Also as previously reported, earlier proposed regulations under the CASL had been issued for consultation in July, 2011. That consultation led to their refinement, resulting in the ECP Regulations.

• define “family relationship” and “personal relationship” for the purposes of paragraph 6(5)(a) of the CASL;
• specify limited exemptions from the operation of section 6 of the CASL, including, among other things, those CEMs that are sent within a business, sent in response to a request, inquiry, complaint or which have otherwise been solicited by the person to whom the message is sent, or sent to satisfy a legal or juridical obligation;
• ensure that the first CEM sent through third party referrals where there is an existing business relationship does not fall within the prohibition found in paragraph 6(1)(a) of the CASL;
• establish conditions for use of consent;
• specify certain computer programs for the purposes of subparagraph 10(8)(a)(vi) of the CASL (express consent to install a computer program as prescribed); and
• further define membership, club, association and voluntary organizations for the purposes of paragraph 10(13)(c) of the CASL.

Interested persons may make representations on the proposed ECP Regulations within 30 days after their publication (January 5, 2013). Details of the process for making those representations is found in the January 5, 2013 Canada Gazette.

For more information on the CASL, see our FTR Now “Preparing for Canada's New Anti-spam Legislation.”

*The title of CASL (formerly Bill C-28) is An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act

Bill C-12 reintroduces Bill C-29 (previously reported here), which expired on the Order Paper when Parliament was proclaimed dissolved in March, 2011. 

Among other things, Bill C-12 would:

• specify the elements of valid consent for the collection, use or disclosure of personal information;
• permit the disclosure of personal information without the knowledge or consent of the individual for prescribed purposes;
• clarify the meaning of lawful authority for the purpose of disclosures to government institutions of personal information without the knowledge or consent of the individual;
• permit organizations, for certain purposes, to collect, use and disclose, without the knowledge or consent of the individual, personal information contained in witness statements related to insurance claims, or produced by individuals in the course of their employment, business or profession;
• permit federal works, undertakings and businesses to collect, use and disclose personal information without the knowledge or consent of the individual to establish, manage or terminate employment relationships;
• provide a framework for organizations to notify individuals proactively about disclosures of their personal information made in certain circumstances to government institutions; and
• require organizations to report material breaches of security safeguards to the Privacy Commissioner and to notify certain individuals and organizations of breaches that create a real risk of significant harm.

The proposed Regulations are administrative in nature and specifically provide definitions for terms used in Bill C-28, including “personal relationship” and “family relationship”. The Regulations also define the specific conditions under which consent would be considered validly obtained on behalf of a person whose identity was unknown as well as the permitted use of such consent, both of which are consistent with existing requirements for email marketers. Finally, the proposed Regulations specify the meaning of membership, club, association, and voluntary organization for the purposes of ss. 10(13)(c) of the legislation, which defines the term “existing business relationship”.

Stakeholders and interested persons may comment upon the proposed Regulations by September 9, 2011.

As previously reported, Bill C-28 specifically amends PIPEDA to prohibit the collection of personal information by means of unauthorized access to computer systems, and the unauthorized compiling of lists of electronic addresses. A discussion of Bill C-28 can be found in our FTR Now of June 9, 2010.

Bill C-28 was originally introduced with a Short Title, the Fighting Internet and Wireless Spam Act. At the Committee stage of the legislative process, there was disagreement as to whether this Short Title was appropriate, given that the Bill had been introduced in a previous session as Bill C-27, the Electronic Commerce Protection Act.

In view of this disagreement, the government indicated its intention at Third Reading to change C-28’s Short Title back to the Electronic Commerce Protection Act. However, it did not do so.

At present, there is no Short Title for C-28. The Act is therefore titled An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act.

Going forward, we will refer to it simply as “C-28”.

• the amendments to the Freedom of Information and Protection of Privacy Act ("FIPPA"), which come into force on January 1, 2012; and
• sections 5 to 16, dealing with the reporting of consultants and expense claims, procurement standards and compliance reports, which will come into force on April 1, 2011.

