areas are targeted, then we can come to an overall approach. I don't think that means scrapping it entirely.

    Is there anybody else?

    Is there time to respond?

    You are using it up right now.

    Some hon. members: Oh, oh!

    The Chair: Very quickly.

    You have to be careful with the argument. What's missing in that common argument is that they are still businesses, and Canada has to have to have strong commerce. We don't operate in a vacuum, so it's about finding the right balance between protecting consumers and making it easy for legitimate businesses to comply with.

    It can be amended to address the issues that are there.

    If I may, there could be intent and common sense amendments so that there's certainty in the lawful business environment, and so that the scant government resources that are there for compliance and enforcement are targeted where they should be.

    Excellent.

    Thank you very much.

    We have time for one more five-minute round for Mr. Sheehan.

     Make it count.

    Thank you very much.

    Going last, a lot of what I was going to ask has been asked and answered. However, I just want some clarification. During the testimony we heard, I think it was the Chamber of Commerce who said that CASL would basically not allow a businesswoman to send an email to another businesswoman to go for a coffee. I think it was like a paraphrase of that. Then in the later testimony there was an indication, I believe by Michael Geist, that this is not true and that B2B emails would be allowed. Having heard conflicting testimony thus far, perhaps I will ask Andrew for clarification. Is B2B emailing truly made more difficult and circumvented, yes or no?

    I think Michael Geist misrepresented that information around the business-to-business exception. There is a business-to-business exception under one of the regulations, but it's very narrowly defined. It's not broad such that if you're a business and someone else is a business, you can send them a commercial electronic message. That doesn't exist.

    More so on this particular piece of legislation....

     I will be sharing my time with Lloyd. I'm sorry. I forgot to mention that, as well, Mr. Chair.

     I just want to give you an opportunity to speak.

    We'll have to get clarification on that, because the business-to-business piece is really important. I think there's been very much a difficulty in communication. I think it was Jason who had indicated that the lawyers who are advising businesses have just said to not even take a chance and to not do it, so the risk aversion is hampering it. Again, I think we need to really drill into that, and we can't do that right now.

    I will turn it over to Lloyd right now, and I'll save it for future committee meetings to delve into that. I appreciate it.

    We're sitting too close together. Our minds are getting closer together, too. That's a scary thing for both of us.

    The Chamber of Commerce referral systems.... I'm still operating under referral systems where I am working on innovation projects. I see something really cool going on in southern Ontario, in Ingersoll specifically. I let the Conservative member know I am in his riding, and I see some cool business activity that I think another business could benefit from, and I ask them to contact each other.

     Mr. Schiestel, how close am I to breaking a law there?

    You probably would break the law, based on my understanding, if you don't have consent, because you would be incorporated as different corporations. You also run into that instance a lot in the private sector if it's a manufacturer and they have a dealer network. Probably the opinion of the courts is that if consent is given to a manufacturer, the dealer itself can't actually send commercial electronic messages to that person.

    That goes back to the education piece that, in my role as a salesman, in my head I'm thinking I'm doing something right, whereas in fact I could be putting my company or their companies in jeopardy by trying to help them out.

    That's it exactly.

     Moreover, I think there's a real problem with records. You need to have records to be able to prove that you fit within the various exceptions and exemptions. Those are quite onerous. To tell a sales force for a business that when they're reaching out to these businesses this is what they have to do, that every time they meet someone they have to scan their business card and put it into their CRM and if they met them they provide an annotation to that effect. It's really unwieldy and it's very difficult, which is why I think a lot of businesses have said there's too much risk there; they might make a mistake, and they don't want to incur the fine.

    In our previous study we looked at knowledge transfer and the point you're making is knowledge transfer is inhibited and innovation is also inhibited. But he did give me some cool gum packs with a tear-off business card that I could give. I could do that but I couldn't do it electronically. Sometimes we're working at cross-purposes in our innovation agenda. I think you've highlighted some of those things that we'll be considering. I really appreciate all your testimony.

    I want to thank everybody for coming in today and sharing their time and knowledge with us. Thankfully, we still have a lot more witnesses, and we don't have to make any decisions today, which is a good thing, but we are going to look forward to the coming weeks with more witnesses.

    The meeting is adjourned.