JILT 2005(1) - Colin Davies and Tania Cheng
The Joint IDA-AGC Consultation Paper on the Legislative Framework for the Control of E-Mail Spam - A Commentary
Colin R Davies
Head of the Intellectual Property Law Unit, School of Law, University of Glamorgan
Cdavies1@glam.ac.uk
and
Tania S L Cheng
Lecturer, School of Law, University of Glamorgan
tslcheng@glam.ac.uk
The Consultation Paper has an executive summary and is divided into 5 parts, with 3 annexes attached. The introduction to the Consultation Paper is set out in Part 1 and gives a breakdown of the different areas covered by the paper. In Part 2, the Consultation paper identifies the problems caused by spam and more importantly the reasons for the proliferation of spam and the challenges which the authorities face in controlling spam. Part 3 sets out the IDA’s proposed approach to curbing spam: a multi-pronged approach combining the following elements: technology, public education, self-regulation, spam control legislation and international co-operation, each of which is covered in detail. It also identifies current legislation which may have an effect on spam, such as the Computer Misuse Act (Cap 50A) and the Consumer Protection (Fair Trading) Act 2003, extracts of which are included in Annex B. Part 4 briefly sums up conclusions drawn from a survey conducted by the AGC of legislative and regulatory frameworks relating to Australia, the UK, the USA, Japan and South Korea. The results of the survey are set out in a comparative table in Annex B. The key legislative issues are discussed in Part 5.
Keywords: Infocomm Development Authority of Singapore (IDA), Attorney-General’s Chambers of Singapore (AGC), spam, email, bulk mail, opt-out regime.
This is a commentary published on: 22 August 2005.
Citation: Davies and Cheng, ‘The Joint IDA-AGC Consultation Paper on the Legislative Framework for the Control of E-Mail Spam - A Commentary’, 2005 (1) The Journal of Information, Law and Technology (JILT). < http://www2.warwick.ac.uk/fac/soc/law2/elj/jilt/2005_1/daviesandcheng/>.
Unsolicited communication, commonly known as spam, has been in the limelight very recently. Many jurisdictions, which have highly developed IT infrastructures such as Australia,1 the USA,2 the UK3 and South Korea,4 have recently enacted anti-spam legislation. It is yet too early to determine fully the effectiveness of such legislation, although there is some evidence that anti-spam legislation may be working.5
In line with this recent global flurry of activity in this area, the Infocomm Development Authority of Singapore (IDA) and the Attorney-General’s Chambers of Singapore (AGC) have recently issued a joint consultation paper proposing a legislative framework to control spamming activity in Singapore.6 This is in contrast to the IDA’s position, not too long ago, that the problem of spam was something which was better handled at an ISP level using practical solutions such as filtering tools and codes of practice. Spam was only to be dealt with indirectly by the authorities if actual damage was caused by spam to the receiving computer terminal or server.7 The premise for such a stand was the view that anti-spam legislation is ineffective and it is in essence a practical problem which can be resolved by self-regulation.
So, why this change in attitude by the authorities? The reason is a recognition by the authorities that legislation sends out the signal that spamming is a social mischief and is a deterrent to would-be local spammers. This is spelt out in 3.12 of Part 3 of the Consultation Paper. The authors of the Consultation Paper also recognised wisely that legislation alone is insufficient and have identified other initiatives apart from legislation that need to be taken: public education; industry self-regulation and international co-operation.8
It is in many ways a welcome Consultation Paper. It is comprehensive and forward thinking. On just a few issues however, the paper is superficial and has either ignored them or their implications. It is silent on issues, such as punitive damages, which the writers of this article deem pertinent to the control and regulation of spam. Therefore the Consultation Paper raises many questions, the more important of which will be addressed in this article. Where helpful, comparisons will be made against corresponding provisions of anti-spam legislation in Australia, the UK and the US.
