Canada’s Anti-Spam Legislation (CASL) came into effect July 1, 2014, becoming one of the toughest laws of its kind in the world. CASL applies to everyone - individuals, incorporated and unincorporated businesses, not for profit organizations etc. - who sends Commercial Electronic Messages (CEM).
To qualify as a CEM the message must have as a purpose to encourage participating in a commercial activity. CEM’s cover a wide range of messages including messages that are sent to emails, instant messaging accounts, telephone accounts, and social media accounts such as Facebook and Twitter, as well as the broadly defined “any similar account. There are 3 main requirements:
- You need consent from the recipient of the message. This can be either express or implied. Implied consent includes situations when a receipt has purchased a product or service or made a business deal with you in the last 24 months. Consent will also be implied if you are a registered charity or political organization and the person you have sent the CEM to has donated or volunteered for you. Consent will not be achieved through pre-toggle or pre-checked boxes.
- You need to identify yourself. The Act says that whoever sends the message has to identify themselves or whoever they are sending on behalf of, and that contact information has to be valid for a minimum of 60 days after the message has been sent.
- You need to provide an unsubscribe mechanism. Even if (1) and (2) are satisfied you cannot send a CEM if you do not provide a mechanism where the recipient can unsubscribe to future contact. This should be simple, quick and easy for the end-user. An example of an acceptable unsubscribe mechanism would be an unsubscribe link in an email that takes the user to a web page where they can select either to unsubscribe from all or some types of CEM. Another acceptable way to unsubscribe would be allowing the end user to text the word “STOP” or “UNSUBSCRIBE”. An unacceptable unsubscribe mechanism would be a complex multi-step mechanism, such as being re-directed to a new page and then having to login with a username and password and then having to select an unsubscribe button.
Exemptions:
There are several exemptions to CEM’s. These include:
- messages to employees, consultants, those associated with your business, family members and close friends
- responses to anyone who has communicated with you and/or your business in the last six months
- messages attempting to enforce a legal right or court order
- messages that provide information about subscriptions, purchase price, membership accounts, warranty, recall, safety or security information about a product or service
- messages that are sent to a person who is engaged in a commercial activity and that consist solely of an inquiry or application related to that activity
Non-Compliance & Penalties
The law is enforced by three (3) government agencies: The Canadian Radio-Television and Telecommunications Commission (CRTC), the Office of the Privacy Commissioner, and the Competition Bureau. As of July 1, 2017, there will also be a private right of action, which will allow individuals to start taking legal action against anyone not following the rules. The law provides for serious fines. For individuals the maximum is $1 million. For companies, the maximum is $10 million.
Almost a year after CASL came into effect, a Quebec company by the name of Compu-Finder became the first company to be fined. The CRTC handed down the $1.1 million fine after Compu-Finder sent emails to businesses promoting training courses. The violations occurred on four occasions between July 2nd and September 16, 2014. Compu-Finder accounted for 26% of all complaints submitted to the Spam Reporting Centre during that time. These emails were unrelated to the business of many of the recipients, since the email addresses had been acquired by scouring websites. The fact that B2B (business to business) communications attracted the fine is an indication that although there are categories of B2B implied consent, they are not blanket exemptions. The CRTC will enforce compliance with the requirements associated with the B2B exemptions. While it may be tempting to take advantage of “free” electronic communications to advertise and solicit business, failure to comply with CASL can come with a high price tag.
Takeaways:
- B2B (business to business) commercial electronic messages (CEM) are permitted but must comply with the restrictions found in the Canadian Anti-Spam Legislation (CASL). Failure to comply can result in large fines.
- CEM’s must have the (express or implied) consent of the recipient; indentify the sender; contain contact information of the sender; and contain an unsubscribe mechanism, all in accordance with the requirements of the legislation.
- Businesses should carefully consider the CASL consent rules when designing CEM’s for apps and websites.