Canada’s Anti-spam legislation (CASL) – Performance measurement report 2017-2018

From: Innovation, Science and Economic Development Canada

Table of Contents


1. Introduction

Canada's Anti-Spam Legislation (CASL) protects Canadians from spam and other electronic threats, while ensuring that Canadian businesses can remain competitive in the global marketplace. Generally, the law prohibits sending commercial electronic messages without the recipient's consent; installing computer programs without the express consent of the owner of the computer; making false or misleading representations to the public in the form of electronic messages; collecting personal information through the illegal access of a computer; and collecting and using electronic addresses through computer programs (address harvesting).

CASL was passed in 2010 and the majority of provisions came into force in 2014 with a three-year transition period to allow time for consumers and businesses to become aware of and comply with the legislation.

In 2017, CASL was evaluated by ISED's Audit and Evaluation Branch, which identified a need for greater coordination amongst government partners on outreach and education. This annual report is part of management's actions to respond to this need.

It is also consistent with a recommendation made by the House of Commons Standing Committee on Industry, Science and Technology in their statutory review report on CASL.

2. Results at a Glance

Promoting:

In 2017-18, there were 400,184 visits to Fightspam.gc.ca including 339,978 unique visitors; 68.8% were from Canada, 22.2% from the United States and 9% from all other countries.

The Canadian Radio-television and Telecommunications Commission (CRTC) had 133,386 unique page views and 173,578 page views of its CASL-related website.

The Office of the Privacy Commissioner's (OPC's) CASL-related webpages were viewed more than 20,000 times while its "Helpful tips for businesses doing e-marketing" webpage was consulted more than 14,400 times.

In 2017-18, the number of CASL-related social media negative mentions (18%) continued to decline. When compared to the measurement of tone of mentions in the two previous years (26.4% negative mentions in 2015-16, 22% negative mentions in 2016-17), these findings indicate a steady, decreasing trend in negative perceptions.

Monitoring:

Canadians made 343,799 submissions to the Spam Reporting Centre, including 7,873 web form submissions and 335,926 email forwards. The CRTC issued 13 notices to produce to organizations in order to verify compliance with CASL.

Enforcing:

The CRTC took 5 enforcement actions: 2 warning letters and 3 undertakings.

The Competition Bureau resolved 2 cases that resulted in $2.25 million in administrative monetary penalties, while 1 application was filed with the Competition Tribunal.

The OPC received nine written CASL-related complaints from the public, 6 of which were accepted and successfully resolved through early resolution or referred for investigation.

3. Partners

The CASL initiative is administered by Innovation, Science and Economic Development Canada (ISED) and enforced by the CRTC, the OPC and the Competition Bureau. Roles and responsibilities of all organizations have been defined in foundational documents including laws and regulations.

Innovation, Science and Economic Development Canada

Innovation, Science and Economic Development Canada is the Department responsible for CASL within the Government of Canada; within ISED the Marketplace Framework Policy Branch and the Office of Consumer Affairs share CASL responsibilities.

National Coordinating Body

The National Coordinating Body, which resides in ISED's Privacy and Data Protection Directorate within the Marketplace Framework Policy Branch, is responsible for policy and research, public communications and outreach oversight, monitoring and reporting on the overall effectiveness of the regime.

Office of Consumer Affairs

The Office of Consumer Affairs coordinates consumer and business education and awareness efforts for the CASL initiative.

Enforcement Partners

Canadian Radio-television and Telecommunications Commission (CRTC)

The CRTC is Canada's broadcasting and telecommunications regulator. The CRTC has the primary enforcement responsibility under CASL and investigates, takes action against, and sets administrative monetary penalties for:

Competition Bureau

The Competition Bureau, is an independent law enforcement agency which ensures that Canadian businesses and consumers prosper in a competitive and innovative marketplace, including the electronic marketplace.

