Articles

Are You Complying with Canada's New Anti-Spam Rules?

Date: July 14, 2014

Canada's Anti-Spam Legislation has gone into effect as of July 1, 2014, but there's no need to panic if you know the basics.
 
The majority of Canada's Anti-Spam Legislation (CASL) went into effect on July 1, 2014, and this has many U.S. associations and nonprofit organizations concerned. We are not Canadian lawyers, but we can tell you what we know about the new law.
 
First, there is no need to panic, because the CASL includes an "implied consent” provision that should permit organizations to send commercial emails to members and others with whom they have an existing relationship.

In the long run, obtaining an opt-in from recipients to receive messages will be necessary to ensure compliance with the law. The new law does have a private right of action so that even U.S. organizations could be ultimately subject to legal action in Canada. However, these issues are being addressed currently, and for legal advice, you should consult Canadian counsel.
 
One of the key provisions of the law — Section 6 of CASL — concerns the sending of commercial electronic messages (CEMs) when a computer system located in Canada is used to send or access the CEM. Similar to the U.S. CAN-SPAM Act, associations and nonprofit organizations are not exempt from compliance, and any electronic messages promoting or encouraging sales of product or services or participation in organizational activities are regulated under the CASL. Given that many associations have members, volunteers, content subscribers, and business contacts residing in Canada, it will be necessary to implement a plan to comply with CASL. 

While the U.S. CAN-SPAM Act regulates email messages, note that CEM is broadly defined under CASL to cover all types of electronic messages, including email, text, sound, voice, or image message, and "electronic address” is also broadly defined to include recipient's email account, instant messaging account, telephone account, or any similar account (possibly a social media account).   

In short, if a sender is transmitting a CEM to an electronic address where the recipient is in Canada, the sender must comply with three requirements under CASL:

  1. Obtain consent;
  2. Provide identification information; and 
  3. Provide an unsubscribe mechanism.

Because the CASL requirements concerning identification and an unsubscribe mechanism are very similar to the CAN-SPAM Act, associations who have been following best email practices under the CAN-SPAM Act regime should focus mainly on the consent requirement. There are two types of consent under CASL, express and implied.  

How to Obtain Express Consent
To obtain express consent, the recipient must take a positive action to indicate his or her consent. As such, an opt-in mechanism is required, as opposed to opt-out. An example of an acceptable means of obtaining consent in writing would be having the recipient check a box on a webpage or on a membership application or renewal form to indicate consent.
 
However, because the sender cannot presume consent on the part of the recipient, a pre-checked box may not be used. In addition, requests for consent may not be bundled with requests for consent to the association's general terms and conditions of use or sale of products or services. That is, the recipient must be able to consent to the terms and conditions of use or sale while still refusing to grant his or her consent to receive CEMs.

The Canadian Radio-television and Telecommunications Commission (CRTC) has issued provide guidance on recommended "check-the-box” practices and has approved the following example as compliant:

[  ] I accept the Terms and Conditions.
[  ] I agree to receive Association's publication containing news, updates, and promotions regarding Association's products. You can withdraw your consent at any time. Please refer to our privacy policy or contact us for more details.

Implied Consent and the Transitional Period
It is clearly advisable for associations to obtain express consent because such express consent does not expire until the recipient withdraws his or her consent. In contrast, implied consent is usually subject to an expiration date. In this respect, CASL includes a transitional provision of 36 months that relates to obtaining implied consent. Under the transitional provision, consent is implied for a period of 36 months beginning July 1, 2014, provided that there is an existing business or non-business relationship (as described further below) that includes the communication of CEMs. However, once this 36-month transitional period has ended, implied consents will no longer be effective. 

As for what constitutes an existing business or non-business relationship:

  • There is an existing business relationship between the sender and the recipient if the CEM arises from the purchase of a product/goods/service, the acceptance of a business opportunity, or a written contract between the sender and recipient, provided that the foregoing activities occurred within a two-year period immediately before the CEM was sent. There is also an existing business relationship if an inquiry or application is made in respect to the referenced activities, and the implied consent is valid within a six-month period immediately before the inquiry was sent. 
  • There is an existing non-business relationship between the sender and the recipient if the CEM arises from a donation to a registered charity, volunteer work, or attendance at a meeting organized by a registered charity, or membership in a club, association, or voluntary organization or association, provided that the foregoing occurred within a two-year period immediately before the CEM was sent.

