Canada: CASL Update #4 – Final Anti-Spam Regulations And In-Force Date Published

Last Updated: December 13 2013
Article by Robert Hester and David Young

On December 5, 2013, Industry Canada published its final Electronic Commerce Protection Regulations and announced that the in-force date for Canada's Anti-Spam Legislation (CASL) will be July 1, 2014. The timing, essentially a six-month window to required compliance, is shorter than generally expected (Industry Canada had indicated previously a likely 12-month delay following finalization of the regulations), with the result that businesses and other organizations will now need to shift their CASL-qualifying activities into high gear. As well, the message is that the overall compliance requirements will not be changed substantially from what we have understood:

  • an opt-in consent regime with no grandfathering of consents otherwise compliant under the Personal Information Protection and Electronic Documents Act (PIPEDA);
  • specific exceptions for permitted commercial electronic messages (CEMs);
  • limited scope for implied consent to send a CEM;
  • requirements that all CEMs contain specified sender contact information and an unsubscribe mechanism.

While the regulations contain certain additional specific exceptions, such as for charities' and political parties' fundraising activities, as well as refinements to certain of the previously indicated exceptions, the thrust is consistent with the federal government's consumer protection strategy: protecting Canadians from spam.

The now final regulations reflect Industry Canada's review and response to comments received and consultations conducted with stakeholders during the 10 months following its release of draft regulations in January 2013. Those draft regulations had, in turn, reflected revisions to an earlier draft of the regulations (June 2010).

At each stage of these successive draft, and now final, versions of the Industry Canada Regulations, the government has sought to satisfy significant business and, more recently, non-profit sector concerns with the law. However, the "ban-all, subject to exceptions" approach, while potentially assisting many organizations in achieving compliance, leads to a patchwork quilt of rules which underscores the need to obtain opt-in consent in any event so as to ensure compliance outside of the specified exceptions.

The changes to the Industry Canada Regulations from the January 2013 draft are quite limited, although they do contain some helpful additional provisions, as well as certain "tweaks" which are mostly helpful but in some instances may complicate compliance. Of equal importance to these adjustments are the comments (presumably emanating from Industry Canada) contained in the Regulatory Impact Analysis Statement (RIAS) that accompany the regulations. Here, unusually, the RIAS, which typically is intended to summarize the impacts – both positive and negative – of new legislation, in this case seeks to provide interpretations and compliance guidance. The RIAS is helpful in explaining the rationale behind some of the changes from the previous draft version – as well as changes that were not made. The interpretive guidance indicated, while helpful to understand, however cannot be considered as having any binding effect, as might be the case with guidelines or policy statements issued by the CRTC as the agency responsible for enforcing CASL. The RIAS indicates that Industry Canada and the CRTC intend to issue, jointly, guidance information respecting CASL.

The CASL Regulations

CASL contemplates two sets of regulations, one from Industry Canada and another from the CRTC. The CRTC finalized its regulations on March 7, 2012. Those regulations specify the required form and content of CASL-compliant CEMs as well as the form and content for requests for consent ( McMillan Bulletin – July 2012).

The Industry Canada Regulations are intended to address potential exclusions and exceptions from the law, by either providing definitions for exemption categories specified in the law or supplementing them with additional categories. In addition, the regulations stipulate a number of other definitions and procedural conditions and as well computer programs that may be installed without a user's separate consent.

No Grandfathering of PIPEDA Consents

The most significant information learned from the Industry Canada Regulations is that there will be no "grandfathering" of consents obtained under PIPEDA. PIPEDA permits both implied and express consent; under CASL implied consent is available only in limited specifically-defined circumstances.

This qualification, which had been advocated almost unanimously across the stakeholder spectrum from the early days of the proposed legislation, was rejected by Industry Canada. No PIPEDA consent grandfathering will complicate compliance under the law for businesses and not-for-profit organizations, small and large. The reason for this is that, as the potentially broad application of the law and its patchwork quilt of exceptions becomes more clearly understood, most organizations will realize that their only confident option for compliance will be express, opt-in consent. PIPEDA grandfathering would have qualified email contact lists understood to be compliant under that law, but which will not be CASL-compliant unless either they:

  1. continue, on an on-going basis, to qualify under one of CASL's situation-specific exceptions; or
  2. were obtained with express consent prior to CASL's coming into force.

