Newport Thomson

In 2010 a new Anti Spam law was passed in Canada called the Candian Anti Spam Legislation or CASL for short. It promised aggressive enforcement for those who continued to use electronic messaging to spam people. Spam simply means “irrelevant” to the recipient.

The government set forth a plan to come into force in 2014. When that plan was revealed it turned out to be a 3 year plan with staged elements coming into force by specific dates. So in total, organizations had at least 7 years to come into compliance. That’s right – 7 years!

The Canadian Radio and Telecommunications Commission (CRTC) was positioned as the lead enforcement agency with the Competition Bureau and the Office of the Privacy Commission having limited enforcement powers.

Beginning in July 2014 the CRTC used the first 18 months to investigate and fine a few high profile companies like Rogers and Porter Airlines. As part of these announcements they were very clear why the fines were issued and every one of them required an order to come into compliance within 6 months. They also issued guidance documents to allow organizations to understand key elements of this new law.

In December 2015, CRTC’s focus shifted. They started several International discussions designed to create Memos of Understanding (MOUs) in order to enforce this tough new standard globally. It was clear to us watching them closely that they were setting the table for the Private Right of Action to come into force on July 1, 2017. The PRA was always meant to be the PRIMARY enforcement tool. With the public holding organization’s feet to the fire, the enforcement bodies could focus on malicious activity and the dark web, where their enforcement actions could make a significant difference in the amount of spam in our inboxes.

On June 14, 2017, just 2 weeks before the PRA was to come into force, then Minister of Innovation, Science and Economic Development (ISED), Minster Navdeep Bains, announced the “indefinite suspension” of the Private Right of Action. “in order to promote legal certainty for numerous stakeholders claiming to experience difficulties in interpreting several provisions of the Act while being exposed to litigation risk.”

“They noted that such a delay would not leave individual Canadians without enforcement of CASL and highlighted that a robust and comprehensive public enforcement regime is in place, with dedicated staffing and funding.”

https://gazette.gc.ca/rp-pr/p2/2017/2017-06-14/html/si-tr31-eng.html

In early June 2017, Newport Thomson had 25+ potential contracts with a variety of organizations to help bring them into full compliance with CASL. Our practice was to understand the specific situation, write a clear Statement of Work and issue short contracts referring to those SOWs. Then the work of changing internal practices that are not compliant and replacing them with new practices begins.

Despite Minister Bain’s claim that “a comprehensive enforcement regime is in place”, not one of those documented engagements came to fruition. Not one. CASL compliance disappeared from most organization’s priority lists on June 14, 2017. In fact, despite having written the only private sector book on CASL Compliance, we have not had a single CASL compliance engagement since June 14, 2017! We have included electronic messaging in most Privacy Management Programs we have helped implement, but it was almost always our recommendation to do so.

In the past 8 years there have been 24 enforcement files recorded (violations and undertakings) by the CRTC under CASL. In 2018, only 4 violations/undertakings were announced by CRTC. – https://crtc.gc.ca/eng/ce/actions.htm#casl . Fact is, they have limited resources to enforce laws that have global impact and CASL is not the only law they enforce. Without the PRA they appeared to have “benched” themselves for a couple of years while they rethought their enforcement strategy.

We address this to bring attention to the private right of action embedded in Section 132 of the first reading of Bill C-36. I quote:

“Private Right of Action

Damages — contravention of Act

132 (1) An individual who is affected by an act or omission by an organization that constitutes a contravention of this Act has a cause of action against the organization for damages for loss or injury that the individual has suffered as a result of the contravention if

(a) the Commissioner has made a finding under subsection 105(1) or section 106 that the organization has contravened this Act and

(i) the organization has paid the penalty and subsection 107(4) or 108(4) apply, as the case may be,

(ii) the finding is not the subject of an application for review under section 109 and the time limit for applying for a review set out in a notice of contravention has expired,

(iii) the Commission has confirmed or varied the finding under subsection 110(1),

(iv) the finding is not appealed and the time limit for making an appeal under subsection 126(2) has expired, or

(v) the Federal Court has dismissed an appeal of the finding under section 128;

(b) the Federal Court has made a finding under section 128 that the organization has contravened this Act;

(c) a final decision dismissing any appeal of the finding, or confirming the finding that the organization has contravened this Act, has been made and all rights of appeal have been exhausted; or

(d) the Commissioner has entered into a compliance agreement with the organization under section 103 and the agreement does not provide for the payment of damages for that loss or injury.

