June 19, 2014

Canadian Anti-Spam Legislation – Impact on Student Recruitment

Canadian Anti-Spam Legislation Overview

• Canada’s Anti-Spam Legislation

• Commercial Electronic Messages (CEMs)

• Requirements

– Consent

– Identification

– Unsubscribe Mechanisms

• Tips for Compliance

• Sources

Canada’s Anti-Spam Legislation (CASL) Overview

• The CASL was introduced in 2010 to help protect Canadians while enabling businesses to compete in the global market.

• Starting July 1st, 2014, new laws about commercial electronic messages (CEM) will be enforced to ensure consent, identification, and the presence of unsubscribe mechanisms.

• Features of CASL include:

– Regulating CEMs.

– Prohibiting the unauthorized altering of transmission data.

– Prohibiting the installation of computer programs without consent (viruses, spyware).

– Provision of false or misleading information either in the content of your message or the sender information.

Canada’s Anti-Spam Legislation (CASL) Timelines

• New laws about CEMs – starting July 1, 2014.

• Implied consent for CEMs is valid for 2 years.

– The government has agreed to temporarily extend the ‘transitional period’ to 3 years to give businesses an extra year to prepare.

• Provisions relating to computer programs - January 15, 2015.

• Provisions for a private right of action - July 1, 2017.

Canada’s Anti-Spam Legislation (CASL) Jurisdiction, Third Party, & Penalties

• Geographic Jurisdiction

– CASL applies to all CEMs that are sent by Canadian institutions to individuals in Canada and outside Canada.

– When sending CEMs to other countries, you may have to comply with their anti-spam laws.

• Third Party CEMs

– CASL applies to both CEMs sent by your institution and those that your institution “causes or permits to be sent” by third parties, such as web sites and list brokers.

• Penalties

– CASL imposes administrative monetary penalties for noncompliance of up to $10 million for an organization and $1 million for an individual.

– Anybody who received a CEM without providing their consent has a private right of action against the organization sending the CEM, and may be able to receive up to $200 per violation.

• The private right of action does not come into force until July 1, 2017.

Commercial Electronic Messages (CEM) Definition

• A Commercial Electronic Message (CEM) is defined as any electronic message that encourages participation in a commercial activity.

• An electronic message is any message sent to an electronic account (emails, text messages, and messages using social media websites).

• The following is not categorized as a CEM:

– Interactive two-way voice communications

– Fax messages

– Voice recordings sent to a telephone account

– Promotional phone calls (note – these may be regulated by the Do-Not-Call-List)

– Snail mail

Commercial Activities Application to Student Recruitment Activities

• Generally, commercial activities are performed in return for fees or other gain, but keep in mind that the CASL’s definition of “commercial activity” is very broad; it covers activities of a “commercial character” regardless of whether or not there’s an expectation of profit.

• Here are some examples of commercial activities at a college or university:

– Concerts, plays, and sporting events (if charging entry fees)

– Promotion and sale of products and services by the bookstore

– Promotion and sale of publications by the college / university press

– Promotions of third-party commercial services (e.g. preferential credit card rates)

– Student housing services

– Campus food services

– Promoting contests or other draws

– Solicitation for sponsorship

Commercial Activities Student Recruitment Activities – Grey Area

• Student recruitment initiatives, or promotions of new courses or academic programs to prospective students, are probably not commercial activities because they do not have a “commercial character.”

– But this has yet to be tested.

• Providing information to alumni or the general public about the activities or facilities of your institution would probably not be considered as advertising or promoting a “commercial activity”.

– For example, a press release about the results of a research project would not be considered as promoting a commercial activity.

– However, advertising or promoting products for purchase, including advantages available to alumni, will likely be considered a commercial activity.

Commercial Activities Exemptions

• Messages that are sent by or on behalf of a registered charity for the primary purpose of raising funds for that charity are not commercial activities and are exempt from the consent and form requirements set out in the CASL.

CEM Requirements Overview

• Essentially, the CASL contains the following three requirements for CEMs:

– You must have the consent of the individual before the message is sent.

– You must identify yourself and provide your contact information.

– You must give the individual a way to “unsubscribe” from further messages.

Consent

Unsubscribe Identification

Consent Definition

• The CASL is based on an opt-in system, which means that you need to have the person’s consent before you send them a CEM.

• An electronic message that is designed to request a person’s consent is itself a CEM under the CASL.

• Under the legislation, there are two kinds of consent:

– Implied consent

– Express consent

Implied Consent Situations Where Implied Consent Arise

• From an existing business relationship. For example with:

– Current students,

– Individuals leasing institution-owned facilities,

– Suppliers of goods and services to your institution,

– Prospective students,

– Alumni.

• From an existing non-business relationship. For example with these 2 groups:

– Volunteers at your institution,

– Donors to your institution.

• From individuals who have given or have conspicuously published their business contact information (e.g. a business prominently displaying its email on its website)

– Note - this type of implied consent only applies to businesses, not to private individuals.

Implied Consent Timeline for Compliance

• Implied consent normally lasts for two years.

– For example, if somebody volunteered at the university, then you have a non-business relationship with them, which gives you their implied consent to send them CEMs for the next two years.

• After two years, the implied consent expires.

– When the CASL comes into force, the government has agreed to temporarily extend that “transitional” period to three years to give businesses an extra year to prepare.

• If you have somebody’s implied consent, you should send them a message asking for express consent before the implied consent period expires.

Express Consent Situations When Express Consent Arise

• Express consent should be in writing, but can also be oral.

• Individuals may provide their consent in various ways:

– Signing a document,

– Sending you an email,

– Entering information into a web form,

– Clicking on an “I Accept” button.

• Once you have secured someone’s express consent, then you may continue to send them CEMs indefinitely unless the individual “unsubscribes” from further messages.

Express Consent Requirements When Getting Consent

• The following is required when securing someone’s express consent:

– Identification components (purpose, name, contact),

– Unsubscribe mechanism,

– Privacy statement explaining purpose for collecting personal information.

• If oral consent is obtained, the above is required, as well as the following to establish onus for properly obtaining consent:

– Be capable of being verified by an independent third party, OR

– Be contained within a complete and unedited audio recording of the consent.

• Consent must be “opt-in”, not “opt-out”.

– For example, individuals must check the box to explicitly indicate his or her consent. The box cannot be “pre-checked.”

Identification Components

• All CEMs must contain the following information:

– Specific purpose for which you are seeking their consent.

– Name of the institutional unit seeking consent.

– Contact information for the unit (or a link to a website containing this information):

• Mailing address,

• Telephone number and/or email address and/or web address.

Unsubscribe Mechanisms Requirements

• All CEMs have to give subscribers the opportunity to unsubscribe from future CEMs.

• Your unsubscribe mechanism must be easy to access and use.

• Your unsubscribe mechanism must be valid for at least 60 days after you send the CEM.

• If you receive a request to unsubscribe, you have to comply within 10 business days.

Unsubscribe Mechanisms Methods

• When you send CEMs by email, you may offer one or both of the following unsubscribe methods:

– by email,

– by clicking on a link that will take the user to a web page where he or she can unsubscribe.

• If you have multiple mailing lists, ensure recipients have the option to manage their subscriptions.

• When you send CEMs by text message, then you must offer both of the following unsubscribe methods:

– replying to the text message with the word “STOP”,

– clicking on a link that will take the individual to a web page where he or she can unsubscribe.

Unsubscribe Methods Examples

Tips For Compliance Best Practices

• The responsibility is on the sender to prove they have consent for all CEMs.

• Here are a few tips for adapting to this new legislation:

– Obtain express consent from all contacts within the next 36 months (e.g. email campaigns, unsubscribe pages, etc.).

– Develop a system or use CRM software to track the date and method that you received express consent or unsubscribes from members.

– Incorporate unsubscribe mechanisms in all communication moving forward.

– Implement opt-in options on sign-ups and future communication to gain consent from new contacts.

Sources & More Information Useful Resources

• Government of Canada - http://fightspam.gc.ca/eic/site/030.nsf/eng/home

• Mount Royal University - http://www.mtroyal.ca/CASL/CASLFAQs/index.htm

• Simon Fraser University - http://www.sfu.ca/itservices/info_security/anti-spam-compliance.html

• University of Alberta - http://www.advancement.ualberta.ca/en/casl.aspx

• University of Manitoba - http://umanitoba.ca/legal_counsel/CASL.html

• Niagara College - http://www.niagaracollege.ca/content/Portals/3/NiagaraCollege/pdfs/casl/CASL_Qs_and_As%20-

%20Released%20May%2021%202014.pdf

• Elite Email – How To Prepare For CASL - http://www.eliteemail.com/learning-center/casl/page6.html#anchor21

Thank You & Questions Contact Information

Head Office – Canada

67 Mowat Avenue, Suite 533 Toronto, ON M6K 3E3, Canada

info@edgeip.com

1-800-211-5577