Canada enacted anti-spam legislation in December 2010 that came into force, in part, on 1 July 2014. Canada's anti-spam legislation sets out a comprehensive anti-spam regime that, among other things, places restrictions on the sending of commercial electronic messages, including emails and text messages.
Given the broad application, technical nature of Canada's anti-spam legislation, not to mention the severe penalties for breach, Canadian businesses and others sending marketing messages to and from Canada, need to sit up and take notice. Since the legislation has come into force, the regulator – the Canadian Radio-television and Telecommunications Commission (CRTC) – has reported receiving over 50,000 complaints.
Canada's anti-spam legislation (CASL) regulates the sending of "commercial electronic messages" (CEMs), which is defined broadly to include a message sent by any means of telecommunication, including a text, sound, voice or image message, that by virtue of its content, including any hyperlinks to other content on a website and contact information, it would be reasonable to conclude that, among its purposes, it is aimed at encouraging participation in a commercial activity.
The penalties for violations of CASL are significant. The Act allows the CRTC to impose administrative monetary penalties of up to C$1 million per violation for individuals and up to C$10 million per violation for businesses. CASL also provides for a private right of action, allowing consumers and businesses to take civil action against anyone who violates its provisions. The court may order violators to pay compensation in the amount equal to the loss or damage suffered or expenses incurred, and statutory damages of up to C$200 for each violation of the Act, up to a maximum of C$1 million each day.
In general, CASL prohibits the sending of CEMs unless the recipient has provided express or implied consent and the message complies with prescribed form and content requirements.
While an implied form of consent may be relied upon in certain circumstances (e.g. where there is a defined form of existing business relationship), such consent is time-limited under CASL (e.g. two years after a purchase or written agreement and six months after an inquiry). Organisations must, therefore, carefully consider the type of consent they obtain, and be prepared to keep track of various time restrictions (or else obtain express consent or rely on another exception).
CASL sets out prescriptive requirements for obtaining express consent to send CEMs. Express consent may be obtained orally or in writing. In either case, any request for express consent must set out the following information:
- the purpose for which consent is being sought;
- the name of the person requesting consent;
- if the consent is sought on behalf of another person, the name of that person;
- if consent is sought on behalf of another person, a statement indicating which person is seeking consent and which is the person on whose behalf consent is sought;
- the mailing address and either a telephone number providing access to an agent or a voice messaging system, an email address or a web address of the person seeking consent or, if different, the person on whose behalf consent is sought; and
- a statement indicating that the person whose consent is sought can withdraw their consent.
Given that there is no general grandfathering of existing express consents under CASL, many organisations have been reviewing all of their CEMs and carefully considering the application of CASL on their messaging activities.
Form and content requirements for CEMs
Under CASL, most CEMs need to comply with prescribed form and content requirements, including an unsubscribe mechanism. The following information must be set out clearly and prominently in each CEM:
- the name of the person sending the message; and
- the mailing address, and either a telephone number providing access to an agent or a voice messaging system, an email address or a web address of the person sending the message.
CASL also sets out further notice obligations when the message is sent on behalf of another person.
In addition, an unsubscribe mechanism (in the prescribed from) must be set out clearly and prominently and be able to be "readily performed." The unsubscribe mechanism must take effect within 10 days of the unsubscribe request being sent.
Computer installation provisions
CASL also includes provisions related to the installation of computer programs. These provisions do not come into force until 15 January 2015.