CyberLex
CyberLex Insights on cybersecurity, privacy and data protection law

In New CASL Case, CRTC Sends $15,000 Message

Posted in CASL
Jade Buchanan

The biggest changes to CASL since CASL are on the horizon but the Canadian Radio-Television and Telecommunications Commission (“CRTC”) just showed us that it still cares about the little things. All it took was complaints about 58 emails – fewer emails than many people receive in a day – for the CRTC to impose an administrative monetary penalty (“AMP”) of $15,000.

Background

The CRTC just released a Compliance and Enforcement Decision (the “Decision”) regarding the ill-fated email campaigns of one Mr. William Rapanos. In a rare act of true irony, Mr Rapanos sent a series of unsolicited emails advertising his business of designing, printing and distributing paper flyer advertisements.

After receiving complaints between July 8, 2014 and October 16, 2014, the CRTC investigated and, on April 22, 2016, sent Mr Rapanos a Notice of Violation (“NoV”). The NoV cited 10 violations related to Mr Rapanos’ commercial electronic messages (“CEMs”), which violated CASL in almost every way an email can, including being sent without the recipients’ consent and not including an unsubscribe mechanism. Mr Rapanos ran three separate campaigns, committing a total of ten violations. The NoV also assessed an AMP of $15,000.

Mr Rapanos exercised his right to respond to the NoV, arguing that because his wi-fi connection was unsecured, an unknown person and sent the offending emails and that he had been “potentially the victim of a personal vendetta or of identity theft” and that the CRTC had not proven “beyond a reasonable doubt” that he sent the CEMs.

The Decision

Mr Rapanos was not successful. The CRTC was satisfied – on the balance of probabilities (the actual legal test that applied, and not “reasonable doubt”) – that Mr Rapanos had committed all of the violations listed in the NoV and maintained the $15,000 penalty.

Unfortunately, Mr Rapanos’ case does not lend itself to clarifying CASL’s more pressing ambiguities (such as the “6(6)” issue and the handling of consents obtained prior to CASL coming into force). The emails were unambiguous violations.

The Decision does contain some useful guidance on how to manage investigations and how to minimize AMPs. The Decision is particularly notable for maintaining the AMP imposed by the NoV. This differs from the recent Blackstone decision, which decreased the AMP from $640,000 to $50,000. Here are some of the lessons from the Decision:

  1. Documenting compliance efforts can help reduce an AMP. As in Blackstone, the CRTC considered indicators of self-correction (a factor not explicitly listed in CASL). Mr Rapanos showed an unwillingness to self-correct, including by running a fourth CASL-violating email campaign after learning the CRTC was taking action. The CRTC used this to further justify the quantum of the AMP. It is probable that Mr Rampanos could have helped lower the AMP by demonstrating self-correction, or at least a willingness to correct. In fact, evidence of self-correction – before and after the investigation began – did justify a lower AMP in Blackstone.
  2. The CRTC found a fine of $1,500 per-violation to be reasonable. This is a helpful benchmark for future AMPs against individuals. For comparison, the per-violation penalty for a small business in Blackstone was roughly $5,500. However, due to the high volume of emails in Blackstone (385,668), Mr Rapanos is paying dramatically more on a per-email basis: $259 per email compared  to Blackstone’s 13 cents per email.
  3. The Decision further clarifies the calculation of violations. The number of emails did not factor into the number of violations (even though it may have affected the AMP). Just as in Blackstone, the CRTC considered the number of email campaigns. However, unlike Blackstone, Mr Rapanos committed multiple violations in each email campaign by violating three to four different provisions of CASL.
  4. Violators must produce evidence if they want the CRTC to consider their ability to pay. Mr Rapanos claimed “he never had a career due to health issues and that he and his wife subsist solely on social assistance.” The CRTC, faced with a sympathetic offender, noted they had “taken into account” Mr. Rapanos’ submissions on the AMP, but ultimately disregarded this claim because Mr Rapanos did not provide supporting evidence.
  5. The CRTC will use its power to compel evidence liberally. Notices for production were issued to Mr Rapanos (twice), his wife, the owner of the house where he resided, the host of his website domain and both of the companies that provided him with cell phone services (and that is just the notices that were mentioned in the Decision.