Computer Program Guidance
CASL Computer Program Guidance
Overview
Consent Requirements
Form of Consent
Enhanced Disclosure
Exceptions
Implications for UWinnipeg
Section 8 of CASL deals with the installation of computer programs in the course of a commercial activity and came into force on January 15, 2015. In essence, CASL prohibits individuals and organizations from installing or causing to be installed software on another person's computer system in the course of a commercial activity without the express consent of the owner or authorized user.
Where express consent is required, UWinnipeg must
- Explain why it is seeking consent
- Explain who is seeking consent
- Provide a mailing address and one other piece of contact information (telephone, email, website address)
- Provide a statement indicating that the owner or authorized user may withdraw consent
- Describe generally the function and purpose of the program
- Obtain and record a positive consent from the owner or authorized user
Consent may be provided by the owner or the authorized user of the computer system. To use employee computers as an example, the University is the owner and the employee is the authorized user.
When is enhanced disclosure required?
If the computer program performs any of the below functions without the knowledge of the owner or authorized user, a separate enhanced disclosure is required.
- Collects personal information stored on the computer system
- Interferes with the owner or authorized user's control of the computer system
- Changes or interferes with settings or data on the computer system
- Causes the computer system to communicate with another system or device without the authorization of the user
- Provides third party access to the computer system
To provide enhanced disclosure, UWinnipeg must explain
- The nature and purpose of the specific function
- The potential impact on the user's computing device
- An electronic address where the owner or authorized user, for a one-year period, may request that the program be uninstalled from their system
1. If the computer program was installed before January 15, 2015, consent is implied until January 15, 2018 unless the owner or authorized user provides notice that they would like the program to be uninstalled from their computer system.
2. Consent is implied if the program is
- A cookie
- HTML code
- Java scripts
- An operating system
- A program that is executable only through the use of another computer program whose installation or use the owner or authorized user has previously expressly consented to
- A program that is necessary to correct a failure in the operation of a computer system or a program installed on it and is installed solely for that purpose where the owner or authorized user's conduct is such that it is reasonable to believe that they consent to the program's installation
Unless the owner or authorized user chooses to disable any of the above. If so, consent is not implied.
3. CASL does not apply to software, apps, widgets or updates that the owner or authorized user self-installs. This does not include automatic updates unless express consent for automatic updates was secured at time of installation.
1. Installation of computer programs on employee computers is of low concern as CASL generally does not apply to self-installation of software by owners or authorized users.
2. Programs installed before January 15, 2015 are of relatively low concern. Assistance should be offered to owners or authorized users who wish to uninstall the program from their computer system.
3. Offering apps to students, employees and visitors on campus is of relatively low concern provided that the individual is installing the program on their own computer system and the app does not perform a function where enhanced disclosure is required or contain any hidden programs or undisclosed functionality.
4. Express consent should be sought for updates to computer programs, either at time of installation or time of updating.
5. All evidence of express consent must be documented and retained.