Canada’s new anti-spam and online fraud act (commonly known as “CASL”) and the American Controlling the Assault of Non-Solicited Pornographic And Marketing Act of 2003 (commonly known as “CAN-SPAM”) both regulate unsolicited electronic communications, but there are significant differences between the two laws. CASL establishes one of the strictest anti-spam regimes in the world, with a much broader scope of application than CAN-SPAM and with restrictions and requirements that are far more onerous than those under CAN-SPAM.
Following is a summary of the key differences between CASL and CAN-SPAM with respect to the regulation of unsolicited commercial electronic messages:
- Messages: CASL applies to any electronic message (email, text, sound, voice or image) sent to an electronic address (email, instant message, telephone or similar account). CAN-SPAM applies to electronic mail only.
- Commercial Purpose: CASL applies to an electronic message if one of its purposes is to encourage participation in a commercial activity (a transaction, act or conduct of a commercial character) whether or not in expectation of profit. CAN-SPAM applies to a message only if its primary purpose is commercial advertisement or promotion of a commercial product or service.
- Extra-Territorial Application: CASL applies if a computer system in Canada is used to send or access a regulated message, subject to limited exceptions. The extra-territorial application of CAN-SPAM is not specified.
- Consent: CASL is an opt-in regime, which prohibits sending a regulated message unless the recipient has given consent (express or implied in limited circumstances), subject to limited exceptions, and a regulated message cannot be used to request consent to receive future regulated messages. CAN-SPAM is an opt-out regime, which permits sending a regulated message unless the recipient has previously opted out of receiving the message.
- Information Disclosure for Express Consent: CASL requires that a request for express consent to receive a regulated message include disclosure of prescribed information (purpose of consent, name and contact details of persons requesting consent, and statement that recipient can withdraw consent). CAN-SPAM does not require express consent or related information disclosures.
- Implied Consent: CASL recognizes implied consent to receive a regulated message in limited circumstances, many of which are time limited and subject to withdrawal of consent. CAN-SPAM generally recognizes implied consent where the recipient has not opted out of receiving a regulated message.
- Formalities: CASL and CAN-SPAM both require that certain information and an unsubscribe mechanism be included in a regulated message, but those requirements are different.
- Exceptions: CASL and CAN-SPAM both recognize various exceptions to certain restrictions and requirements, but the exceptions are different.
- Vicarious Liability: CASL imposes vicarious liability on corporate directors and officers (who are personally liable if they direct, authorize or assent to, or acquiesce or participate in, a contravention of CASL) and employers (who are liable for acts of employees/agents within scope of their employment/agency), subject to a due diligence defence. CAN-SPAM does not expressly impose vicarious liability.
- Private Civil Action: CASL allows any individual or organization affected by a contravention of CASL to sue for compensatory damages and a penalty of $200 per contravention to a maximum of $1 million per day, and class proceedings are possible. CAN-SPAM allows affected Internet access service providers to sue for statutory damages.
CASL is expected to come into force in late 2013 or early 2014, after all required regulations have been finalized.
American organizations that send commercial electronic messages to recipients in Canada must comply with CASL, unless limited exceptions apply, or risk potentially severe consequences, including administrative penalties (up to $1 million per violation for individuals and up to $10 million per violation for organizations). Due to the significant differences between CASL’s opt-in regime and CAN-SPAM’s opt-out regime, CAN-SPAM compliance practices will not ensure compliance with CASL. Accordingly, American organizations that send commercial electronic messages to recipients in Canada should now be preparing to comply with CASL.