Anti-Spam Laws in Different Jurisdictions: A Comparative Analysis

CAN-SPAM Act, 2003

Spam Act, 2003 (Australia)

Spam Control Act, 2007 (Singapore)

Canada's Anti-Spam Legislation, 2014

The Privacy and Electronic Communications (EC Directive) Regulations, 2003

(United Kingdom)

Jurisdiction

National Jurisdiction.

The defendant must be either an inhabitant of the United States or have a physical place of business in the US.[1]

National Jurisdiction.

Must have an "Australian link" i.e.

(a) the message originates in Australia; or

(b) the individual or organisation who sent the message, or

authorised the sending of the message, is:

(i) an individual who is physically present in Australia

when the message is sent; or

(ii) an organisation whose central management and control

is in Australia when the message is sent; or

(c) the computer, server or device that is used to access the

message is located in Australia; or

(d) the relevant electronic account-holder is:

(i) an individual who is physically present in Australia

when the message is

Spam Act, 2003, § 7

Spam Control Act, 2007, § 7(2)

Canada's Anti-Spam Legislation, 2014, §accessed; or

(ii) an organisation that carries on business or activities in

Australia when the message is accessed; or

(e) if the message cannot be delivered because the relevant

electronic address does not exist-assuming that the

electronic address existed, it is reasonably likely that the

message would have been accessed using a computer, server

or device located in Australia.[2]

National Jurisdiction.

Must have a "Singapore link"

An electronic message has a Singapore link in the following circumstances:

(a) the message originates in Singapore;

(b) the sender of the message is -

(i) an individual who is physically present in Singapore when the message is sent; or

(ii) an entity whose central management and control is in Singapore when the message is sent;

© the computer, mobile telephone, server or device that is used to access the message is located in Singapore;

the recipient of the message is-

(i) an individual who is physically present in Singapore when the message is accessed; or

(ii)an entity that carries on business or activities in Singapore when the message is accessed; or

(e) if the message cannot be delivered because the relevant

electronic address has ceased to exist (assuming that the electronic address existed), it is reasonably likely that the

message would have been accessed using a computer, mobile telephone, server or device located in Singapore.[3]

Extends to cases where the mail originates in a foreign state but is accessed in Canada

Section 6 of the CASL prohibits the sending of unsolicited CEMs.[4]

As per Section 12 of the CASL, A person contravenes section 6 only if a computer system located in Canada is used to send or access the electronic message.

CASL applies to CEMs sent from, or accessed in, Canada.[5]

So, if a CEM is sent to Canadians from another jurisdiction, CASL will apply. Notably, there is an exception where the person sending the message "reasonably believes" that the message will be accessed in one of a list

of prescribed jurisdictions with anti-spam laws thought to

be 'substantially similar' to CASL and the message complies with the laws of that jurisdiction.

European Union

These regulations can be enforced against a person or a company anywhere in the European Union who violates the regulations.

Definition Of Spam

"unsolicited, commercial, electronic mail"[6], where

a commercial electronic mail is "any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service"[7]

"unsolicited commercial electronic messages" where electronic message means a message sent "using an internet carriage service or any other listed carriage service; and to an electronic address in connection with: an e-mail account; or an instant messaging account; or a telephone

account; or a similar accounts."[8]

"unsolicited commercial electronic message sent in bulk", where

a CEM is unsolicited if the recipient did not-

i) request to receive the message; or

ii)consent to the receipt of the message;[9] and

CEMs shall be deemed to be sent in bulk if a person sends, causes to be sent or authorizes the sending of-

a) more than 100 messages containing the same subject matter during a 24-hour period;

b) more than 1,000 messages containing the same subject matter during a 30-day period;

c) more than 10,000 messages containing the same subject matter during a one-year period.

"unsolicited, commercial, electronic message"[10]

where, an "electronic message" means a message sent by any means of telecommunication, including a text, sound, voice or image message.[11]

These rules apply to all unsolicited direct marketing communications by automatic call machines[12], fax[13], calls[14] or e-mail[15].

Where, "direct marketing" is defined as "the communication (by whatever means) of any advertising or marketing material which is directed to particular individuals"[16]

The UK used its discretion to include voice-to-voice telephone calls as well.

