Overview of Canada’s Anti-Spam Legislation

Wendy Wagner

Anca Sattler

Gowling Lafleur Henderson LLP

2

Canada’s Anti-Spam Legislation

Legislative Background:• CASL comes into force on July 1, 2014

• CASL will take a prohibitive approach to “Commercial Electronic Messages” (CEMs) prohibiting all but those messages that comply with its requirements.

3

Canada’s Anti-Spam Legislation

Under CASL:• Unless exempt, CEMs require consent from the

recipient, either express or implied;

• Unless exempt, CEMs must contain:• prescribed disclosure; and

• an unsubscribe mechanism in prescribed form.

4

Canada’s Anti-Spam Legislation

To which electronic messages does CASL apply?

Commercial Electronic Messages - a message sent by any means of telecommunication, including a text, sound, voice or image message, to an “electronic address”:

• an electronic mail account;• an instant messaging account;• a telephone account; or • any similar account.

CASL will not apply to several classes of messages:• Interactive two way voice communications;• Messages sent via facsimile to telephone accounts; and• Voice recordings sent to a telephone account.

5

Canada’s Anti-Spam Legislation

Is the Electronic Message “Commercial”?

CASL will only apply to electronic messages that are “commercial”: messages that, based on their content, including links, and contact information, have as one of their purposes encouraging participation in commercial activity, regardless of whether this is done with the expectation of profit.

• Messages that offer to sell a product; • Messages that advertise a product; • Messages that promote a person or corporation; • Messages that seek to gather consumer or market information; • Messages that seek consent to send further messages.

6

Exceptions under CASL and RegulationsThe Act & Regulations exempt the following message classes from consent and message content requirements:

• Messages sent by an individual to a family or friend• messages sent between employees of an organization relating to the affairs of the

organization, and messages sent between two organizations with a relationship, where the message relates to their affairs;

• messages that respond to an inquiry, complaint, or other solicitation from the recipient;

• fundraising messages sent by a registered charity;• messages where the person sending the message reasonably expects it to be

received in a foreign state listed in the Regulations, if the message complies with the law of that state

• messages sent to a secure account to which only the person providing the account may send messages

• messages sent on a platform that includes compliant disclosure and an unsubscribe mechanism in its interface are exempt from the message requirements, but not the consent requirements.

• messages sent to satisfy a legal obligation• Messages that consist solely of a request for information about the recipient’s

commercial activities

7

Exceptions to the Need for ConsentCASL creates exceptions to the need for consent for certain messages but content requirements still apply. These exceptions will apply to messages that solely:

• provide a quote or estimate for the supply of a product or service;• facilitate, complete or confirm a previously agreed upon

commercial transaction; • provide warranty information, product recall information or safety

or security information about a product the recipient uses or had purchased;

• provide notification of factual information about the ongoing use by recipient of a product or a service offered under a subscription, membership, account, loan or similar relationship by the sender

• Deliver agreed goods or services.

There is also a “referral” exemption that allows one initial CEM to be sent by pursuant to a referral from an individual who has a defined relationship with the recipient.

8

Implied Consent under CASL:

An “existing business relationship” arises from the purchase of goods or services or the acceptance of a business opportunity within the previous 2 years or a written contract within 2 years of expiry, or an inquiry or application made by the recipient in the previous 6 months.An “existing non-business relationship” will exist where the recipient had made a donation or a gift within the two years prior to the message being sent, where the recipient has volunteered work or attended at a meeting organized by the person who sends the message, or where the recipient was a member of the sender’s organization or application within the two years prior to the message.

Implied Consent Under CASL

Requirements for Implied Consent

1. There is an existing business or non-business relationship between the sender and the recipient, or

2. The recipient has conspicuously published their address, or has disclosed it to the sender and:

• has not indicated they do not wish to receive commercial messages; and,• the message is relevant to the recipient’s business, role, functions or duties

9

Express Consent Under CASL

Requirements for a Request for Express Consent

1. Provide the purpose for which the consent is sought;

2. Provide the name under which the person seeking consent carries on business, and if different, the name under which the person on whose behalf consent is sought carries on business;

3. If applicable, identify which person is seeking consent, and on whose behalf consent is sought;

4. Provide the mailing address, and one (or more) of a telephone number, website, or email address of either the person seeking consent, or if different, the person on whose behalf consent is sought

5. State that consent may be withdrawn.

10

Message Content under CASL

Commercial Electronic Message must contain:

Message Content

1.Identity of the person who sent the message and, if applicable, the person on whose behalf it was sent;

2.Provide prescribed contact information for one of these persons; and

3.Include an unsubscribe mechanism.

The required contact information must remain current for a minimum of 60 days after the message is sent.

11

Third Party Mailing Lists

CASL expressly provides for consent obtained on behalf of an unknown third party; however, it limits how this consent may be obtained and used:

• The party seeking consent must comply with standard CASL requirements for obtaining consent, including stating the purpose for the collection, and providing their name and contact information.

• A person relying on such a consent must meet additional disclosure requirements for the message content.

12

Penalties

Administrative monetary penalties for violations: • A fine of up to $1,000,000 for a violation by an individual. • A fine of up to $10,000,000 for a violation by a corporation.

CASL also creates a private right of action for persons who allege they have been affected by a violation. If the action is successful in court, the court may order:

• Compensation equal to the actual loss or damage suffered; and

• $200 for each contravention, not exceeding $1,000,000 for each day on which a contravention occurred.

The private right of action has a delayed coming into force date, and will not be in place until July 1, 2017.

13

Application

Compliance with CASL will become a legal requirement on July 1, 2014.

Organizations should be bringing their electronic marketing practices into compliance now, both due to the magnitude of the potential penalties, and to help establish an express consent list that will survive the coming into force of the Act.

Application of Canada’s Anti-Spam Legislation to Not-for-Profit Organizations

Sending CEMS without Express Consent

If sending CEMs to recipients without their express consent, must be able to prove an exception or an implied consent scenario applies:

Exceptions, e.g.: • between employees,

representatives, etc, of different organizations where the organizations have a business relationship

• factual information about membership

• Responses to requests for information

Implied Consent, e.g.: • messages sent to a current or past

member of your organization within last two years, to volunteers or donors

• messages sent to individuals with whom there is an existing business relationship

15

16

Transitional Provisions

When CASL comes into force on July 1, 2014, there will be an extended period of three years during which implied consent will survive in cases of “existing business and non-business relationships”, as defined in CASL that include the sending of commercial messages.

• The transitional period provides an extended timeline for

perfecting existing implied consent (as defined in CASL) by seeking express consent.

• Any attempts to perfect consent within this period would need to be carried out in compliance with CASL.

Canada’s Anti-Spam LegislationPreparing for Compliance

Prepare for Compliance with CASL

Key steps towards compliance with CASL:• What types of CEMs do you send and to whom? • Which categories are exempt from CASL entirely?• Which can be sent pursuant to implied consent, but

must comply with message content requirements?• For those sent pursuant to implied consent based on

a time frame, what can you use to keep track of your CASL compliance?

• Consider an internal facing policy to reflect the above.

18

Checklist• Obtain consent from new members and applicants at

the sign-up stage (but not as a condition of membership…)

• Consider whether to request consent from contacts that are currently in your database

• Managing Communication Preferences on an Ongoing Basis

19