For more detailed information about the Bill, please read our FTR Now of November 5, 2010, "Government Introduces Public Sector Accountability Legislation".

More information about the extension of FIPPA to hospitals is available in our FTR Now of November 5, 2010, "Government to Bring Hospitals Under the Freedom of Information and Protection of Privacy Act".

As previously reported, the Bill passed at Third Reading on December 2, 2010 after being amended by the Standing Committee on Social Policy under an accelerated schedule for consideration and debate.

The Bill will come into force on a date to be named by proclamation, with the exception of the amendments to FIPPA, which will come into force on January 1, 2012.

For more detailed information about the Bill, please read our FTR Now of November 5, 2010, "Government Introduces Public Sector Accountability Legislation".

More information about the extension of FIPPA to hospitals is available in our FTR Now of November 5, 2010, "Government to Bring Hospitals Under the Freedom of Information and Protection of Privacy Act".

As previously reported, the Bill was amended by the Standing Committee on Social Policy and ordered for Third Reading on November 30, 2010 under an accelerated schedule for consideration and debate.

The Bill is expected to receive Royal Assent shortly and will come into force on a date to be named by proclamation, with the exception of the amendments to FIPPA, which will come into force on January 1, 2012.

For more detailed information about the Bill, please read our FTR Now of November 5, 2010, "Government Introduces Public Sector Accountability Legislation".

More information about the extension of FIPPA to hospitals is available in our FTR Now of November 5, 2010, "Government to Bring Hospitals Under the Freedom of Information and Protection of Privacy Act".

The Committee amendments include:

• an express protection against the disclosure of information protected by solicitor-client privilege, litigation privilege or settlement privilege; and
• an express obligation for hospitals and local health integration networks to post compliance attestations publicly on their websites.

The Bill is expected to be debated at Third Reading on December 1, 2010, and to pass shortly thereafter.

For more detailed information about the Bill, please read our FTR Now of November 5, 2010, "Government Introduces Public Sector Accountability Legislation".

More information about the extension of FIPPA to hospitals is available in our FTR Now of November 5, 2010, "Government to Bring Hospitals Under the Freedom of Information and Protection of Privacy Act".

As previously reported, the Bill would enact comprehensive anti-SPAM legislation. For example, it would prohibit the sending of commercial e-mails without prior consent of the recipient and provide a regulatory framework governing the sending of such messages. It would specifically amend PIPEDA to prohibit the collection of personal information by means of unauthorized access to computer systems, and the unauthorized compiling of lists of electronic addresses.  A discussion of Bill C-28 can be found in our FTR Now of June 9, 2010.

In our FTR Now of June 9. 2010, we summarize the major changes to PIPEDA outlined in both Bills and explain why these changes make it time for Canadian organizations to pay special attention to privacy protection and data security.

Bill C-29 would:

• specify the elements of valid consent for the collection, use or disclosure of personal information;
• permit the disclosure of personal information without the knowledge or consent of the individual for prescribed purposes (including identifying an injured, ill or deceased individual and communicating with their next of kin, performing police services and preventing, detecting or suppressing fraud);

Additional amendments to PIPEDA were introduced in Bill C-28, the Fighting Internet and Wireless Spam Act.

Bill C-28 would prohibit the sending of commercial e-mails without prior consent of the recipient and provide a regulatory framework governing the sending of such messages. It would specifically amend PIPEDA to prohibit the collection of personal information by means of unauthorized access to computer systems, and the unauthorized compiling of lists of electronic addresses.

An FTR Now is being prepared.

As Hicks Morley partner Dan Michaluk blogs on slaw.ca, if passed, this legislation will add to duties embodied in the Child Pornography Reporting Act, 2008, provincial legislation passed in December of 2008 (not yet in force), which imposes duties that apply to “persons” writ large—not only to internet service providers. Bill C-22 specifies that a person who has reported information in compliance with an obligation to report child pornography under the laws of a province will be deemed to have reported in compliance with the provisions of Bill C-22.