Based on the definitions of existing business relationship and non-business relationship, most associations should be considered to have obtained implied consent from their members, event participants, volunteers, and vendors residing in Canada. So, at present, associations with bona fide members, vendors, exhibitors, or other similar relationships in Canada should be able to rely on implied consent for the 36-month period until express consent is obtained via opt-in.
 
However, it is important to note that, any implied consent will end if the recipient indicates that they no longer consent to receiving CEMs. Given the transitional period and the time limitations applicable to implied consent, it is advisable that associations seek express consent for the continued sending of CEMs.  
 
Identification Information
As mentioned previously, the identification requirement under CASL is similar to the U.S. CAN-SPAM Act requirement. Note the following points:

  • The CEM must prescribe information that identifies the sender and on whose behalf the CEM is sent. 
  • When a CEM is sent on behalf of multiple persons, such as affiliates, all of these persons must also be identified in the CEM. If it is not practicable to include the information in the body of a CEM, it is acceptable to use a hyperlink to a webpage containing the information. 
  • The CEM must set out information enabling the recipient to readily contact the sender. In regards to contact information, it is required that the mailing address of the sender be included; P.O box or general delivery address are acceptable. 

Unsubscribe Mechanism
The unsubscribe mechanism requirement under CASL is essentially the same as the U.S. CAN-SPAM Act. Note the following points:

  • The unsubscribe mechanism must be easy to use and at no cost to the recipient.  
  • The unsubscribe request must be honored no later than 10 business days after the request has been sent.

Here are some questions that have been raised concerning compliance with CASL:
 
Question: If someone gives a staff a business card at an event, does that constitute consent to add the person to the association's mailing list?

  • There may be implied consent to send CEMs as long as the CEM relates to the recipient's role, function, or duties in an official or business capacity, and the recipient has not made a statement when handing the business card that he or she does not wish to receive CEMs at that address.

Question: If an employee of Company ABC attended an association event on behalf of the company and provided express consent to receive CEMs from the association, can the association send CEMs to other employees of Company ABC?

  • Unless all employees of Company ABC share one email address, the association cannot send CEMs to other employees of Company ABC. CASL prohibits sending CEMs to an electronic address unless all requirements (i.e. consent, identification, and unsubscribe mechanism) are met.


Question: Is there a difference between sending "blast” electronic messages and sending a message to one individual in Canada to attend an upcoming event?

  • If the message is a commercial electronic message, CASL applies. It doesn't matter if it is sent through an email list, sent to an individual with a personal cover note, or to multiple addressees. 
  • However, the CEM provision does not apply to CEMs sent to an individual with whom the sender has a personal or family relationship. A personal relationship involves direct, voluntary, two-way communication, and is subject to a narrow interpretation limited to close relationships. For example, a Facebook friend might not be considered an individual whom the sender has a personal relationship. Also note that a personal relationship is one that exists between individuals, not legal entities.


Question: Do associations need to send a consent request to Canadian members and contacts every year or every two years?

  • If the association obtains express consent from the recipient, the consent continues until the recipient withdraws his or her consent. As such, it is not necessary for associations to seek express consent every year or every two years. 
  • As mentioned above, CASL has a transitional provision in place. As such, consent is implied for a period of 36 months beginning July 1, 2014, provided that there is an existing business or non-business relationship that includes the communication of CEMs.  

Finally, it is important to note that, in addition to an administrative monetary penalty for up to $1 million for individuals and up to $10 million for corporations, a private right of action for violations is available under CASL. As for liability, directors, officers, and agents of an entity may be liable if they directed, authorized, assented to, or participated in the commission of the violation. The section permitting the private right of action will come into force on July 1, 2017. 

View the full text of CASL.