CASL, through amendments to the Competition Act, enables the Competition Bureau to more effectively address false and misleading representations and deceptive marketing practices in the electronic marketplace, including false or misleading sender or subject matter information, electronic messages and locator information such as URLs and metadata.

Office of the Privacy Commissioner of Canada

The OPC is an Agent of Parliament which protects the privacy rights of Canadians. Through amendments to the Personal Information Protection and Electronic Documents Act (PIPEDA) the Privacy Commissioner enforces CASL with respect to two types of conduct:

4. The Ecosystem

4.1 International Context

The proliferation of spam and electronic threats such as malware, phishing, false and misleading content and identity theft are a harmful, costly, and evolving set of issues for Internet users, businesses, and governments around the world. The cost of these threats continues to rise despite spam filters and new technologies. In 2017, 14.5 billion spam emails were sent worldwide every day accounting for 45% of all emails sent.

Because the majority of these threats are coming from outside Canada, CASL partners have established relationships with sixteen countries including Australia, the Netherlands, the United Kingdom and the United States in an effort to address some of these issues. To this end, the CASL partners are also members of the Unsolicited Communications Enforcement Network (UCENet), an international network of agencies that share information and collaborate to address spam and other electronic threats.

4.2 E-commerce trends, indicators and challenges

CASL protects Canadians from spam and other online threats while ensuring that businesses can continue to compete in the global marketplace. It allows Canadian enforcement against spammers operating in Canada and facilitates co-operation in global anti-spam enforcement actions.

The electronic marketplace in which CASL exists is complex and fast-evolving; CASL is part of a broad range of domestic and international legal and policy frameworks in the areas of spectrum, telecommunications, privacy protection and cyber resilience, including cyber security.

In 2017, online privacy and trust remain a concern for Canadians: 44% of Canadian internet users reported being more concerned about their online privacy than a year ago. Cyber criminality was the primary source of concern for Canadians; they also expressed distrust of social media platforms, search engines and internet technology companies, with 58% of Canadian internet users feeling that social media has too much power. Despite this, e-commerce continued to be healthy with 86% of Canadians making an online purchase during the same year.

These concerns reflect a real challenge, as 39% of Canadian businesses reported experiencing an attack by malicious software. Canadians lost more than $33 million to online purchase scams and wire fraud alone.

To respond to this, an estimated $2.26 billion was spent in Canada for cybersecurity. An estimated 71% of security breaches affected small businesses while 24% of Canadian businesses reported not using anti-malware software.

This illustrates the pertinence of CASL, which helped keep Canada out of the top 10 spamming countries.

5. The Achievements

5.1 Policy and Coordination

CASL policy, research, oversight and coordination are the responsibility of the National Coordinating Body, which resides in ISED's Marketplace Framework Policy Branch. On an ongoing basis, the National Coordinating Body keeps abreast of the most recent developments in spam, online threats, cybersecurity and e-commerce spheres by performing strategic intelligence scans, information research, analyzing metrics and trends. The National Coordinating Body also works with national and international partners with the view to aligning legislative and regulatory frameworks with international anti-spam and malware industry best practices. For example, alongside CASL enforcement partners, the National Coordinating Body participates in (and sponsors) spam-related international fora such as the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) and UCENet, a network of anti-spam, consumer protection and telecommunications regulatory authorities.

The National Coordinating Body is responsible for informing and advising the Minister responsible for CASL, the Minister of Innovation, Science and Economic Development, of all developments that relate to the CASL initiative management and policy. It also oversees communications and outreach efforts including the development of the fightspam.gc.ca website, which is the responsibility of the Office of Consumer Affairs.

The National Coordinating Body also coordinates CASL governance-related activities by chairing Directors' General Steering Committee meetings to discuss policy and strategy.

The National Coordinating Body leads and coordinates the development of an annual CASL initiative Performance Measurement Reports which are produced in accordance with Treasury Board policies and guidelines. A report was completed for 2016-17 and in previous years in collaboration with all CASL partners.