Consent Requirement

Opt-out

Opt-in

Opt-out

Opt-in

Opt-in

CEMs are unlawful unless the message provides-

(i)clear and conspicuous identification that the message is an advertisement or solicitation;

(ii)clear and conspicuous notice of the opportunity under paragraph (3) to decline to receive further commercial electronic mail messages from the sender; and

(iii) a valid physical postal address of the sender.[17]

Section 16 prohibits the sending of unsolicited commercial electronic messages. However, where a recipient has consented to the sending of the message, the said prohibition does not apply.[18]

Consent means:

(a) express consent; or

(b) consent that can reasonably be inferred from:

(i) the conduct; and

(ii) the business and other relationships;

of the individual or organisation concerned.[19]

CEMs are unlawful unless the message contains-

1 a) an electronic mail address, an Internet location address, a telephone number, a facsimile number or a postal address that the recipient may use to submit an unsubscribe request; and

b) a statement the above information may be utilized to send an unsubscribe request.

2. Where the unsolicited CEM is received by text or multimedia message sent to a mobile telephone number, the CEM must include a mobile telephone number to which the recipient may send an unsubscribe request. [20]

Under the CASL, it is prohibited to send or cause or permit to be sent to an electronic address a commercial electronic message unless,

(a) the person to whom the message is sent has consented to receiving it, whether the consent is express or implied; and

(b)

The message must-

(i) set out prescribed information that identifies the person who sent the message and the person - if different - on whose behalf it is sent;

(ii) set out information enabling the person to whom the message is sent to readily contact one of the persons referred to in paragraph

(i); and

(iii) set out an unsubscribe mechanism in accordance with subsection 11(1) of CASL.[21]

Under Section 19 , A person shall neither transmit, nor instigate the transmission of, communications comprising recorded matter for direct marketing purposes by means of an automated calling system except in the circumstances where the called line is that of a subscriber who has previously notified the caller that for the time being he consents to such communications being sent by, or at the instigation of, the caller on that line.

Under Section 20 , A person shall neither transmit, nor instigate the transmission of, unsolicited communications for direct marketing purposes by means of a facsimile machine where the called line is that of an individual or a company except in the circumstances where the individual subscriber has previously notified the caller that he consents for the time being to such communications being sent by, or at the instigation of, the caller.

Under Section 21, A person shall neither use, nor instigate the use of, a public electronic communications service for the purposes of making unsolicited calls for direct marketing purposes where the called line is that of a subscriber who has previously notified the caller that such calls should not for the time being be made on that line.

Under Section 22 , a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail unless the recipient of the electronic mail has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender.

Labelling Requirements

Warning Labels mandatory on e-mails containing pornographic content

No person may send to a protected computer, any commercial electronic mail message that includes sexually oriented material and-

(a) fail to include in subject heading for the electronic mail message the marks or notices prescribed by the law; or

(B) fail to provide that the matter in the message

that is initially viewable to the recipient, when the message is opened by any recipient and absent any further actions by the recipient, includes only-

(i) material which the recipient has consented to;

(ii) the identifier information required to be included in pursuance Section 5(5); and

(iii) Instructions on how to access, or a mechanism to access, the sexually oriented material.[22]

Not Applicable.

True e-mail title and clear identification of advertisements with "ADV" label

Every unsolicited CEM must contain-

a) where there is a subject field, a title which is not false or misleading as to the content of the message;

b) the letters "<ADV>" with a space before the title in the subject field or if there is no subject field, in the words first appearing in the message to clearly identify that the message is an advertisement;

c) header information that is not false or misleading; and

d) an accurate and functional e-mail address or telephone number by which the sender can be readily contacted.[23]

Not Applicable.

Not Applicable.

Other Banned/Restricted Activities

Illegal Access- Prohibition Against Predatory and Abusive Commercial E-Mail-

"Whoever, in or affecting interstate or foreign

commerce, knowingly-

(1) accesses a protected computer without authorization, and intentionally initiates the transmission of multiple CEMs from or through such computer,

(2) uses a protected computer to relay or retransmit multiple

CEMs, with the intent to

deceive or mislead recipients, or any Internet access service, as to the origin of such messages,

(3) materially falsifies header information in multiple commercial electronic mail messages and intentionally initiates

the transmission of such messages,

(4) registers, using information that materially falsifies the identity of the actual registrant, for five or more electronic mail accounts or online user accounts or two or more domain names, and intentionally initiates the transmission of multiple

commercial electronic mail messages from any combination of such accounts or domain names, or

(5) falsely represents oneself to be the registrant or the legitimate successor in interest to the registrant of 5 or more Internet Protocol addresses, and intentionally initiates the transmission of multiple commercial electronic mail messages from such addresses, or conspires to do so, shall be punished as provided for in the Act.[24]

Supply of address harvesting software and harvested‑address lists

"A person must not supply or offer to supply:

(a) address‑harvesting software; or

(b) a right to use address‑harvesting software; or

(c) a harvested address list; or

(d) a right to use a harvested‑address list;

to another person if:

(e) the supplier is:

(i) an individual who is physically present in Australia at the time of the supply or offer; or

(ii) a body corporate or partnership that carries on business or activities in Australia at the time of the supply or offer; or

(f) the customer is:

(i) an individual who is physically present in Australia at the time of the supply or offer; or

(ii) a body corporate or partnership that carries on business or activities in Australia at the time of the supply or offer."

