Area of Law: Internet and Cyber Law
Answer # 362
Software Installation and Alteration of DataRegion: Ontario Answer # 362
The first part of Canada’s Anti-Spam Legislation (CASL) came into force on July 1, 2014. It has received much attention regarding the new rules pertaining to electronic communications, particularly with regard to sending unwanted or unrequested emails. CASL, however, deals with more than just anti-spam laws. Rules regarding software installation and the alteration of transmission data came into force on January 15, 2015.
Computer program installation rules
Under CASL, those engaged in commercial activity are precluded from installing a computer program on any person’s computer system, without their consent.
Specifically, in the course of commercial activities, the law prohibits:
- the installation of computer programs on another person’s computer (or device) system, without the express consent of the owner or authorized user of that system,
- causing a computer program to be so installed, without such consent, and
- having installed such a computer program, causing it to communicate with other electronic devices without such consent.
The law defines computer programs to include software applications as well as updates (upgrades) to the application. CASL will apply to both updates that are manually or automatically installed.
Commercial activity: In addition, it is important to note that commercial activity does not require an expectation of profits. The legislation defines commercial activity as:
“any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, whether or not the person who carries it out does so in the expectation of profit, other than any transaction, act or conduct that is carried out for the purposes of law enforcement, public safety, the protection of Canada, the conduct of international affairs or the defence of Canada.”
This means that the law also applies to free downloads. There are some limited exceptions, where the user’s actions make it reasonable to conclude that they have consented to the installation, such as with operating systems, and cookies.
Self-installed software: Because of the way the legislation was drafted, there was some question as to whether the CASL rules, with regard to software installation, apply when the owner (or authorized user) of a computer (or device) intentionally installs a computer program on the computer (or device). The CRTC (Canadian Radio-Television and Telecommunications Commission) says no, the CASL rules do not apply.
To receive consent, the person making the request must clearly state:
- why the consent is being sought,
- who is asking for the consent (it may be someone other than the person making the request),
- contact information of the person making the request and/or the person on whose behalf the request is being made,
- a statement confirming that the consent can be revoked (withdrawn) at any time,
- a basic description of the software’s functions and purpose, (more detailed information will be required if the software is capable of specific functions such as, interfering with the control of the computer, or collecting personal information).
The new legislation provides a three-year transition period for software installed prior to January 15, 2015. Such software therefore, can be upgraded or updated without express consent until January 15, 2018, at which time the new consent requirements will apply.
Alteration of transmission data
The new legislation also prohibits the alteration of transmission data in the course of commercial activity. As of January 15, 2015, it is illegal to transmit data (or cause it to be transmitted) in an electronic message, so that the message is sent to a recipient (destination) other than the one identified by the sender, unless consent of the sender or the recipient is obtained and the sender provides an opt-out mechanism.
For each violation of the new rules under CASL, the fines can be up-to $10,000,000 for organizations, and as high as $1,000,000 for individuals. If an employee engages in any of the prohibited behaviour, the employer can be held responsible. As well, directors and officers may be held personally liable for a breach of the new law.
For more information about Canada’s Anti-Spam Legislation, visit fightspam.gc.ca. Visit the Canadian Radio-television and Telecommunications Commission website for more information regarding the requirements for installing computer programs.
For help dealing with the new legislation, contact a computer or technology lawyer.
You now haveoptions: