In late November, the Canadian Radio-television and Telecommunications Commission (CRTC), the Office of the Privacy Commissioner of Canada (OPC) and the Competition Bureau (Bureau) announced the issuance of 36 warning letters to various mobile app companies in Canada. The letters are reported to have raised potential concerns under Canada’s anti-spam legislation (CASL), the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Competition Act. We detail below the basis for the issuance of these letters, focusing in particular upon the Competition Act, potential next steps by the regulators and implications for Canadian businesses.

Why the Warning Letters?

Under the Competition Act, the focus of the letters was reportedly upon “apps that make false or misleading claims to promote a product, a service or a business interest,” a practice that could invoke the application of the misleading representation provisions and attract significant monetary penalties of up to $10 million for an initial contravention and up to $15 million for subsequent contraventions.

As we previously reported, the Bureau has been taking enforcement measures in this area, including with respect to representations or reviews by employees about a company’s apps, and representations concerning the use and collection of data. In the press release announcing the issuance of the warning letters, a senior representative of the Bureau stated: “Businesses involved in the mobile app industry must be clear and disclose accurate information upfront to help consumers make informed decisions. Canadians expect and deserve truth from businesses in the digital economy, and the Bureau will take action if it becomes aware of businesses making false or misleading claims on their app or in electronic messages.” The references to providing sufficient disclosure “upfront” may suggest that the Bureau has concerns about (i) mandatory fees that are not disclosed in initial price representations but are applied later in the purchasing process; or (ii) the collection or use of data that is not sufficiently disclosed to consumers.

The warning letters also raised potential concerns under PIPEDA including, for example, with respect to “apps that collect or use personal information, such as electronic addresses, without consent” and “apps designed to spam users’ friends and contacts.” As the OPC’s press release explains, the OPC may take enforcement action if there has been “harvesting of electronic addresses; and the collection of personal information through illicit access to other people’s computer systems, primarily through means such as spyware.”

Finally, the warning letters raised concerns about whether the apps send commercial electronic messages, alter transmission data or download computer programs without the appropriate consent (issues that fall within the enforcement mandate of the CRTC under CASL).

What’s Next?

Since the regulators have now issued warning letters and made their respective concerns public, it would not be surprising to see them follow up with enforcement action against individual companies, especially if these companies received a letter and did not take corrective action. For example, in July 2017, the Bureau issued a broad warning to the ticketing industry calling on participants to review their marketing and pricing practices. Less than six months later, the Bureau filed an application with the Competition Tribunal alleging that certain companies had engaged in false or misleading representations as a result of the failure to disclose certain mandatory fees.

Although the three regulators (CRTC, Bureau and OPC) can already share information to some degree under their respective enforcement mandates under CASL, we expect to see increased cooperation in the future. In particular, legislation currently being considered by the Canadian Parliament (Bill C-11) would permit broader information sharing, allowing the OPC, Bureau and CRTC to “undertake and publish research on issues of mutual interest” and to “develop procedures for disclosing information” to each other when such information is relevant to their respective “powers, duties and functions” under their legislative mandates.

Implications

Enforcement in the digital economy and particularly in relation to the use and collection of consumer data is likely to remain a high priority for Canadian regulators. As a result, companies operating in Canada would be wise to ensure that their mobile applications, websites and emails to consumers do not raise the issues highlighted in these warning letters from three of the leading regulators in the digital space.