The RIAS makes clear that many PIPEDA-compliant consents will not be valid under CASL. However, helpfully, it also confirms that an express consent obtained prior to CASL (i.e. under PIPEDA) that addresses sending CEMs will be recognized as compliant with CASL.

The RIAS underlines that CASL's three-year transition period (see McMillan Bulletin – July 2012) is intended to enable organizations to obtain consent. However, to qualify under the transitional period a contact must fall within one of CASL's defined "implied consent" categories of an existing business or non-business relationship without reference to otherwise applicable time periods. If this condition is not met and the contact does not qualify under a specific exception, the organization will not be able even to request consent by way of a CEM once the law comes into force.

Exclusions – All CEM Compliance Requirements

The final regulations expand the list of specifically defined exclusions from all of CASL's CEM compliance requirements and provides adjustments to some of the previously identified exclusions.

Charities and Political Parties

The Industry Canada Regulations provide that CEMs sent by registered charities and political parties which have the primary purpose of seeking donations, or soliciting a contribution, (respectively), are not subject to CASL's consent and content requirements.1 Charities and not-for-profit organizations had made strong submissions arguing for complete exclusion from the law. Industry Canada's response is to provide an exception, limited to charities' communications that qualify as having fundraising as the primary purpose. The challenge for such organizations will be to ensure that the excepted communications meet the criterion. Fundraising likely extends to selling tickets for dinners and other galas – but does it include, for example, sale of merchandise? CEMs sent by many charities clearly will not be excepted – such as theatre subscription solicitations.

There is no blanket exception for non-charitable, not-for-profit organizations. However, fine-tuning adjustments to certain of the defined exceptions should assist such organizations in facilitating compliance (see below).

Communications Within or Between Organizations

The January 2013 draft regulations introduced an exception for messages sent within an organization or between employees or agents of two organizations, if the message concerns the "affairs" or "duties" of the employee of the organization, and the organizations have a "business relationship".

This exception has been refined to more clearly enable its application to non-business organizations. Now, the subject matter of an excepted message need only relate to the "activities" (as opposed to the "affairs" or "duties") of the organization and it will be sufficient for a connection between two or more organizations to constitute a "relationship" (as opposed to a "business relationship").

CEMs Sent by Foreign Entities

The January 2013 draft regulations provided that CASL's consent and content requirements would not apply to a CEM sent by a foreign entity if accessed by a computer in Canada, if the sender could not reasonably be expected to know that that would occur and the CEM related to products, or services, of an organization provided or located outside of Canada. The revised version of this exception eliminates these specific requirements and replaces them with an alternative, broader criterion: that the sender must simply believe that the message will be accessed in a foreign state that has a law substantially similar to CASL,2 and it complies with that law.

This exception enables Canadian-based entities to send CEMs to foreign persons if those CEMs comply with the law of the state in which the foreign person is located. Clearly, the revised exception has a different and more broader focus than the initial draft version – which was explained as seeking to except CEMs addressed to foreigners temporarily travelling in Canada. Industry Canada's stated rationale for the revised provision is to "reduce regulatory duplication". However, many non-Canadian organizations that maintain multi-national email communication lists will need to consider whether the exception permits them to address another concern: the need of differentiating emails intended solely for Canadian residents from those that cannot be differentiated between Canadian and non-Canadian residents. The difficulty that has been voiced is that such organizations may not be able to isolate all email addresses related to persons resident in Canada (such as an address that ends in ".com") and therefore may, inadvertently send non-complying emails to such addresses.

Electronic Messaging Services

The final regulations add as new category of excepted communications, messages sent and received on an electronic messaging service. Individual messages will be excluded provided that the recipient consents to receive messages, either expressly or by implication, and the user interface of the electronic messaging service includes CASL's required content information. Unique to this exception is that consent to receive the messages may be implied and that such implied consent is not limited to a defined category, in contrast to the limited, defined categories of implied consent otherwise applicable to CEMs ( McMillan Bulletin July 2012).

While details have not been provided as to what may be considered an "electronic messaging service", this description may include web-based discussion forums, instant messaging platforms and apps (e.g., Facebook Chat, Yahoo Messenger, Google Hangouts) and websites with pop-up chat windows used by businesses for the purposes of sales promotions and customer assistance. By contrast, SMS text messages, and other technologies which transmit messages without the use of a user interface, would not be covered under this new exemption.

Personal and Family Relationships

Under s.6 of CASL "personal or family relationships", as defined by the regulations, are excepted from the consent and content requirements.

The January 2013 draft regulations helpfully brought the qualifying criteria for a "personal relationship" into the digital era by not requiring a face-to-face, in-person meeting in order to qualify. However, by stipulating a list of criteria,3 all of which would need to be considered – including whether such an in-person meeting had occurred, the proposed revision might have been interpreted as still requiring an in-person meeting. The revised version of this exception stipulates that qualification for a personal relationship need only consider any, as opposed to "all", of the stipulated criteria, thus making it more clear that an in-person meeting is not a requirement.

The significance of the definition for marketers is that it can enable referral marketing using "refer-a-friend" techniques using viral and social media platforms. Such potential application would have been severely limited if the requirement of an in-person meeting had applied.

The definition of a "family relationship", also an excluded category, while seemingly streamlined in a revised definition, appears to have been narrowed to exclude extended "blood relationship" family members who are not in an immediate parent-child relationship (e.g. grandparents/grandchildren). Instead, the definition now specifically refers to a relation through a marriage, common-law partnership or legal parent-child relationship. While it remains to be seen how this definition will be interpreted, there is a suggestion that this narrowing is a drafting error which should be rectified.4

Exemptions from Consent Requirement - Referrals

The January 2013 draft regulations introduced a new category of exception from CASL's consent requirement – third party referrals. It was intended to enable individuals to refer other individuals with whom they have a defined relationship (personal, family, business, non-business) to a professional or other individual supplier of a product or service with whom they also have such a relationship, who then could send a CEM to the individual without requiring their consent. The exemption is intended to apply to the initial CEM between the person receiving the referral and the CEM recipient, in which, presumably, a request for consent to future CEMs would be included. However, as written, the draft version of the exemptions did not clearly enable referrals to "organizations".

The version of the exception contained in the final regulations makes it clear that the referral may be to an organization or any other entity that falls within the Act's definition of "person" which includes both individuals and organizations. The exception is of relevance for referral marketing particularly since, in contrast to the personal relationship exception, which requires that the introductory communication be sent directly "friend-to-friend", there is no such requirement and the CEM may be sent directly by the product marketer. On the other hand, the personal relationship exception can apply to all CEMs sent by an organization to an individual whereas the referral exception applies only to the initial, introductory communication.

Industry Canada's publication of its final Industry Canada Regulations and its announcement of the July 1, 2014 in force date mean that the compliance picture for CASL is now substantially complete. Organizations should be taking focused measures to ensure that their email contact databases will not offend the law. Future guidance from interpretation bulletins will assist. However the now clear six-month compliance window dictates finalizing and executing compliance strategies without delay.

Footnotes

1 CASL's content requirements stipulate that all CEMs must include specified sender contact information and an unsubscribe mechanism.

2 The regulations include a defined list of states deemed to have such a law.

3 Sharing of interests, experiences, opinions and information evidenced in the communications; the frequency of communication; the length of time since the parties communicated; whether the parties have met in person.

4 See Barry Sookman, December 4th Blog post. Alternatively, it could be argued that the new wording may permit a broader scope of relationships, to be based on a relation through the family connection. This may be why Industry Canada elected to use "through", rather than "by".

The foregoing provides only an overview. Readers are cautioned against making any decisions based on this material alone. Rather, a qualified lawyer should be consulted.

© Copyright 2013 McMillan LLP

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Authors
Robert Hester
Similar Articles
Relevancy Powered by MondaqAI
 
In association with
Related Topics
 
Similar Articles
Relevancy Powered by MondaqAI
Related Articles
 
Related Video
Up-coming Events Search
Tools
Print
Font Size:
Translation
Channels
Mondaq on Twitter
 
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).
 
Email Address
Company Name
Password
Confirm Password
Position
Mondaq Topics -- Select your Interests
 Accounting
 Anti-trust
 Commercial
 Compliance
 Consumer
 Criminal
 Employment
 Energy
 Environment
 Family
 Finance
 Government
 Healthcare
 Immigration
 Insolvency
 Insurance
 International
 IP
 Law Performance
 Law Practice
 Litigation
 Media & IT
 Privacy
 Real Estate
 Strategy
 Tax
 Technology
 Transport
 Wealth Mgt
Regions
Africa
Asia
Asia Pacific
Australasia
Canada
Caribbean
Europe
European Union
Latin America
Middle East
U.K.
United States
Worldwide Updates
Registration (you must scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.

Disclaimer

The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.

General

Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions