CRTC releases CASL compliance program bulletin

The CRTC just released another bulletin regarding CASL – Compliance and Enforcement Information Bulletin CRTC 2014-326.  It sets out “Guidelines to help businesses develop corporate compliance programs”.

The bulletin sets out CRTC thoughts on best practices for the development of corporate compliance programs for both CASL and the do not call rules.  It is worth taking a look at, because having a proper compliance program in place reduces the likelihood of a violation, helps establish a due diligence defence (a due diligence defence may not give a complete pass on a violation, but will reduce the consequences), and helps avoid director and officer personal liability.

Keep in mind that these bulletins do not have the force of law, and don’t bind the CRTC. And as the bulletin rightfully points out, all businesses are different, and small businesses don’t have the same resources as large one.

For more information on CASL search my blog for “CASL”, or visit the HP CASL page.

 

SCC “gets” tech – government not so much

Far too often – at least in my opinion – courts and legislators don’t seem to understand technology related issues or how the law should fit with them.  The Supreme Court of Canada, however, got it right with Spencer, which basically says that internet users have a reasonable expectation of anonymity in their online activities.  Last Fall the SCC sent a similar message in the Vu case saying that a general search warrant for a home was not sufficient to search a computer found there.  And that trend will hopefully continue with its upcoming Fearon decision on the ability to search cell phones incident to arrest.

While the SCC seems to now “get it” when it comes to privacy and technology, the federal legislature doesn’t seem to.  It has continually tried to erode privacy with a series of “lawful access” attempts, the latest of which may be unconstitutional given the Spencer decision.  Another example of the federal legislature not “getting it” is the CASL anti-spam legislation, which imposes huge burdens on normal businesses and software providers.

Cross posted to Slaw

http://harrisonpensa.com/lawyers/david-canton  

Clarification on CASL charity exemption?

Imagine Canada has published an Issue Alert resulting from discussions it had with Industry Canada about the charitable exemption to the anti-spam legislation. They say Industry Canada is interpreting this exemption broadly, which would be good news for charities.

The regulations contain an exemption that says the act does not apply to messages ” … sent by or on behalf of a registered charity as defined in subsection 248(1) of the Income Tax Act and the message has as its primary purpose raising funds for the charity”.

It was unclear how broad that exemption is in practice, given the broad definitions of CEM. Did it, for example, apply to fundraising events, or for tickets being sold by a theatre or orchestra?

Imagine Canada says Industry Canada has advised them that the exemption does apply to messages selling those things, and that ” .. “if the commercial activity is undertaken to carry out the charity’s mission, and the funds go directly to the charity to support its work, then it likely falls under the exemption.”

This is not a complete free pass for charities on CASL.  The act may still apply to some commercial activities of a charity, and might apply if a newsletter is laden with third party ads.

Lets hope Industry Canada or the CRTC adds this clarification to their own FAQs soon to give us further comfort on this.

 

The Cloud – Panacea or Perilous?

The cloud has been touted as a significant revolution in computing – providing scalable, secure, and cost effective alternatives to owing and managing your own computing infrastructure.  It has also been criticized for being insecure, unreliable, and a potential threat to the future of your business if something goes wrong.

So which is it?  It can be both, actually.

Done right – with the right application, the right vendor, the right agreement, and with proper attention to issues like security, encryption, privacy, and continuity – it can work very well.

Done wrong – without those details being considered – it has the potential to cause things ranging from spotty performance to embarrassing data leakage to a business ending catastrophic failure.

The key is to spend the time up front to get it right.

(Cross-posted to Slaw)

http://harrisonpensa.com/lawyers/david-canton

Carmi Levy’s 7 tech trends

I was at a presentation this morning by tech guru Carmi Levy who talked about 7 tech trends.  If you watch national news broadcasts you will have seen Carmi.

1. Cloud.  It aligns spend with need, and you can spend less time managing your infrastructure.

2. Mobile.  More smart phones were sold last year than feature phones.  Facebook revenue from mobile is more than 50% now.  Just 3 years ago was zero.  25% of Facebook users are mobile only.  This trend is similar for other providers - mobile is rapidly becoming a prime way to connect.  Businesses need to address the mobile market.   Some businesses are not even bothering with web sites because their customers are just using social media and apps.

3.  Social Media.  Social media is today’s town square.  It is changing the way we consume content and works well local as well as global.  London’s #Ldnont hash tag is an example of an effective local tool.

4.  Apps.  The real action is mobile.  Apps can be a meaningful way to connect.   In some cases they are becoming as important as a web site.  Apps vs responsive web is controversial.   Apps can give richer experience, but responsive can be simpler to do and is platform agnostic.

5.  Gaming.  Casual gaming is the fastest growing game segment. Ties in to the mobile trend.

6.  Ecommerce.   We are seeing a revolution at summer festivals in the park.  Festival vendors used to use cash only.  Now vendors increasingly use mobile payment options such as Square.  The tech allows the smallest of small business to do this easily and cheaply.

7.  Hyperlocal.  London’s Hacker studios is an example of a startup hub where users pay a subscription for space including mentoring and support.

In general, Carmi says tech is an investment not a cost.  It is a marketing enabler if it is done right.  It is a constant adaptive process, and has to be part of business culture in general – not just delegated to a particular department.  Digital competency is something we become not something we build.

Cross posted to Slaw

http://harrisonpensa.com/lawyers/david-canton

CASL observations

I was at a conference on CASL (anti-spam) last week chaired by Barry Sookman.  His summary of conference highlights is worth reading.  Below are some of my observations based on both that conference and my CASL dealings with clients so far.