The Performance Measurement Framework for CASL was updated in 2017. The National Coordinating Body and all CASL partners collaborated with ISED's Audit and Evaluation Branch in coordinating this effort.

The Audit and Evaluation Branch also completed an evaluation of CASL in 2017-18. The evaluation examined the initial achievements of the initiative, its management, and the extent to which CASL's impact on the electronic marketplace could be measured. It also identified a need for greater coordination of education and outreach activities among partners. This annual report is part of management's actions to respond to this need. The National Coordinating Body supported the Branch for that exercise, and will coordinate the implementation of the Management Response and Action Plan, which is management's response to the Evaluation's recommendations. All partners worked in collaboration with the National Coordinating Body to develop the plan, as they did for the evaluation itself.

National Coordinating Body CASL policy-focused achievements for 2017-18:

CASL provides for a Private Right of Action, which was scheduled to come into force in July 2017. In response to broad-based concerns raised by businesses, charities and the not-for-profit sector, the National Coordinating Body coordinated the consultation and performed the policy research and analysis which led to the suspension of the coming into force of the Private Right of Action by the Government of Canada on June 2, 2017.

Section 65 of CASL requires that the Act, which came into force in 2014, be reviewed by a parliamentary committee three years after coming into force. A review was therefore undertaken by the House of Commons Standing Committee on Industry, Science and Technology between September 26 and December 12, 2017. The National Coordinating Body was responsible for ISED's appearance before the Committee and required support of the Committee's work. On December 13, 2017, the Committee tabled its report entitled: "Canada's Anti-Spam Legislation: Clarifications are in Order". The report makes 13 recommendations respecting the application and requirements of CASL and asks for a Government's response, which the National Coordinating Body is tasked with preparing.

Alongside the National Coordinating Body, all partners appeared before the Committee, where all expressed support for the legislation and its impact on helping to fight spam and address online threats which can be harmful to Canadians. Here are the CASL partners' statements before the Committee.

5.2 Promoting Compliance

Office of Consumer Affairs

The Office of Consumer Affairs manages CASL-related communication products for Canadian individuals and businesses, including the Fightspam.gc.ca website.

Fightspam.gc.ca promotes CASL-related information. In 2017-18, there were 400,184 visits to the website:

Distribution of visitors on fightspam.gc.ca in 2017-18:

Distribution of CASL-related social media mentions in 2017-18:

The Office published 10 CASL-related Facebook posts on Your Money Matters and Questions d'argent Facebook pages in 2017-18. Together, these Facebook posts had a total reach of 48,730. Through online and social media monitoring, the Office reported 2,475 CASL-related mentions.

Key trends and highlights of CASL social media mentions in 2017-18:

In 2017-18, the number of negative mentions continued to decline:

When compared to the tone of mentions in the two previous years (26.4% negative mentions in the 2015-16, 22% negative mentions in 2016-17), these findings indicate a steady, decreasing trend in negative perception.

On top of promoting online information, the Office distributes print copies of Worried It's SPAM? postcards to help Canadians recognize potential spam messages.

Distribution of print postcards to regional MP offices in 2017-18:

Ongoing promotion of CASL compliance to business is done online via the fightspam.gc.ca website. In total, 77,985 visits were made to web pages that specifically tackle the topic of CASL compliance for businesses.

CRTC

Complementing fightspam.gc.ca, the CRTC's website also provides CASL-related information to Canadians and stakeholders to make it easier for everyone to get the help they need. In 2017-18, the CRTC also continued to strengthen CASL's social media presence, using Twitter and Facebook to educate and inform stakeholders and Canadians.

The online experience was enriched with easy-to-access alerts, videos and infographics, resulting in a 34% increase in website visits from people on mobile devices, and an overall increase of 9% in new visitors across all devices. This means the CRTC is reaching more Canadians than ever.

