On July 1, 2014, the first of several phases of Canada’s sweeping new Anti-Spam Law (“CASL”) passed in 2010 will become effective after a long “phase in” period. CASL, while containing significant tools to combat bad spam and to make e-mail marketing more user-friendly and respectful, will require businesses and charities doing business in Canada to devote significant attention (and resources) to re-qualifying their procedures for e-mail communications.
CASL should be of keen interest to any organization, for profit or non-profit, that sends electronic messages (i.e., not just emails, but also text messages) to recipients in Canada in connection with a “commercial activity.” Anyone doing business with Canadian companies or residents, including American companies and organizations, will have to comply with CASL or face the consequences of failing to do so.
The first part of CASL aims to protect consumers from unsolicited electronic messages (which includes not only emails but also text messages) by giving consumers control over who can send them a commercial electronic message or business email. Primarily a law to counter spam, CASL will have a major impact on how businesses conduct operations and market their products in Canada. New rules for electronic communications will compel companies to review their current email practices and, most likely, require them to re-qualify their email customer/contact lists to make them compliant. Persons and businesses in violation of the new laws may face significant financial penalties.
The basic prohibition contained in CASL is against sending “commercial electronic messages” unless the recipient has consented to receiving the message and the message contains certain prescribed information, including the identity of the sender and the sender’s contact information, as well as the unsubscribe mechanism. What is considered “commercial” under CASL is very broad. It is defined to include “any offer to transact any product or service or an interest in land, offer an economic opportunity (including gambling) or to promote any of these activities.” The mechanism to unsubscribe from receiving emails has to remain operative for 60 days and an unsubscribe request must be acted on within 10 days.
Canada’s new law represents a significant and tougher stance against unsolicited commercial emails and is far more restrictive than the United States’ CAN-SPAM Act. The US law is an “opt-out” system. CAN-SPAM only applies to emails Under current US law, as long as an email header (i.e., the subject line) is not misleading, companies are allowed to send one unsolicited commercial email (i.e., SPAM) to a recipient, so long as the email message contains a link to allow the recipient to opt out of receiving future emails and the company then removes the recipient from their mailing lists if they opt out. Canada’s new system, on the other hand, is an “opt-in” system that will require prior to consent to receive emails or texts “in connection with a commercial activity,” subject to a proviso that “implied” consent may be used within specifically defined circumstances such as a contractual relationship with a recipient.
The CASL does include some exclusions and exemptions. For example, several broad categories of messages are excluded entirely from the CASL prohibition or, while governed by it, will have no consent requirement. Excluded entirely are messages between individuals having a family or other personal relationship and business-to-business inquiries or applications. A second category of messages will be required to comply with the required “content” provisions described above, but not the consent requirement. This category broadly includes commercial communications that have a consensual basis, specifically: providing a quote in response to a request, facilitating a commercial transaction, providing warranty, product recall or safety information about a purchased product, providing information regarding the ongoing use of a purchased product or service or an employment relationship, or delivering a product or service (including upgrades) for a previously purchased product or service, to which the purchaser is entitled.
One important group of electronic communications that is exempt from the consent requirement are those falling under the category of “implied consent.” The most important of these are communications relating to an “existing business relationship” or an “existing non-business relationship.” The term “implied consent” is defined to include only specified circumstances. In addition to the two categories just listed, it includes a person posting an e-mail address in effect inviting communications or providing an e-mail address to a sender with no indicated intent not to receive messages, provided that any message sent is relevant to the person’s business.
While the “implied consent” exemption may appear to be an easy “out” from having to comply with CASL’s opt-in requirements, the scope of the “implied consent” rule is limited by the explicit definitions given to the terms “existing business relationship” and “existing non-business relationship.” In both cases, the required element is either an existing commercial relationship (e.g., a recent product or service purchase or a written contract) or a non-commercial relationship (e.g., a gift or donation, volunteer work or membership in an organization).
So how does a company whose messages are not going to be exempted under CASL acquire the required opt-in consent? The request for consent must set out clearly the purposes for which it is sought and, in a prescribed manner, identity information of the requestor. CASL places the legal burden on the organization to prove that consent was, in fact, obtained.
The second phase of CASL will become effective on July 1, 2015. That phase will prohibit the unsolicited installation of computer programs or software, as well unauthorized interference with private electronic messages. This portion of CASL seeks to protect consumers from potentially damaging and deceptive electronic threats (such as identity theft, phishing and spyware) by allowing them to decide who is allowed to put computer programs on their electronic devices. The general rule is that express consent is required to interfere with a message or to download. Furthermore, if downloaded software will perform functions such as collecting the user’s personal information, changing settings already installed on a computer, or interfering with stored data, this fact must be described clearly, prominently, and separately apart from the license attached to the software. Downloading of certain computer programs, such as cookies, where it is reasonable to assume the user’s consent, as well as upgrades to existing programs that have been installed previously with the user’s consent, are deemed to have received express consent.
The third phase, which will become effective on July 1, 2017, pertains to a person’s right to commence an action in court in response to a violation of CASL.
Once CASL is fully phased in, the penalties for failing to comply with it will be significant. These penalties include: (i) monetary penalties in amounts of up to $1,000,000 for individuals and $10,000,000 for other entities; (ii) criminal penalties for obstructing an investigation; and (iii) a private right of action for persons suffering actual loss or damage as a result of non-compliance with CASL. With respect to both the violations and the criminal offences, directors and officers who authorized an organization’s non-compliance will be personally liable. Further, the private right of action (which does not exist for violations of the US CAN-SPAM Act) is significant and potentially far-reaching. It will be available to any individual or other person who has suffered damage as a result of non-compliance. While it will be necessary to prove actual damages, in certain cases it may be possible for a large class of individuals impacted by a violation to file a large and costly class action suit.
The bottom line is that CASL represents a significant change to existing Canadian law, and it should be considered carefully by anyone doing business in Canada.