Dictionary Attacks and Address harvesting software

"No person shall send, cause to be sent, or authorize the sending of, an electronic message to electronic addresses generated or obtained through the use of-

a) a dictionary attack;

b) address harvesting software.[25]

Where,

"dictionary attack" means the method which by which the electronic address of a recipient is obtained using an automated means that generates possible electronic addresses by combining names, letters, numbers, punctuation marks or symbols into numerous permutations.[26] And,

"address harvesting software" means software that is specifically designed or marketed for use for-

a)searching the Internet for electronic addresses; and,

b) collecting, compiling, capturing or otherwise harvesting those electronic addresses."[27]

Altering Transmission Data

"It is prohibited, in the course of a commercial activity, to alter or cause to be altered the transmission data in an electronic message so that the message is delivered to a destination other than or in addition to that specified by the sender, unless

(a) the alteration is made with the express consent of the sender or the person to whom the message is sent, and the person altering or causing to be altered the data complies with subsection 11(4) of CASL; or

(b) the alteration is made in accordance with a court order.[28]

Installation of Computer Program

A person must not, in the course of a commercial activity, install or cause to be installed a computer program on any other person's computer system or, having so installed or caused to be installed a computer program, cause an electronic message to be sent from that computer system, unless

(a) the person has obtained the express consent of the owner or an authorized user of the

computer system and complies with subsection 11(5) of the CASL; or

(b) the person is acting in accordance with a court order.

(2) A person contravenes subsection (1) only if the computer system is located in Canada at the relevant time or if the person either is in Canada at the relevant time or is acting under the direction of a person who is in Canada at the time when they give the directions."[29]

Electronic mail for direct marketing purposes where the identity or address of the sender is concealed

A person shall neither transmit, nor instigate the transmission of, a communication for the purposes of direct marketing by means of electronic mail-

(a) where the identity of the person on whose behalf the communication has been sent has been disguised or concealed; or

(b)where a valid address to which the recipient of the communication may send a request that such communications cease has not been provided.

Types of Senders Covered

Spammers and beneficiaries-

the term ''sender'', when used with respect to a commercial electronic mail message, means a person who initiates such a message and whose product, service, or Internet web site is advertised or promoted by the message."[30]

Spammers and beneficiaries-

A person must not send, or cause to be sent, a commercial electronic message that:

(a) has an Australian link; and

(b) is not a designated commercial electronic message.[31]

Spammers,

beneficiaries, and

providers of support

services

"sender" means a person who sends a message, causes the message to be sent, or authorizes the sending of the message.[32]

Further, persons aiding or abetting the offences under Section 9 or 11 are also punishable under the Act.[33]

Spammers and beneficiaries-

Under Section 6, it is prohibited to send or cause or permit to be sent to an electronic address a CEM.

Under Section 7, It is prohibited, in the course of a commercial activity, to alter or cause to be altered the transmission data in a CEM.

Under Section 8, A person must not, in the course of a commercial activity, install or cause to be installed a computer program on any other person's computer system or, having so installed or caused to be installed a computer program, cause an electronic message to be sent from

that computer system.

Spammers and beneficiaries-

The texts of Sections 19, 20, 21 and 22 all prohibit the transmission as well as the instigation of the transmission of, communications for direct marketing purposes without the consent of the recipient.

Who Can Sue

FTC[34], Attorney Generals[35], ISPs and IAPs[36] and most recently even companies/private entities[37]

Australian Communications and Media Agency (ACMA)[38]

Any injured party, including individual users.[39]

Any injured party, including individual users.[40]

Any person who suffers damage by reason of any contravention of any of the requirements of these Regulations.[41]

Exceptions

Transactional or Relationship Messages [42]

where,

The term ''transactional or relationship

message'' means an electronic mail message the primary purpose of which is-

(i) to facilitate, complete, or confirm a commercial

transaction;

(ii) to provide warranty information, product recall information, etc. with respect to a commercial product or service used or purchased by the recipient;

(iii) to provide notifications-

(I) concerning a change in the terms or features of;

(II) of a change in the recipient's standing or status with respect to; or

(III) information with respect to a subscription, membership, account, loan, or comparable ongoing commercial relationship involving the

ongoing purchase or use by the recipient of products or services offered by the sender;

(iv) to provide information directly related to an employment relationship or related benefit plan in which the recipient is currently involved, participating,

or enrolled; or

(v) to deliver goods or services, including product updates or upgrades, that the recipient is entitled to receive under the terms of a transaction that the recipient has previously agreed to enter into with the sender.