Damages – offence

(2) If an organization has been convicted of an offence under section 145, an individual affected by the act or omission that gave rise to the offence has a cause of action against the organization for damages for loss or injury that the individual has suffered as a result of the act or omission.

For greater certainty

(3) For greater certainty, subsections (1) and (2) do not limit or affect an individual’s right to avail themselves of a civil remedy under another Act of Parliament, under an Act of a legislature of a province or at common law.

Limitation period or prescription

(4) An action must not be brought later than two years after the day on which the individual becomes aware of

(a) in the case of an action under subsection (1),

(i) the Commissioner’s finding,

(ii) if there is a review under section 109, the decision of the Commission, or

(iii) if there is an appeal, the final decision after all rights of appeal have been exhausted; and

(b) in the case of an action under subsection (2), the conviction.

Court of competent jurisdiction

(5) An action referred to in subsection (1) or (2) may be brought in the Federal Court or a superior court of a province.”

Under this Private Right of Action: Can Individuals Sue?

One of the most significant features of Bill C-36 is that it gives individuals the ability to sue an organization if they have suffered harm because the organization violated the law.

However, this is not an open invitation for anyone to file a lawsuit whenever they believe their privacy has been violated.

Instead, the legislation sets a high threshold.

Before someone can sue:

The Privacy Commissioner must first determine that the organization broke the law, or

The Federal Court must make that finding, or

The organization must have entered into a compliance agreement acknowledging the issue.

In many cases, the organization will also have exhausted its opportunities to challenge that decision through reviews or appeals before a lawsuit can proceed.

Why This Matters

This approach prevents organizations from being flooded with speculative lawsuits every time someone alleges a privacy violation.

Instead, a civil lawsuit is generally available only after an independent regulator or the courts have confirmed that the organization actually contravened the Act.

That significantly reduces the risk of frivolous litigation while still giving individuals an avenue to recover compensation when real harm has occurred.

What Can Someone Recover?

If these conditions are met, an affected individual can seek compensation for the actual loss or injury they suffered because of the organization’s violation.

The Act does not create automatic damages or fixed penalties payable to individuals. A person must still demonstrate that they suffered a loss or injury caused by the organization’s conduct.

Other Legal Rights Remain

The legislation also makes it clear that this new right does not replace existing legal remedies.

Individuals may still pursue claims that are available under:

provincial privacy laws,

other federal legislation, or

common law (such as negligence or breach of confidence), where those remedies are available.

Time Limit

An individual generally has two years from becoming aware of the final regulatory or court decision (or conviction for an offence) to commence an action.

Is This a Strong Enforcement Tool?

Yes, but in a measured way.

For organizations, the provision increases accountability because a confirmed violation can expose them to both regulatory penalties and civil lawsuits from affected individuals.

For individuals, it provides a realistic path to compensation, but only after the regulator or courts have established that the organization violated the law. This strikes a balance between protecting privacy rights and avoiding unnecessary litigation.

In practical terms, businesses should view Section 132 as a secondary enforcement mechanism. The primary enforcement still comes from the Privacy Commissioner and the new tribunal/court process. Once a violation has been confirmed, however, organizations may face additional financial exposure through civil claims brought by affected individuals. The reality will likely end up like CASL, where the PRA became the primary tool due to limited resources of the new Commission.

A Caveat

Organizations know that a private right of action can be very costly. This should signal high-risk and have them taking actions to comply. Most enforcement of similar laws are designed to have organizations come into compliance rather than punishing them.

But, their experience is, Canada always chickens out at the last minute. If CASL is any example, the fear of non-compliance may not put players in motion, early in the Government’s timeline. Organizations invested a significant amount of time and money to be CASL compliant, right up to June 14, 2017. And very little since. They know Canada does not like class action lawsuits, unlike our neighbours to the South.

Our recommendation to this Government: strengthen the PRA and do not “indefinitely postpone” it when companies who have not come into compliance complain loudly through their industry Associations. The loudest ones should be amongst the first to be investigated. That should have been a very different signal to Minister Bains back in June 2017.