Enforcement thumb image

CRTC CASL Compliance and Enforcement Update

On February 12th Lynne Perrault and Dana-Lynn Wood did a presentation to continue the CRTC’s “on-going dialogue” with industry. Keith Rose wrote a great synopsis for snIP/ITs:

As of early February 2016, the SRC has received over 500,000 complaints. These have been received fairly steadily at a rate of about 22,000 per month (5,000 – 6,000 per week), although there is a noticeable spike each time the CRTC issues an enforcement announcement.

More than 80% of the submissions from Canadians (a subset – the SRC accepts submissions from non-Canadians as well) have been about email. SMS is the next largest category, at about 13%. However, this may reflect (at least in part) the fact that the collection mechanisms that the SRC uses were largely designed with email in mind and it is much easier to report an email message to the SRC than any other kind of CEM.

An overwhelming 94% of complaints involved some form of consent issue (including both initial consent and withdrawal of consent/unsubscribe issues). Approximately 1/3 of complaints involved the identification requirements, and slightly less than that (28%) involved some allegation of deceptive marketing practices. (The numbers do not add up to 100% because complaints may involve multiple issues. Also, to be clear, the analysis is of issues reported by the complainants without any attempt to assess their merits.)

The presenters also addressed the interpretation of the due diligence provisions of the Act. As they explained it, whether an organization has exercised due diligence is an all-or-nothing question; there is no partial defence.

The presenters referred to a number of factors or tests that might be applied, including having adequate written policies with adequate on-going training, contemporaneous record-keeping, active monitoring and enforcement to put those policies into practice as well as responsiveness to complaints, problems and to inquiries from the CRTC. It was not entirely clear whether these were factors to consider, if relevant, or tests that would apply on a cumulative basis. But in any case, the Commission’s view seems to be that due diligence is not a one-time activity; it is an on-going, day-to-day activity that organizations will have to practice and document if they want to be able to rely on it as a defence.

To read the rest of the synopsis please visit: http://www.canadiantechlawblog.com/2016/02/12/crtc-casl-compliance-and-enforcement-update/