Designated Commercial Electronic Message (DCEM). A DCEM is a message containing purely factual information, any related comments of non-commercial nature and some limited commercial information as to the identity of the sender company/individual.[43]

A message is a DCEMs if-

a) the sending of the message is authorized by any of the following bodies:

(i) a government body;

(ii) a registered political party;

(iii) a religious organization;

(iv) a charity or charitable institution; and

(b) the message relates to goods or services; and

(c) the body is the supplier, or prospective supplier, of the goods or services concerned.[44]

Messages from educational institutions:

an electronic message is a DCEM if:

(a) the sending of the message is authorised by an educational institution; and

(b) either or both of the following subparagraphs applies:

(i) the relevant electronic account‑holder is, or has been, enrolled as a student in that institution;

(ii) a member or former member of the household of the relevant electronic account‑holder is, or has been, enrolled as a student in that institution; and

(c) the message relates to goods or services; and

(d) the institution is the supplier, or prospective supplier, of the goods or services concerned.

Electronic Messages authorized by the Government[45]

The Act does not apply to any electronic message where the sending of the message is authorized by the Government or a statutory body on the occurrence of any public emergency, in the public interest or in the interests of public security or national defence.[46]

A certificate signed by the Minister shall be conclusive evidence of existence of a public emergency and the other above stated matters.[47]

• Family and Personal relationships, where

"Family relationship" is a relationship between two people related through marriage, a common law partnership, or any legal parent-child relationship who have had direct, voluntary two-way communications; and

"personal relationship" means a relationship between two people who have had direct, voluntary two-way communications where it would be reasonable to conclude that the relationship is personal.[48]

• Mails sent to an individual who practices a particular commercial activity with the mail containing solely an inquiry or application related to that activity[49].
• A mail which - provides a quote or estimate for the supply of a product, goods, a service, etc. if requested by the recipient;

· facilitates, completes or confirms a commercial transaction that the recipient previously agreed to enter into with the sender;

· provides warranty information, product recall information etc. about a product, goods or a service that the recipient uses, has used or has purchased;

· provides notification of factual information about-

(i) the ongoing use or ongoing purchase by the recipient of a product, goods or a service offered under a subscription, membership, account, loan or similar relationship by the sender, or

· provides information directly related to an employment relationship or related benefit plan in which the recipient is currently involved, is currently participating or is currently enrolled;

· delivers a product, goods or a service, including updates or upgrades, that the recipient is entitled to receive under the terms of a transaction that they have previously entered into with the sender.[50]

· Telecommunications service provider merely because the service provider provides a telecommunications service that enables the transmission of the message.[51]

· CEMs which are two-way voice communication between individuals sent by means of a facsimile or a voice recording sent to a telephone account.[52]

A person may send or instigate the sending of electronic mail for the purposes of direct marketing where -

(a) the contact details of the recipient of that electronic mail in the course of the sale or negotiations for the sale of a product or service to that recipient;

(b) the direct marketing is in respect of that person's similar products and services only; and

(c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact details for the purposes of such direct marketing, at the time that the details were initially collected, and, where he did not initially refuse the use of the details, at the time of each subsequent communication.[53]

Penalties

Civil and Criminal

Statutory damages-

Amount calculated by multiplying the number of violations by up to $250. Total amount of damages may not exceed $2,000,000. [54]

Imprisonment- upto 5 years.[55]

Forfeiture from the offender, of-

i) any property, real or personal, constituting or

traceable to gross proceeds obtained from such offense;

ii) any equipment, software, or other technology used or intended to be used to commit or to facilitate the commission of such offense.[56]

Civil only

For a body corporate without prior record,

for upto 2 contraventions, civil penalty should not exceed

i) 100 penalty units if the if the civil penalty provision is subsection 16(1), (6) or

(9); or

ii) 50 penalty units in any other case.

For more than 2 contraventions, civil penalty should not exceed

i) 2000 penalty units if the if the civil penalty provision is subsection 16(1), (6) or

(9); or

ii) 1000 penalty units in any other case.

