Bottom Line: Canada's Anti-Spam Legislation ("CASL") is a strict regime with severe penalties for non-compliance, including a private right of action. For example, as marketers, whether you're using electronic means to invite consumers to enter a contest, try a new product or participate in some other marketing program, you won't be able to do so without getting proper consent and observing speci_c form and content requirements in your subsequent e-messages.
CASL regulates the sending of "commercial electronic messages" ("CEMs"), including email, text, sound, voice and image messages. Notably, this definition goes beyond the reach of anti-spam legislation in the US and several other jurisdictions which focus on email spam. CASL applies to CEMs sent to, through or from Canada, meaning that it applies to US or other international senders who send emails into Canada.
In general, subject to limited exclusions and prescribed circumstances in which consent is not required (i.e., CEMs that provide a quote, facilitate, complete or confirm a commercial transaction or provide factual information), CASL prohibits the sending of CEMs unless the recipient has provided express or implied consent and the message complies with prescribed form and content requirements.
While an implied form of consent may be relied upon in certain circumstances (i.e., where there is an existing business relationship), such consent is time-limited under CASL (i.e., two years after a purchase or written agreement, six months after an inquiry). Organizations must therefore carefully consider the type of consent they obtain, and be prepared to keep track of various time restrictions (or else obtain express consent from the outset). Given that there is currently no grandfathering of existing consents that were obtained under existing privacy legislation, organizations will need to take stock of all of their CEMs and carefully consider the application of CASL to each type of communication to determine if a re-consenting process is required.
HEAVY DUTY PENALTIES
The penalties for violations of CASL are significant. The Act allows the Canadian Radio-television Telecommunications Commission ("CRTC") to impose administrative monetary penalties of up to $1 million per violation for individuals and up to $10 million per violation for businesses. The Act also provides for a private right of action, allowing consumers and businesses to take civil action against anyone who violates the Act. The court may order violators to pay compensation in an amount equal to the loss or damage suffered or expenses incurred, and statutory damages of up to $200 for each violation of the Act, up to a maximum of $1 million each day. For mass email campaigns over a period of time, then, the potential damages and penalties could be enormous.
The CRTC Regulations ("CRTC Regs"), finalized in March 2012, prescribe the requirements for obtaining express consent to send CEMs under CASL. Express consent may be obtained orally or in writing. In either case, any request for express consent must set out the following information:
- the purpose for which consent is being sought (meaning that if you get consent for one purpose, you won't be able to send CEMs for another);
- the name of the person requesting consent;
- if the consent is sought on behalf of another person (such as a marketing partner or sponsor), the name of that person;
- if consent is sought on behalf of another person, a statement indicating which person is seeking consent and which is the person on whose behalf consent is sought;
- the mailing address, and either a telephone number providing access to an agent or a voice messaging system, an email address or a web address of the person seeking consent or, if different, the person on whose behalf consent is sought; and
- a statement indicating that the person whose consent is sought can withdraw their consent.
Note, though, that unlike in the US, under CASL you can't send a request for consent by email – or by any other electronic means covered by CASL. Requests for consent are considered to be CEMs and therefore you will need to have consent in order to send them.
FORM AND CONTENT REQUIREMENTS FOR CEMS
Under CASL, once you have consent to send CEMS, the CEMS themselves will need to comply with prescribed form and content requirements, including an unsubscribe mechanism. The CRTC Regs require the following information to be set out clearly and prominently in each CEM:
- The name by which the sender carries on business;
- A mailing address and one of either: (i) a telephone number with access to an agent or voice messaging system; (ii) an email address; or (iii) a web address; and
- When sending out a message on behalf of another organization, the message must include the same contact information listed above for the other organization and a statement indicating which organization is sending the message and which organization on whose behalf the message is sent.
In addition, the CRTC Regs provide that an unsubscribe mechanism (in a prescribed from) must be set out clearly and prominently and be able to be "readily performed." The unsubscribe mechanism must take effect within ten days of the unsubscribe request being sent.
The CRTC Regs for CASL were finalized in March of this year. Industry Canada regulations are expected to be released this fall for a second comment period. The Act (and associated regulations) is expected to be in force in the latter half of 2013.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.