Canada’s
Anti-Spam Legislation (CASL) took effect July 1, 2014. CASL prohibits sending
commercial electronic messages (CEMs) such as email, to parties in Canada
without consent. If you don’t have consent or fall under one of the exceptions
to the consent requirement, you may want to consider resorting to the postal
service to obtain consent to send CEMs to Canadians. Even if you have consent,
if challenged, you need to be able to prove it. Practically speaking, this puts
an end to “cold” emailing to Canadians.
What is the
risk?
If you or your organization is found to
have sent non-compliant electronic messages, it can mean up to a $1 million dollar
fine for individuals and $10 million dollars for corporations. Officers, directors
and agents of a corporation can be liable if they directed, authorized,
assented to, acquiesced in, or participated in the commission of the violation.
Starting in 2017, recipients of the messages can also sue for $200 for each
message, once the private right of action provisions comes into force.
What
type of electronic messages does it apply to?
CASL applies, if any element of the
electronic message encourages participation in a commercial activity. The good
news is that once express consent has been granted, it is valid until it is
revoked – the situation becomes trickier if you’re relying on implied consent
in a pre-existing business relationship as time limits apply to the implied
consent.
Does
it apply to a message sent from the U.S.?
CASL’s provisions
apply to any CEM where a computer system located “in Canada is used to send or
access the electronic message”. It applies to emails, instant messages,
SMS messages and messages sent to “similar accounts”. This means that the form,
content and unsubscribe requirements established by CASL apply to foreign messages including those sent by
foreign organizations to Canadian recipients.
What
is Express Consent?
Express consent can be obtained
electronically, verbally or in written format, but to be valid, the recipient
needs to understand what the consent is for, be provided with the sender’s
contact information and be informed that they can withdraw their consent at any
time. Implied consent comes into play when two parties already have an existing
business relationship.
Does
CASL apply to all Electronic Messages?
CASL’s provisions permit certain
messages to be sent without full CASL compliance. These include for example:
· Business to Business - messages sent within
an organization by an employee, representative, consultant or franchisee to
another employee, representative, consultant or franchisee of that organization
in connection with the activities of that organization or to another
organization, if the organizations “have a relationship” and the message
concerns the activities of the recipient organization.
· Messages sent in the context of a Family
Relationship and/or Personal Relationship – Family means individuals related by
marriage, common-law partnership or a legal parent-child relationship and
personal relationship means individuals who had direct, voluntary, two-way
communications where it would be reasonable to conclude that they have a
personal relationship taking defined factors into consideration.
· One referral message -
CASL contains provisions that permit one message to be sent following a
referral by any individual who has an “existing business” or “non-business
relationship”, family or personal relationship with the person who sent the
message and that discloses the name of individual that made the referral and
the fact that the message is sent as a result of the referral.
Does CASL apply to Social Media?
Yes, CASL applies
to Social Media. Any marketing endeavor, even on social media, may be considered
a CEM, if the message says “encourage[s] participation in a commercial
activity” and it is sent to an
electronic address. According to the
frequently asked questions (FAQs) provided by the Canadian Radio-Television and
Telecommunications Commission (CRTC), a social network account may fall within
the category of an electronic address (i.e. a similar account to email
accounts, phone accounts and instant messaging accounts). According to the
CRTC: “a typical advertisement placed on a website or blog post would not be
captured...”, whether communication using social media fits the definition of
“electronic address”, must be determined on a case-by-case basis, depending
upon, for example, how the specific social media platform in question functions
and is used. For example, a Facebook wall post would not be captured. However,
messages sent to other users using a social media messaging system (e.g.,
Facebook messaging and LinkedIn messaging), would qualify as sending messages
to “electronic addresses”.
What should you do to ensure CASL Compliance?
·
Conduct a CASL
compliance audit.
·
Put a CASL compliance
program in place. Such a program is critical to establishing a due diligence defense
to any alleged violation of CASL.
·
If in doubt – resort to
seeking consent using postal services.