Restriction to Only Emails
Part 2 starts out by attempting to define spam. 2.1 states that “spam is a term generally used to refer to unsolicited email messages, usually transmitted to a large number of recipients”. No reference is made in this Part or any other part of the Consultation Paper to other forms of communication which pose very similar problems to those presented by unsolicited emails e.g. voice mail, multimedia messaging (MMS), short message service (SMS) and telefaxes.
Further, in 5.3 of the paper, the IDA and AGC have proposed that spam be defined in the proposed legislation as “unsolicited commercial email”. In 5.3(c) in particular, the paper states that a key distinctive feature of spam is that it consists only of email. Indeed, in 5.8, the IDA and AGC support this proposal by referring to, inter alia, the UK Regulations,9 indicating that it focuses on just emails. On this basis, 5.8 concludes that SMS and MMS would not constitute spam. The writers respectfully submit that not only is this stance of limiting spam to emails not far reaching enough but this interpretation of the UK legislation is erroneous.
First of all, the UK Regulations, which implement the European Personal Data and Protection of Privacy Directive (the Privacy Directive),10 regulates more than just emails. It covers the use of automated calling systems (Regulations 19 and 24), unsolicited telefaxes for direct marketing purposes (Regulations 20 and 24) and unsolicted telephone calls (Regulations 20 and 24). This is in line with the Privacy Directive, which recognises that
“Safeguards should be provided for subscribers against intrusion of their privacy by unsolicited communications for direct marketing purposes in particular by means of automated calling machines, telefaxes, and e-mails, including SMS messages.”11
Secondly, s.2(1) of the UK Regulations defines “electronic mail” as
“…any text, voice, sound or image message sent over a public electronic communications network which can be stored in the network or in the recipient’s terminal equipment until it is collected by the recipient and includes messages sent using a short message service.”
This definition clearly contemplates forms of communication other than just emails.
5.8 also refers to the US Can-Spam Act of 2003 to support the Consultation Paper’s proposal that anti-spam legislation should only target emails. In this respect, it should be noted that although the US Act currently applies only to “commercial electronic mail messages”, it does require the Federal Communications Commission to make rules within 270 days of the Act to protect consumers from “unwanted mobile service commercial messages”.12 This clearly indicates that the US authorities also recognise that there are other forms of spam which should be given as much attention as that given to the email form of spam. Reference should also be made to this provision in the US Act.
Further, the Australian Spam Act of 2003 covers unsolicited commercial electronic messages, the definition of which generously covers not only emails but also SMS, multimedia messaging service (MMS) and instant messaging.
It can thus be seen that the major anti-spam legislations worldwide do recognise the need for regulating all forms of spam, and not just emails. The IDA and AGC should likewise recognise this pressing need. Indeed, to a certain extent, the IDA appears to recognise this as 5.8 states that it will conduct a separate study on mobile spam in due course. The writers however question why a separate study should be made. Why deal with the problems of spam in such a piecemeal fashion?
5.9 proposes a “technology neutral approach”, which curiously appears to only relate to the many ways in which emails may be received i.e. internet web browser, email software such as Outlook and Eudora, mobile phones or Personal Digital Assistants (PDA). This is a rather narrow meaning of “technology neutral”. It is unfortunately short-sighted, considering firstly the plethora of means by which individuals and businesses may choose to communicate in today’s world (SMS, MMS, telefaxes, instant messaging etc) and secondly, taking into account the incredible swiftness by which technology develops in the field of communications. Why should SMS and MMS messages be treated any differently? The writers believe that the use of these forms of communication by spammers will increase phenomenally in the coming years as the use of these devices grow. As there is no reason for the control of these forms of spam to differ substantially from that of emails, surely it is better to adopt an all encompassing approach to the problem. “Technology neutral” should take a far wider definition than that adopted in the Consultation Paper.