Large companies are spending millions of dollars to comply with CASL.  Small business is struggling to comply and to make sense of how to comply and why it is even needed. But you can bet that the true spammers will just continue to try to hide from the regulators.

Opt-in rates for attempts to get express consents so far have in some cases been abysmal – low single digit %. I suspect there are a number of reasons for that. Many on the mail list don’t care (meaning it’s a waste of time to send to them anyway). But many actually do want it and are not paying attention, who will eventually wonder why they stop getting things.  The challenge is to request consents in a way that will encourage a quick and easy yes – meaning that the use of marketing professionals may be key to getting a good response rate.

There is so much uncertainty around CASL interpretation that CASL compliance will be an iterative process.

No software solutions are available for the average business to track CASL compliance.  There is a business opportunity to develop affordable mini-CRM software that meets CASL rules and evidentiary requirements and can tie in with bulk mail programs and contact management systems such as Outlook.

The CASL software consents that kick in in January 2015 have the potential to cause real havoc.  They are being overshadowed now because of the looming July 1 date for CEM, and that the software consent issue only applies to those creating software.  These rules are unprecedented, and there is a danger that many offshore software developers will simply not offer their products to Canadians rather than taking the time and effort to comply.

(Cross posted to Slaw)

http://harrisonpensa.com/lawyers/david-canton

 

 

 

Is wearable tech dead?

Nike just announced that it is exiting its FuelBand fitness tracker business.

Another article claims that “it’s only a matter of time until [Google Glass] joins devices such as the Zune, the Kin, the PlayBook, and the Xoom in tech hell.”

Despite musings that wearable tech is dead and dying, these are just growing pains.

Wearable devices are still in an early bleeding edge phase where manufacturers and users are trying to figure out what works, what users want, what users find creepy, and what users are willing to pay for.

Take Google Glass, for instance.  I have no doubt that there is a future for head mounted display devices.  The unknown is how popular they will be beyond niche uses for things like surgeons, mechanics or others needing to see and send information while they use their hands.

Fitness trackers have been compared to January gym memberships – many tend to use them for only a short time before abandoning them.  There may be a limit to sales of one function devices, but there is more promise to multifunction devices.  One potentially interesting market is for wearable devices that stretch beyond fitness tracking to medical tracking.

Wearables are not dead – but perhaps are in the “trough of disillusionment” in the Gartner Hype Cycle.

hype cycle

Cross posted on Slaw

Spam now so you can Spam later

CASL - the new Canadian anti-spam act - comes into force July 1.  It contains extensive, complex provisions that apply to the sending of any email that has a hint of a commercial purpose (a “CEM”).  In the short term it may increase the amount of email we get.  We have all received emails from mail lists we are on asking us to confirm our consent.  But there is another reason we may get more.  The reason goes like this:

CASL requires express or implied consent from the recipient before a CEM can be sent.

The act contains a transitional provision that gives up to 3 years to get express consent. (The section is below.) To take advantage of that, there must be a current or prior business or non-business relationship with the recipient AND that relationship must include communication of CEM.

Couple that with the fact that after July 1 you can’t send an email to request consent (unless there is implied consent).

So to pull as many email addresses as possible into the transition provision, maximize express consents, and give the longest possible time to obtain them, the tactic is …?

Before July 1, pull together every email address you can get from every person that you can fit into the business or non-business relationship category, and send CEM to them.

The transition section:

66. A person’s consent to receiving commercial electronic messages from another person is implied until the person gives notification that they no longer consent to receiving such messages from that other person or until three years after the day on which section 6 comes into force, whichever is earlier, if, when that section comes into force,

(a) those persons have an existing business relationship or an existing non-business relationship, as defined in subsection 10(10) or (13), respectively, without regard to the period mentioned in that subsection; and

(b) the relationship includes the communication between them of commercial electronic messages.

Cross posted to Slaw.

http://harrisonpensa.com/lawyers/david-canton

Are you vulnerable to Heartbleed?

A serious flaw has been discovered in OpenSSL - the browser encryption standard used by an estimated two-thirds of the servers on the internet.  This flaw has been there for a couple of years, and allows hackers to read data stored in memory.  That gives hackers access to anything in memory, including security keys, user names and passwords, emails and documents.  More detail is on Gigaom and Schneier on Security.

An update to OpenSSL fixes the flaw.  Anyone who has a website should ask their service provider if it affects their site, and have it updated immediately.

And for those of you still using Windows XP or Office 2003 – upgrade that immediately as well.  I was surprised to read this morning that as many as 30% of Windows based computers still use XP.  As of today, Microsoft is no longer supporting them.

[cross-posted on Slaw]

Office for iPad – there’s a catch

Microsoft released office for iPad last week. They have promised to release Office for Android soon as well.

The good news is that it is free to download. The bad news is that it can only be used as a reader. If you want to create or edit documents, you need an Office 365 account. And if you have a personal Office 365 account, the terms don’t let you use it for commercial purposes.

Office 365 is Microsoft’s cloud based service that is purchased for an annual fee.

Even if your office has one of the many flavours of Microsoft corporate licenses, you probably don’t have Office 365 access. That means that to use iPad or Android Office, there is a significant extra cost.

Frankly, while a usable Office on a tablet would be marvelous to have, the price is far too high.

Microsoft has been getting some flak over this. Hopefully they will come up with an alternate way of giving access to those of us who already use Office.

In the meantime, free alternatives such as Google’s Quickoffice work well enough.

[cross-posted on Slaw]