The federal government is expected to soon bring into force Bill C-28, Canada’s Anti-Spam Legislation (CASL). It’s a development that has been criticized as long overdue, considering that the U.S. introduced its comparable CAN-SPAM Act in 2003.
At Fasken-Martineau Ottawa’s annual symposium last month, partner Leslie Milton discussed the ramifications of CASL and its expected impact on how organizations may use email for various marketing and transactional activities.
Enforcement of CASL will largely fall on the Canadian Radio-television Telecommunications Commission (CRTC), an arena of regulation in which Leslie is well versed. She practises primarily in the areas of communications law, competition law and international trade law.
Leslie’s communications law practice extends to all areas of communications regulation. She regularly represents clients in regulatory proceedings before the CRTC, including Do Not Call investigations and proceedings, and acts for clients in matters before Industry Canada relating to regulation and access to radio frequency spectrum, satellite orbital slots and equipment certification.
Drawing on her symposium presentation, Leslie responded to the common questions many clients have about CASL:
When is CASL Expected to Take Effect?
The Act itself was enacted at the end of 2010. People have been saying ever since that its entry into force is imminent. We really do think that the legislation is likely to come into force later this year or next year. The lengthy delay is a result of the significant negative commentary Industry Canada received when it published an initial set of regulations which defined some terms in CASL and established some exemptions from the requirements of the Act. Industry Canada went back to the drawing board and released revised draft regulations early in January of this year. There was a short 30-day comment period, which drew far less criticism than before, so it does seem likely that this set of regulations will be finalized later this year. CRTC regulations have been in place for some time.
What Impact Will CASL Have?
CASL covers three different types of activities:
- First, subject to limited exceptions, CASL prohibits the sending of a commercial e-mail unless the recipient has provided express or implied consent to receiving the e-mail and the message satisfies specified content requirements. The content requirements include name and contact information for the sender as well as any other person on whose behalf the message is sent, and an unsubscribe mechanism. Further details concerning the required information and functionality of the unsubscribe mechanism are specified in CASL and CRTC regulations.
- Second, CASL prohibits the alteration of transmission data such that the message is routed to a different or additional address without the express consent of the sender or intended recipient.
- Third, CASL prohibits the installation of computer programs without the express consent of the owner of the computer system or an authorized user.
CASL also amends the Competition Act to extend existing criminal and civil provisions dealing with false and misleading representation in the promotion of products or services to expressly cover online and email representations, including information in email headers.
Finally, CASL amends the PIPEDA – the Personal Information Protection and Electronic Documents Act – which is our federal privacy legislation to include prohibitions on the collection of personal information through accessing a computer system in a manner that contravenes federal law.
What Exactly is Express or Implied Consent?
Express consent means the recipient has voluntarily opted in and this consent is documented. To be valid, the request for consent must set out the purposes for which the consent is being sought and identify the person who is seeking the consent and, if different, the person on whose behalf the consent is being sought.
There are three categories of implied consent. Consent will be implied if there is an “existing business relationship” between the sender and the recipient and also if there is an “existing non-business relationship” between the sender and the recipient. These are defined terms in CASL and these forms of consent are time-limited. Consent can also be implied if the recipient has, through “conspicuous disclosure or publication,” disclosed his or her email address without indicating that he or she does not wish to receive a commercial email. On this basis, the publication of an email address on a corporate website or handing out business cards that bear an email address may be considered forms of implied consent.
How Should I Prepare?
When in force, CASL will prohibit unsolicited commercial emails asking a recipient to opt-in to the receipt of commercial email from the sender. In other words, you won’t be able to send an email seeking express consent, unless the sender can establish implied consent. The circumstances in which implied consent will exist are limited both in terms of the types of relationships that give rise to implied consent and in time. While it is likely there will be a grace period between when the Industry Canada regulations are finalized and CASL comes into force, organizations are advised to start the process of obtaining express consents now.
There are of course various limitations, exceptions and time constraints that are too much to cover in the space we have here. The best defence, as always, is consulting with expert legal counsel.
What Are the Penalties for Non-Compliance?
“Administrative monetary penalties,” or fines, can total as much as $1 million per violation for an individual and up to $10 million per violation for anyone else. The CRTC can already levy penalties of up to $1,500 and $15,000 per violation for individuals and corporations respectively under Do Not Call List rules, and we have seen an increasing willingness on the part of the CRTC to seek significant penalties due to the significant number of violations that can result from a single calling, or, in CASL’s case, email campaign.
Any “affected” person can also bring a private right of action seeking compensation for damages or loss as well as for statutory damages. This applies to the amended PIPEDA and Competition Act provisions, as well as to the activities that are regulated by CASL.
Statutory damages can also add up. For commercial electronic messages, the maximum is $200 per violation, up to $1 million per day. This could create fertile territory for class-action plaintiff lawyers.
Ultimately, organizations sending commercial electronic messages face significant potential liability. They must be aware of the rules and implement compliance programs. If mistakes happen, due diligence is a defence. A credible and comprehensive compliance program should go a long way toward establishing due diligence.