It would be helpful to consider the European Commission’s stand on this issue. The European Privacy Directive repealed and replaced an earlier piece of legislation, the Telecommunication Directive13 as the latter was considered to be of too narrow application. The Preamble to the European Privacy Directive states that the Telecommunication Directive had to be ‘adapted to developments in the markets and technologies for electronic communications services in order to provide an equal level of protection of personal data and privacy for users of publicly available electronic communications services, regardless of the technologies used’.14 The Privacy Directive is therefore intended to be technology neutral so as to take into account future technological changes, which is sensible and desirable. It is technology neutral in the widest sense as it covers different forms of communications, and not just the different means by which emails may be received or sent.
Exclusions
5.7 states that commercial communications would exclude non-commercial content such as Government to citizen communications, appeals for donations by charities and religious organisations. Such messages may not only be sent unsolicited but it seems that there is also no requirement for an unsubscribe facility.
The writers do not see why such exceptions should be made to these types of messages. There is no reason why they should be any less of a nuisance or inconvenience to individuals and businesses. The Consultation Paper does not attempt to show how these messages may cause less problems nor does it attempt to explain the rationale behind such an exception.
Furthermore, unsolicited appeals for donation by religious organisations may be offensive or at least upsetting to certain individuals who subscribe to a different religion.
5.10 proposes that the legislation should only apply to spam transmitted in bulk. The writers question why such a limitation should be applied and submit that this is an unnecessary limitation to the application of the proposed legislation. Spammers would firstly be able to avoid the application of the legislation by simply sending just one email less the specified number. This is an easy way around the limitation.
Secondly, how would the number of emails sent be monitored? Presumably only ISPs would be in a position to do this. Even if email volume can be easily monitored, ISPs would also have to decide if the senders of such emails necessarily fall foul of the legislation. As many businesses legitimately send an enormous number of emails a day, ISPs would have to screen these legitimate emails, in addition to spam emails from the true culprits, to ascertain if they necessarily constitute spam. Therefore, if ISPs are to do the monitoring, would this not be an added burden on them? This is ironical as one of the aims of the proposed anti-spam legislation was to ease the strain caused by spam on their services. Such effort spent in terms of employee numbers, time and finance on monitoring numbers should be made instead in setting up anti-spam filtering programs.
Let us not forget the mischief that anti-spam legislation is intended to address: each spam email is a nuisance and inconvenience in terms of the time and money spent in perusing, deleting and storing it. The content of some spam emails may also prove to be embarrassing, distressing and irritating to individual users. Time spent by employees in perusing any number of spam emails means low productivity for businesses. Further, as each spam email is unsolicited, it is an unwanted intrusion into one’s privacy. Each and every spam email should therefore be outlawed – the law should not only just apply to those sent in bulk. It is clear that while spam emails are usually sent in huge numbers and that this causes problems for ISPs in particular, it is only one aspect of spam emails. The other features of spam emails are such that spam emails per se should be outlawed irrespective of the numbers sent.
5.21 proposes that an opt-out regime as opposed to an opt-in regime be imposed. This means that unsolicited commercial emails are allowable as long as they contain an unsubscribe facility. 5.22 to 5.25 set out the arguments for and against either regime.
The writers submit that a purely opt-out regime defeats the purpose of an anti-spam legislation. The problems which beset individuals, businesses and ISPs are caused by the sending of unsolicited emails. The problems are not resolved by simply allowing individuals and businesses the option of opting-out of emails which have been received unsolicited. Individuals and businesses would have suffered by simply receiving these unsolicited emails in the first instance. The problems ranging from intrusion of privacy, clogging up inbox space to time wasted in perusing and deleting are still all present. Opting-out is merely shutting the stable doors after the horses have bolted.
After all, it is unusual for a user to receive a multitude of emails from a single organisation. It is more usual for a user to receive a multitude of different emails from several different organisations. It is therefore the single email which creates problems for users. Opting-out would therefore have no effect on the problems caused by spam on users.
Further, the arguments presented by the Consultation Paper against an opt-in regime are not sufficiently compelling to support the proposal. For instance in 5.23, it is said that opt-in will not solve the problem of “unwanted” email as opt-in email can be just as annoying as opt-out email. This probably refers to the fact that sometimes it is difficult for a user to get rid of emails to which he or she had previously consented to receiving. It refers too perhaps to the situation where a user, who has had previous commercial dealings with a supermarket, for instance, and therefore has impliedly consented to future marketing emails from that supermarket. Also, it refers supposedly to the cost and time spent in later unsubscribing to such emails. However, the fact remains that these emails are at least “wanted” in the first place. The user has a choice as to whether or not he or she wants to receive marketing emails from an entity with which he/she is familiar with and not be bombarded out of the blue by emails from strangers or strange businesses.
Firms and organisations have simply to ensure that their marketing strategies are effective without having to resort to mass-mailing unsolicited emails to individuals and other businesses. Unsolicited communications are cheap and easy to send but they impose a disproportionate burden on recipients. Hence, to balance the interests of firms and organisations with those of recipients, firms and organisations should obtain explicit consent from recipients before they send off marketing emails. This obligation does not impose an insurmountable burden on them.
Indeed, the European Commission justified the imposition of an opt-in regime by stating in Recital 40 of the Privacy Directive that:
“These forms of unsolicited commercial communications may on the one hand be relatively easy and cheap to send and on the other may impose a burden and/or cost on the recipient. Moreover, in some cases their volume may also cause difficulties for electronic communications networks and terminal equipment. For such forms of unsolicited communications for direct marketing, it is justified to require that prior explicit consent of the recipients is obtained before such communications are addressed to them.”
The Consultation Paper proposes that ISPs have the right to commence action in court to sue spammers or the person commissioning or procuring the spam. This will be a new cause of action and is similar to the position in the US under the US Can-Spam Act.15 This is commendable in that ISPs do suffer much at the hands of spammers and rightly should have a cause of action against spammers.
The Paper also however explains that other entities do not have any right of action.16 This is because the loss suffered by a single individual is unlikely to be significantly substantial and by limiting actions to just one type of entity (in this case just ISPs) frivolous litigation will be avoided. While this sentiment is understandable, the writers submit that individuals and also business entities ought to have some kind of right under the anti-spam legislation nevertheless. Legal action should not be left solely in the hands of ISPs.
If actions against spammers may only be taken by ISPs, then it must be absolutely certain that ISPs will take action where necessary. But will there be sufficient incentive for them to do so? Taking legal action in any matter is a considerable undertaking for any entity, in terms of time, effort and money. These must be expended at the risk of having an adverse result in court. Further, it is noted that the Paper suggests that the court be empowered to award damages and costs. How about punitive damages? It is firstly unlikely that damages awarded will be substantial and secondly, they would be difficult to quantify, unless a particular spam email does actual damage to an ISP’s server. How does receiving volumes of spam translate in monetary terms? Punitive damages would address this.
Further, punitive damages seem particularly apt where spam is concerned. Spamming is a social ill, which is performed with deliberate disregard for the rights of others and which costs the perpetrators next to nothing. Punitive damages would drive home the message that spamming is a social ill which is taken seriously in Singapore.
Therefore, without the likelihood of substantial or punitive damages, ISPs would be naturally cautious about bringing any action against spammers. Bearing this in mind, ISPs may not have much incentive in bringing legal actions at all, in which case, the problem of spam is left unchecked if left to just ISPs to police.
While it is accepted that perhaps individuals or businesses should not be given the right to sue, in order to prevent frivolous or vexatious litigation, they should have the locus standi to make complaints to the relevant authorities. This would ensure that they are not left hanging and dependent on the will of ISPs to pursue the perpetrators.
