Canada's anti-spam legislation: are you ready for it?

September 2013 | EXPERT BRIEFING | CORPORATE LAW

financierworldwide.com

Canada is somewhat late to the anti-spam party but is catching up fast by implementing an anti-spam regime that will be stricter and more far reaching than most other countries. When the average person thinks of spam, the emails that we all clear out of our inbox on a daily basis tend to come to mind. Canada’s Anti-Spam Legislation (CASL) will apply to those emails and much, much more.

CASL takes the approach of forbidding almost all unsolicited commercial electronic messages (CEMs) and generally speaking, requires intended recipients of CEMs to provide express consent to the receipt of those messages. It provides for a few narrow exceptions and details the hoops that the rest of the world will need to jump through to send a CEM. Once in force, CASL will regulate anyone sending CEMs to Canadian recipients. Entities outside of Canada, such as UK businesses, could be susceptible to penalties under this legislation as there is nothing in the CASL which limits its effect to domestic senders of CEMs.

Under CASL, CEMs may be sent when the recipient opts in either with express or implied consent or one of the exemptions to consent applies. This is the complete opposite of the US Can-Spam Act, which permits CEMs to be sent unless or until the recipient opts out.

A CEM is broadly defined to include any message that has, as its purpose or one of its purposes, to encourage commercial activity. It has been suggested that the mere presence of a link to a company website can make an email a commercial electronic message that is subject to CASL.

CASL’s specifically-defined exemptions permit certain messages to be sent without full CASL compliance. The general prohibition on sending CEMs does not apply to a CEM sent: in a personal or family relationship; as an inquiry relating to the recipient’s commercial activity; to provide requested product/service quotes; to further or complete an ongoing commercial transaction previously agreed to; to provide product warranty, recall, upgrade or similar information; to deal with ongoing subscriptions, memberships or similar relationships; or that concern an employment relationship.

Implied consent applies to: ‘existing business relationships’, as defined; ‘existing non-business relationships’, as defined; and circumstances where the email address of the recipient was made publicly available or voluntarily provided.

It is important to note that the above exemptions are very precisely defined and in some cases are subject to time constraints. For example, an ‘existing business relationship’ under CASL generally would not apply to a relationship where business dealings have not occurred within the immediately previous two years.

The Regulations also prescribe the form and content of requests for consent of persons to whom CEMs are proposed to be sent.

With respect to social media sites that allows messages to be posted to ‘walls’, consent to receive any messages that are posted on a ‘wall’, sent via a feed, or otherwise not targeted to any specific individual is obtained when a user agrees to follow or otherwise subscribe to receive such messages but direct messages to any given user’s electronic address, would require CASL consent.

CASL also contains provisions that pertain to the installation of computer programs such as cookies. Cookies are a form of computer program for which consent must be given before they can be installed on someone’s computer.

CASL includes provisions for substantial penalties, with potential fines up to $10m. Enforcement of CASL will be supported by the CRTC’s Spam Reporting Centre.

Given that CASL is not expected to be in force until late 2013 or early 2014, organisations that communicate with Canadians have time to prepare for CASL coming into force by taking appropriate steps. CASL also provides for a transition period under which consent can continue to be implied (unless expressly revoked).

Wendy G. Hulton is a partner at Dickinson Wright PLLC. She can be contacted on +1 (416) 777 4035 or by email: WHulton@dickinsonwright.com.

Wendy G. Hulton

Dickinson Wright PLLC