In 2017-18, the CRTC:

Competition Bureau

In 2017-18 the Competition Bureau increased awareness of CASL-related issues in a number of ways in order to reach as many Canadian consumers and businesses as possible:

OPC

The OPC delivers ongoing CASL-related compliance guidance for businesses and advice for individuals through different channels. The OPC's website (https://www.priv.gc.ca/en/) is its primary tool for reaching individuals and sharing information with businesses.

Highlights for 2017-18 include:

Sharing content through social media channels:

Participating in events and conferences:

Distribution of materials:

Articles and running radio spots:

Responding to inquiries to the OPC's Information Centre:

5.3 International and Domestic Cooperation

All enforcement agencies worked collaboratively and met regularly with domestic and international partners in order to promote compliance with CASL.

CRTC:

Competition Bureau:

OPC:

5.4 Monitoring Compliance

CRTC

The CRTC monitors CASL compliance in several ways, including by:

In 2017-18, the CRTC:

OPC

The OPC concluded its review of Compu-Finder's implementation of privacy measures, finding that the Quebec-based training provider had fulfilled its obligations stemming from a compliance agreement with the OPC established in April 2016.

5.5 CASL Enforcement Operations

CRTC

The CRTC has developed a trusted network of domestic and foreign allies with whom it has established protocols for information sharing and enforcement collaboration. In 2017-18, the CRTC signed separate memorandums of understanding with the Ministry of Internal Affairs and Communications in Japan, the United Kingdom Information Commissioner and the Australian Communications and Media Authority to combat email spam and nuisance phone calls. The CRTC now has a total of 16 countries as established partners.

CRTC's international partners

Description of CRTC's international partners world map

A world map representing the 16 countries with whom the CRTC has established partnership, including the United States, Mexico, United Kingdom, Ireland, Netherlands, Sweden, France, Spain, Portugal, Israel, Australia, New Zealand, Hong Kong, Korea, Japan and Canada.

CRTC enforcement tools include:

The CRTC's enforcement actions are published on its website. In 2017-18, the CRTC took 5 enforcement actions:

2017-18 case results included:

Competition Bureau

In 2017-18, the Bureau:

April 2017 — The Bureau reached a consent agreement with Hertz Canada Limited and Dollar Thrifty Automotive Group Canada.

February 2018 — The Bureau reached a consent agreement with Enterprise Rent-A-Car Canada Company (Enterprise).

January 2018 — The Bureau filed an application to the Competition Tribunal against Ticketmaster over alleged misleading ticket prices.

OPC

Complaints received:

6 complaints were accepted. Of these:

The OPC pursued 3 CASL-related investigations during the year:

Annex A: CASL Logic Model

Description of the CASL Logic Model

The appendix depicts a logic model for CASL. A logic model shows how program activities are expected to produce outputs and in turn how these outputs are expected to lead to different levels of results or outcomes.

There are 4 sets of activities and outputs:

  1. Advocacy including informal advice or correspondence, formal advice and interventions, and liaising with key institutions (cross jurisdictional);
  2. Compliance Continuum including promoting compliance, monitoring compliance, investigating non-compliance; and conducting enforcement actions to address non-compliance;
  3. Communications and Outreach including media connectivity, outreach initiatives, information products, guidance material concerning the administration and enforcement of CASL-related matters, and information centers;
  4. Enablers including capacity building initiatives, National Coordinating Body outputs (e.g. Policy advice and guidance, public reports, research studies, operating processes and procedures, legislative and regulatory amendments), and cross jurisdictional cooperation (federal, provincial and international).

The four sets of activities and outputs lead to three immediate outcomes:

  1. Awareness of spam and other online threats;
  2. Sharing of information to facilitate CASL; and
  3. Recognition of appropriate and inappropriate practices in the electronic marketplace.

The three immediate outcomes lead to three intermediate outcomes:

  1. Cooperation for compliance activities;
  2. Mitigation of threats from impacting the electronic marketplace; and
  3. Proactive actions to protect the electronic marketplace.

The intermediate outcomes lead to one ultimate outcome: electronic commerce in Canada is competitive and strengthens the Canadian economy.

Date modified: