COMBATING SPAM WITH LEGISLATION DOES IT WORK?

It is now almost five months since the Spam Act 2003 (Cth) ( “Spam Act” ) came into force, but there does not seem to have been a great change in the level of spam being received by Australians The Spam Act prohibits the sending of “unsolicited commercial electronic messages”, without the consent of the recipient unless an exception applies. This article summarises the main provisions of the Spam Act, looks at some of the international legislative approaches at combating spam.

The Spam Act regulates the sending of “commercial e-mail” and other types of “commercial electronic messages”.

In summary, the Act:

• Regulates commercial electronic messages
• Prohibits unsolicited commercial electronic messages from being sent, subject to a number of exceptions
• Requires that commercial electronic messages include information about the sender and a functional unsubscribe facility.
• Prohibits address-harvesting software and electronic address lists produced using address-harvesting software from being supplied, acquired or used.

An electronic message includes more than email “spam”. It includes messages sent using an internet or any other carriage service not wholly located outside Australia, which is sent to:

• an e-mail address; or
• an instant messaging address; or
• a telephone number; or
• a similar account.

If a message is sent by way of a voice call made using a standard telephone service, the message is not an electronic message for the purposes of the Spam Act.

Unsolicited commercial electronic messages must not be sent if they:

• have an Australian link; and
• are not designated commercial electronic messages

unless the recipient consented to the sending of the message or the sender did not know and could not, with reasonable diligence, have ascertained that the message had an Australian link or if the message was sent by mistake

Consent means:

• express consent; or
• consent that can reasonably be inferred from the recipient's:
  • conduct; and
  • business and other relationships with the sender.

Consent may in some case be inferred from conspicuous publication of an electronic address, which enables the public to send electronic messages to a particular employee or officeholder unless the publication is not accompanied by a statement to the effect that the relevant electronic account-holder does not want to receive unsolicited commercial electronic messages at that electronic address.

In such cases, consent will be inferred, so long as the messages are relevant to the business, function or duties of the recipient or are relevant to the office, position, function or role of the recipient concerned.

To determine whether a message is a commercial electronic message, having looked at:

• The content of the message
• How the message is presented
• What content can be located using the links, telephone numbers or contact information set out in the message

you must be able to conclude that the purpose, or one of the purposes, of the message is to:

• Offer to supply or provide; or to advertise or promote:
  • Goods or services; or
  • Land or an interest in land; or
  • A business opportunity or investment opportunity; or
  • A supplier, or prospective supplier, of goods or services or land or an interest in land; or
  • A provider, or prospective provider, of a business opportunity or investment opportunity; or
• Assist or enable a person, by a deception, to dishonestly obtain property belonging to another person or a financial advantage from another person; or
• Assist or enable a person to dishonestly obtain a gain from another person

A commercial electronic message has an Australian link if:

• the message is sent in Australia; or
• the sender of the message was in Australia; or had its central management and control in Australia when the message was sent
• the computer, server or device that is used to access the message is in Australia; or
• the message recipient was in Australia; or carried on business in Australia when the message was accessed
• in cases when the message cannot be delivered because the delivery address does not exist, had the electronic address existed, it is reasonably likely that the message would have been accessed using a computer, server or device located in Australia.

An electronic message is a designated commercial electronic message if the message consists of no more than factual information (with or without directly-related comment) and any or all of the following additional information:

• the name, logo and contact details of the sender or the author's employer, partnership or organisation;
• the name and contact details of the author;
• if the message is sponsored - the name, logo and contact details of the sponsor;
• The information discussed below regarding the sender's details and an unsubscribe facility

Designated commercial electronic messages also include any electronic message authorised by any of the following bodies:

• a government body;
• a registered political party;
• a religious organisation;
• a charity or charitable institution; and

if the message relates to goods or services; and the party authorising the message is the supplier, or prospective supplier, of the goods or services concerned.

Further, designated commercial electronic messages include any electronic message authorised by an educational institution where the recipient and / or a member or former member of the recipient's household is or has been, enrolled as a student in that institution; and the message relates to goods or services; for which the institution is the supplier, or prospective supplier.

A person must not send a commercial electronic message to a non-existent electronic address if:

• the person did not have reason to believe that the electronic address existed; and
• the electronic message:
  • has an Australian link; and
  • is not a designated commercial electronic message.

unless the person did not know; and could not, with reasonable diligence, have ascertained that the message had an Australian link.

A commercial electronic message that has an Australian link must not be sent unless the message clearly and accurately identifies who authorised the sending of the message and includes accurate information about how the recipient can readily contact that party, unless the sender did not know; and could not, with reasonable diligence, have ascertained; that the message had an Australian link, or if the sender sent the message by mistake.

A commercial electronic message that has an Australian link and is not a designated commercial electronic message must not be sent unless:

• the message includes:
  • a statement to the effect that the recipient may use an electronic address set out in the message to send an unsubscribe message to the individual or organisation who authorised the sending of the first-mentioned message; or
  • a statement to similar effect; and
• the statement is presented in a clear and conspicuous manner; and
• the electronic address is reasonably likely to be capable of receiving:
  • the recipient's unsubscribe message; and
  • a reasonable number of similar unsubscribe messages sent by other recipients of the same message; at all times during a period of at least 30 days after the message is sent; and
• the electronic address is legitimately obtained; and
• the electronic address complies with the condition or conditions specified in the regulations.
• the sender did not know; and could not, with reasonable diligence, have ascertained; that the message had an Australian link.

Address-harvesting software is software that is specifically designed or marketed for use for:

• searching the Internet for electronic addresses; and
• collecting, compiling, capturing or otherwise harvesting those electronic addresses.

A harvested-address list means:

• a list of electronic addresses; or
• a collection of electronic addresses; or
• a compilation of electronic addresses;

where address-harvesting software has been used in the production of the list, collection or compilation.

It is forbidden to supply or offer to supply:

• address-harvesting software; or
• a right to use address-harvesting software; or
• a harvested-address list; or
• a right to use a harvested-address list;

If the supplier is:

• physically present in Australia at the time of the supply or offer; or carrying on a business or activities in Australia at the time of the supply or offer; or if the customer is:
• physically present in Australia at the time of the supply or offer; or carrying on business or activities in Australia at the time of the supply or offer.

An exception is provided where the supplier had no reason to suspect that the customer, or another person, intended to use the address-harvesting software or the harvested-address list, to send commercial electronic messages which contravene the Spam Act, or if the supplier did not know; and could not, with reasonable diligence, have ascertained that the customer was physically present in Australia at the time of the supply or offer; or carrying on business or activities in Australia at the time of the supply or offer.

Similarly, a person must not acquire:

• address-harvesting software; or
• a right to use address-harvesting software; or
• a harvested-address list; or
• a right to use a harvested-address list;

or use

• address-harvesting software; or
• a harvested-address list

if the person is physically present in Australia; or carrying on business or activities in Australia at the time of the acquisition, unless the person did not intend to use the address-harvesting software or the harvested-address list in connection with sending commercial electronic messages in contravention of the Spam Act.

The Australian Communications Authority (ACA) may issue a formal warning or an infringement notice to parties that breach the Spam Act. If the penalty specified in the notice is paid within the period allowed by the ACA, the matter will not be dealt with by the Federal Court.

If the penalty is not paid, the ACA may take legal action in the Federal Court to recover penalties of up to $1.1 million, up to six years after the breach.

The Federal Court may grant an injunction restraining the conduct that breaches the Spam Act and / or order the party breaching the Spam Act to:

• pay to the Commonwealth any financial benefit that arose as a result of the breach; and
• pay compensation to a victim who has suffered loss or damage as a result of the breach.

To determine whether a person has suffered loss or damage, the Court may consider:

• the extent to which any expenses incurred by the person are attributable to dealing with the messages;
• the effect of dealing with the messages on the person's ability to carry on business or other activities;
• any damage to the reputation of the person's business that is attributable to dealing with the messages;
• any loss of business opportunities suffered by the person as a result of dealing with the messages; and
• any other matters that the Court considers relevant.

It is obvious that the Spam Act has so far done little to combat the huge volume of unsolicited messages received by Australians, which are sent from overseas. To combat the worldwide problem of spam, a concerted and co-ordinated international approach will need to be taken.

The European Union was one of the early movers, introducing legislation as early as 2002 to achieve a pan-European ban on spam being sent to individuals. Under Article 13 of Directive 2002/58/EC on Privacy and Electronic Communications; marketing by e-mail, SMS and other electronic messages received on any mobile or fixed terminal marketing is only allowed with prior consent, subject to a limited exception covering existing customer relationships.

Member States were required to apply and effectively enforce this regime by the October 2003, but only a small number of Member States complied with this deadline. Some commentators have called the Directive a legislative disaster, but others think it has been worthwhile, as it put spam on the political agenda.

From 1 January 2004, the US Federal Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act came into force. There is also extensive State based US anti-spam legislation. There are some commentators who say the US Federal legislation is not as strong as the EU Directive as it still allows marketers to send unsolicited commercial email if it contains an opt-out provision, a legitimate return address, a valid subject line indicating the email is an advertisement and the sender's physical address. However, there have already been considerable criminal and civil penalties imposed on US spammers based on the State laws. In May 2003, Earthlink were awarded damages of US$16.4 million against the “Buffalo Spammer”, Howard Carmack. Carmack also received a prison sentence. In October 2003, the State of California successfully sued the firm PW Marketing and its owners Paul and Claudia Griffin, who were ordered to pay US$2 million in civil penalties for, amongst other things, sending unsolicited commercial email. Amendments to Californian law in January 2004 now also allows individuals to sue spammers and recover damages.

Australians have been active on the international stage too. The Australian Competition and Consumer Commission is co-operating with international law enforcement agencies, including the UK Office of Fair Trading and the US Federal Trade Commission as part of investigations into international spam activities and in support, Australia, the US and UK have signed a memorandum of understanding.

The United Nations is also involved by proposing anti-spam legislation examples that countries could adopt, in an attempt to co-ordinate global efforts to combat spam and make it easier to prosecute spammers around the world.

Before sending an electronic message, you should ask the following questions:

• Is the message a commercial electronic message?
• Does the message have an Australian link?
• Is the message a designated commercial electronic message?
• If the message is not a designated commercial electronic message:
  • Has the recipient consented to you sending them the message?
  • Does the message contain a functional unsubscribe facility?
• Does the message contain the required information about the sender's identity and contact details?
• Is being sent to an address obtained using address-harvesting software or from a harvested-address list?

Legislation on its own is unlikely to combat the worldwide spam problem. In essence it is a technology problem and legislation can only hope to act as a deterrent. However, Government in partnership with industry should work towards a combined effort of both technology and legislation both in Australia and on an international basis to continue to develop our electronic communication channels so we can effectively control access to electronic message transmission.

STEVE WHITE & SARAH PIKE
WHITE SW COMPUTER LAW
SEPTEMBER 2004

© White SW Computer Law 2004 www.computerlaw.com.au This article is a guide only and should not be used as a substitute for proper legal advice, readers should make their own enquiries and seek appropriate legal advice.