Recent enforcement under Canada's anti-spam legislation
(CASL) by the Canadian Radio-Television and Telecommunications
Commission (CRTC) is keeping the spotlight on this new legislation,
which came into force just last year. While the CRTC is responsible
for the bulk of enforcement under CASL, organizations should
remember that CASL also brought in changes to Canada's federal
privacy law, the Personal Information Protection and Electronic
Documents Act (PIPEDA), which applies to the collection, use
and disclosure of personal information (including individuals'
The federal Office of the Privacy Commissioner of Canada (OPC)
is responsible for investigating violations
related to the new provisions under PIPEDA that target the practice
of address harvesting. Address harvesting generally involves
collecting electronic addresses through the use of a computer
program, such as through web scraping, spyware, or automatic
The OPC recently issued a guide and tip sheet for organizations on pratical steps
to take to avoid contravening the PIPEDA requirements,
1. Obtain consent:
Organizations must ensure that individuals are informed
clearly and accurately at the point of collection about how their
email addresses will be used. Just because an email address is
posted online, it cannot be assumed that the individuals at the
addresses posted have provided consent to receive email marketing.
It is also useful to remember that there is no exception for
address harvesting of business email addresses; PIPEDA's
definition of personal information includes business addresses.
2. Due Diligence with Service Providers: If an
organization buys a list of email addresses from a vendor or
employs service providers to conduct email marketing on their
behalf, they should take due diligence steps by asking key
questions, such as:
How was consent obtained? Appropriate consent
at the time of collection must be obtained to use email
addresses. Ensure that email marketing service
providers utilize a clear consent process. If buying or
using a list from a list vendor, were the email
addresses collected through web scraping or automatic
How is the email address list kept up to date?
Unless otherwise permitted under the law, individuals should be
permitted to withdraw consent to the use of their personal
information at any time, such as by unsubscribing from an email
list, and this functionality should be made available.
Organizations that use a purchased list of email addresses should
ensure that any unsubscribe requests will be communicated to them
so that the email can be removed from the list that they use.
3. Maintain written records:
An organization should document all email marketing
compliance measures, including due diligence steps taken when
contracting with a list vendor or email marketing company. Ensure
that the service agreements with these organizations expressly
require compliance with CASL and applicable privacy laws.
Organizations are responsible for ensuring that all individuals
that receive email marketing from them have provided
appropriate consent for the collection and use of their address for
marketing . The OPC will review reports to the Spam Reporting Centre to identify email
harvesters and spyware collecting personal information without
consent. Organizations should take steps to comply with PIPEDA
to avoid being caught by an OPC investigation, which
could lead to being named in the OPC's reports
of its findings and recommendations.
Dentons is a global firm driven to provide you with the
competitive edge in an increasingly complex and interconnected
marketplace. We were formed by the March 2013 combination of
international law firm Salans LLP, Canadian law firm Fraser Milner
Casgrain LLP (FMC) and international law firm SNR Denton.
Dentons is built on the solid foundations of three highly
regarded law firms. Each built its outstanding reputation and
valued clientele by responding to the local, regional and national
needs of a broad spectrum of clients of all sizes –
individuals; entrepreneurs; small businesses and start-ups; local,
regional and national governments and government agencies; and
mid-sized and larger private and public corporations, including
international and global entities.
Now clients benefit from more than 2,500 lawyers and
professionals in 79 locations in 52 countries across Africa, Asia
Pacific, Canada, Central Asia, Europe, the Middle East, Russia and
the CIS, the UK and the US who are committed to challenging the
status quo to offer creative, actionable business and legal
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances. Specific Questions relating to
this article should be addressed directly to the author.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
On Thursday, September 22, 2016, Dentons hosted a panel discussion about the management of liabilities and risks associated with environmental crises, including potential liabilities for directors and officers and provided insight into risk and liability techniques associated with environmental crisis management.
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).