On July 1, 2014, Canada’s New Anti-Spam Legislation (CASL) will come into force. The legislation regulates a variety of activities, including how and when so called “Commercial Electronic Messages” (CEMs) may be sent.
The legislation will prohibit sending Commercial Electronic Messages (CEMs) originating from or received in Canada, unless the recipient has consented to receiving them from the sender, and the message conforms to prescribed form and content requirements.
CASL will be administered on a complaints based system, with fines of up to $1,000,000 per infraction for individuals and $10,000,000 per infraction for corporations. In addition, a private right of action will become available on July 1, 2017, allowing individuals to sue organizations for breaches, and further increasing the monetary risks associated with violating CASL.
CEMs
CASL defines CEMs as any message that has as one of its purposes encouraging participation in a commercial activity. The definition is circular, as commercial activity is defined as any conduct of a commercial character, regardless of whether the sender has an expectation of profit. There are some limited exceptions, discussed later, but generally speaking any person or business who sends out a CEM, either to or from Canada, must comply with the requirements of CASL.
FORM AND CONTENT
Unless a specific exemption applies, a business will need to ensure it has consent to send CEMs to each and every recipient, and that each CEM complies with the form and content requirements of CASL. This means that the CEM must clearly and prominently set out prescribed information identifying the individual sending the CEM and must contain an easy, no cost unsubscribe mechanism.
EXPRESS CONTENT
Under the legislation, consent to receiving CEMs can either be express or implied, however express consent provides businesses with the most protection, as it lasts until a recipient unsubscribes. To obtain express consent, a sender must clearly and simply set out the purpose for which consent is being sought, certain specific identifying information, including the name and mailing address of the sender, and a statement indicating that consent can be withdrawn at anytime.
Of key importance when requesting express consent is that providing consent must be an active process. Consequently, opt out mechanisms, such as pre-checked boxes will not be considered valid forms of consent.
Additionally, an electronic message requesting consent is considered a CEM under the legislation, meaning that if you do not have consent to send CEMs on July 1, 2014, and do not fit into an exemption, CASL prevents you from seeking consent electronically.
IMPLIED CONSENT
Unlike express consent, implied consent under CASL generally provides businesses with a temporary pass to send CEMs to specific classes of recipients. Businesses will have implied consent to send CEMs to recipients with whom they have an existing business or non-business relationship, who have disclosed their email address to the business, or who have otherwise conspicuously published their email address. CASL places strict limits on each of these situations, and the implied consent to send CEMS is usually only temporary.
a) Existing Business Relationship
An existing business relationship under CASL arises only in specific defined circumstances. These include where the recipient of the CEM has purchased or leased a good, product or service from the sender within the past two years; has accepted a business or investment opportunity from the sender within the past two years; and where a written contract is in force between the recipient and sender, or has expired within the past two years.
An existing business relationship will also be deemed to exist for six months after an individual makes an inquiry to the sender of the CEM regarding the purchase or lease of a good, product or service, or a business or investment opportunity.
The time limits act to restrict the time during which a business will have implied consent to send CEMs to the recipient. For example, if a person makes a purchase from a business, the business will have implied consent to send that individual CEMs for two years from the date of purchase, or until the individual unsubscribes.
b) Existing Non-Business Relationship
CASL deems there to be an existing non-business relationship between individuals where, in the previous two years, a person has donated to, volunteered for or attended at a meeting organized by a registered charity, a political party, or a candidate for public office, or has held a membership in a club, organization or not-for-profit organization. If one of these situations exists, the business will have implied consent to send CEMs to the recipient for two years, or until the recipient unsubscribes.
c) Conspicuous Publication of Email Address
A business is deemed to have implied consent to send a CEM to an individual if that individual has conspicuously published their email address, without providing a disclaimer that they do not wish to receive unsolicited CEMs, and the CEM is relevant to the individual’s business role. “Relevant” is not a defined term in CASL, and will likely be determined by the CRTC on a case by case basis.
This form of implied consent is not subject to a time limit, however the recipient retains the right to unsubscribe at any time.
d) Disclosure of Email Address
Finally, consent will be implied if the recipient has disclosed their email address to the sender without an accompanying statement that they do not wish to receive unsolicited CEMs and the CEM is relevant to the recipient’s business capacity. As in the conspicuous publication situation, this form of implied consent is not subject to a time limit.
Despite the timelines set out above, if your business has an existing business or non-business relationship with an individual on July 1, 2014, and already sends that individual CEMs, the implied consent will be deemed to continue until July 1, 2017, or until the recipient withdraws it. This initially provides businesses with additional time to seek express consent from individuals with whom they have an existing relationship.
EXEMPTIONS
CASL sets out two types of exempted messages: those that do not have to conform to the consent or form requirements, and those that do not require consent, but still must comply with the form requirements.
The first category of exemptions, which are exempt from both form and consent requirements, applies to what can be called ordinary business communications. These include messages sent between businesses that have a relationship, if the message relates to the recipient’s business activities, messages sent in response to an inquiry or complaint, inquiries concerning a commercial activity of the recipient, and messages sent by registered charity for the primary purpose of fundraising.
Messages in the second category of exemptions are excluded from the consent requirements but must still contain the prescribed contact information and unsubscribe mechanism. Examples include messages that deliver a product that the recipient is entitled to receive, messages that complete a commercial transaction, such as confirmation messages, and messages that provide factual information about the ongoing use of a service offered under account, such as an update to terms of service. This category also contains an exemption that allows for a limited sharing of contacts between businesses. A business may send one CEM without consent, to a recipient, if the business has been referred to that recipient by a 3rd party who has an existing business, non-business, family, or personal relationship with the recipient.
In Our View
When CASL comes into force on July 1, 2014, it will be one of the most demanding laws in the world dealing with CEMs. The requirements that recipients specifically opt-in to receiving CEMs and CASLs classification of electronic requests for express consent CEMs themselves, combined with the potentially enormous financial penalties for breaching the legislation make CASL particularly daunting for businesses sending messages to or from Canada.
It is impossible to know at this point how strictly CASL will be enforced, and the severity of fines that will be issued for infractions. However, given the potentially enormous monetary impact even a single violation could have on a business, it is important to take steps now to ensure compliance when the legislation takes effect on July 1. To this end, we suggest taking some specific steps.
First, it is essential that organizations review the types of messages they are sending out. Assess whether your organization is sending out messages that could be considered to be “of a commercial character”. In all likelihood, the answer will be yes.
Second, review your organizations contact lists and determine if you are currently sending CEMs to recipients for whom it does not have express or implied consent. If so, seek to obtain express consent from them now, and be prepared to delete them from your contact list on July 1 if you receive no response. Even if your organization has implied consent to send CEMs to an individual, you should begin taking steps to obtain express consent, as this provides the most protection under CASL.
Going forward, organizations will need to implement a system to ensure they know the exact date on which implied consent for a given contact expires. Ensure that all staff of your organization have undergone some level of CASL training so they are aware of how the legislation will impact them in their individual roles. Any CEM sent by any employee of a business without consent could be a violation of CASL and could attract a complaint and subsequent liability.
Organizations should also begin updating their consent procedures to ensure that when they are requesting consent, they are conforming to all of the requirements under CASL. Organizations should also develop a standard form of proof of consent, and retain all relevant records in the event that a complaint is launched against it.
Lastly, organizations should be updating their CEM templates so that each CEM is CASL compliant, and includes an appropriate unsubscribe mechanism, and the required contact information.
For further information, please contact Porter Heffernan at (613) 940-2764.