Following on from this, the writers fail to see why the Consultation Paper is silent on criminal sanctions, which would be eminently suitable in this situation. As stated above, spamming is a socially undesirable activity. Like other similar social ills such as vandalism, which may cost little but is exceedingly damaging to society, spamming should be treated in the same way i.e. by criminal sanction. Only then would spammers be deterred, bearing in mind that damages may not be substantial in the absence of punitive damages.
The writers would submit that criminal sanctions are essential to ensure effective enforcement of the proposed legislation. We have already considered the possible lack of action by the ISPs in civil proceedings. Even if they do take action, due to the absence of punitive damages, the damages likely to be awarded would be unlikely to have any deterrent effect whatsoever. Further, even with the implementation of punitive damages, many spammers would not be deterred when one considers the profits to be made and the general approach of the civil courts to moderate punitive damages.
The only effective deterrent is the criminal imposition of substantial fines and imprisonment. For instance, in the US, offences under the Can-Spam Act carry a fine and a maximum of 5 years imprisonment. Italy’s anti-spam legislation which implements the European Privacy Directive imposes a fine of up to €90,000 and imprisonment of up to 3 years. A term of imprisonment in particular would serve to deter spammers effectively.
Although the writers feel that criminal sanctions, particularly imprisonment as provided for in the US and Italy, are the most effective way of enforcing anti-spam legislation, at the very least, there should be some form of government imposed sanctions. If one looks at the Australian system, the Commonwealth has the power to seek civil penalties (in essence equivalent to criminal sanctions) of up to AUS$44,000 for first-time individual offenders and AUS$220,000 per day for first-time corporate offenders, in addition to an account of profits and compensation for victims. In a sense, much the same as our suggestion for punitive damages, although of course the government would benefit from this rather than ISPs.
The writers would suggest the setting up of a body to oversee and handle complaints, in much the same way that is performed in Australia, the US and the UK. Perhaps the IDA may assume a similar mantle or perhaps another body should be set up for this purpose. The setting up of such an office would also send out the message that the Singapore government takes the problem of spam seriously.
We have chosen to only deal with the issues of definition, limitation to bulk emails, legal remedies and opt-out regime, as these were the issues we felt were not adequately dealt with in the Paper and were of major importance.
However, as stated above, the Paper is a positive and welcome step in the right direction. It has dealt with other no less important issues in a commendable way. For instance, the Paper covers address harvesting, dictionary attacks, identifiers and codes of practice. Of particular benefit was the suggestion that the merchant or business commissioning or procuring spam should also be made liable. This is similar to the current position under the Australian Act, which recognises that the true culprits are those who encourage or in more legalistic terms, aid and abet spamming activity.
The Consultation Paper goes a long way to addressing the evils caused by spam but in the writers’ opinion does not go far enough.
1 Spam Act 2003.
2 Controlling The Assault of Non-Solicited Pornography And Marketing Act 2003, entered into force on 1 January 2004.
3 Privacy and Electronic Communications (EC Directive) Regulations 2003.
4 Act on Promotion of Information & Communications & Communication Network Utilisation & Protection of 2001. Revised on 18 December 2002 and entered into force on 19 January 2003.
5 AOL reported on 19 March that it saw a 27% decline in spam since 20 February. AOL: A Sharp Decline In Spam www.bullguard.com.
6 Proposed Legislative Framework For The Control Of E-mail Spam (Joint IDA-AGC Consultation Paper).
7 Where spam degrades the performance of an ISP’s mail server, this may constitute an offence under s.7 Computer Misuse Act (Cap. 50A).
8 3.5 Consultation Paper.
9 See footnote 3.
10 Directive 2002/58/EC of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector.
11 Ibid, Recital 40.
12 §14 US Can-Spam Act.
13 Directive 97/66/EC of 15 December 1997 on the protection of individuals with regard to the processing of personal data and the protection of privacy in the telecommunications sector.
14 Recital 4, Privacy Directive.
15 §7(g) Can-Spam Act.
16 5.30.