For a body corporate with prior record,

for upto 2 contravention, civil penalty should not exceed

i) 500 penalty units if the if the civil penalty provision is subsection 16(1), (6) or

(9); or

ii) 250 penalty units in any other case.

For more than 2 contraventions, civil penalty should not exceed

i) 10,000 penalty units if the if the civil penalty provision is subsection 16(1), (6) or

(9); or

ii) 5,000 penalty units in any other case.

For a person without prior record,

for upto 2 contraventions, civil penalty should not exceed

i) 20 penalty units if the if the civil penalty provision is subsection 16(1), (6) or

(9); or

ii) 10 penalty units in any other case.

For more than 2 contraventions, civil penalty should not exceed

i) 400 penalty units if the if the civil penalty provision is subsection 16(1), (6) or

(9); or

ii) 200 penalty units in any other case.

For a person with prior record,

for upto 2 contravention, civil penalty should not exceed

i) 100 penalty units if the if the civil penalty provision is subsection 16(1), (6) or

(9); or

ii) 50 penalty units in any other case.

For more than 2 contraventions, civil penalty should not exceed

i) 2,000 penalty units if the if the civil penalty provision is subsection 16(1), (6) or

(9); or

ii) 1,000 penalty units in any other case.[57]

Civil only

i) Injunction

ii) Damages- calculated in terms of loss suffered as a direct or indirect result of the contravention of the Act.

ii) Statutory Damages

not exceeding $25 for each CEM; and not exceeding in the aggregate $1 million, unless the plaintiff proves that his actual loss from such CEMs exceeds $1 million.[58]

iii)Costs of litigation to the plaintiff.[59]

Civil only

Administrative Monetary Penalty , the purpose of which is to promote compliance with the Act and not to punish.[60]

The maximum penalty for a violation is $1,000,000 in the case of an individual, and $10,000,000 in the case of any other person.[61]

Civil on private action; Criminal for non-compliance with IC's notice

A person who suffers damage by reason of any contravention of any of the requirements of these Regulations by any other person shall be entitled to bring proceedings for compensation from that other person for that damage.[62]

The enforcement authority for these regulations is Britain's Information Commissioner who oversees both the Act and the Regulations, and investigates complaints and makes findings in the form of various types of notices.[63]

Failure to comply with any notice issued by the Information Commissioner is a criminal offence and is punishable with a fine of upto £5000 in England and Wales and £10,000 Scotland.[64]

Opt- out Model

Opt-in Model

Double Opt-in Model

Countries following the model

United States of America and Singapore

Canada, Australia and the United Kingdom

None at present.

When messages may be sent

At all times until recipient voluntarily opts out/unsubscribes.

Only after the recipient voluntarily opts-in/subscribes to receive messages by submitting his/her contact details to be part of a particular mailing list.

Only after the recipient responds in the affirmative to the confirmation mail sent by the sender on receiving an opt-in request from the recipient.

Specific requirements

1. The mail/message must bear a clear identifier of its content. E.g. marked as 'ADVT' for advertisements;

2. An 'unsubscribe' option must be provided in the message which may be utilized by the recipient to express his/her disinterest in the message; and

3. The message must conspicuously bear a valid physical postal address.

N/A

N/A

Advantages

Promotes commercial speech rights-

Since the default position presumes the right to market, average collection rates are considerably higher as more emails can be sent to more people.

1. Reduction in unsolicited messages- Commercial messages are not sent until the recipient voluntarily consents to receiving such messages by submitting his/her contact information.

2. Availability of unsubscribe option- Even after a recipient voluntarily opts in, he/she still has the right to withdraw from such messages by unsubscribing.

1. Ensures people are entering their information correctly, which equals a cleaner list and lowers bounce rates.

2. Reduces the probability of spam complaints because subscribers have had to take the extra step to confirm their consent.

Disadvantages

1. This merely places the burden of reduction of spam on the recipients.

2. The functionality of the 'unsubscribe' link is itself questionable. Very often these links themselves are fraudulent. In such a case, the recipient is further harmed before any opting-out can even take place.

3. In the absence of any strict regulatory oversight, there exists no incentive for the senders to strictly address unsubscribe requests.

1. Consent may be obtained in fact but not in spirit through inconspicuous pre-ticked check boxes.

2. E-mail addresses may be added to a list by spambots. Where, the person 'opted-in' may not actually be the person opting in.

3. Errors may be made when entering emails; a typo may result in someone submitting an address that is not theirs.

4. Legitimate addresses may be added by someone who does not own the address.

1. Genuine subscribers may not understand clearly the confirmation process and fail to click the verification link.

2. Confirmation emails may get stuck in spam filters.