Many of the provisions of Canada’s law governing commercial electronic messages (CEMs) will come into effect on July 1, 2014. Colloquially referred to as Canada’s Anti-Spam Legislation (“CASL”), its purpose is to “promote the efficiency and adaptability of the Canadian economy by regulating commercial conduct that discourages the use of electronic means to carry out commercial activities…”. It has been called “the strictest anti spam legislation in the world”.
While most life sciences companies, and particularly those selling prescription drugs which have restrictions on direct to consumer advertising, are not typically involved in unsolicited mass marketing efforts, CASL applies to CEMs between businesses. Moreover, there are several relationships that a life sciences company has that need to be assessed for compliance purposes. For example, while in company to patient relationships, consents are routinely obtained, they may not specifically allow for the receipt of emails from a company given that “consent” was obtained for other purposes. Dealings with vendors will be captured although for these existing relationships consent can likely be implied. Companies using social media may also need consent, depending on the scope of activities undertaken. Existing consents with the range of parties with whom a company deals need to be considered and the gaps addressed.
While the sections dealing with both administrative penalties and private rights of action will not come into force until 2017, companies should be considering what they need to do to comply now, given that common law remedies for breaches of privacy might be immediately available as of July 1, 2014. We have prepared a decision tree that explains application of CASL to various activities, as well as the relevant exemptions, for your reference.
CASL as passed applies to all electronic communications (ie., text, sound, voice or image message). This includes not only email, but text messages, SMS, videos and telephone communications, although there is a temporary exemption for two-way voice communications between individuals, voice recordings sent to a telephone and for facsimiles. There is no indication in CASL as to when this exemption from the application of CASL will be repealed.
Consent and an existing business relationship
As of July 1, 2014, the general rule is that consent is required in order to communicate a CEM (a broadly defined term that encompasses not-for-profit commercial electronic messages as well, such as solicitations for charitable, political purposes or for clubs, associations or professional organizations as well as gaming and bartering activities). Consent may be either implied or express, and, importantly, “implied” consents are limited to those specified in the legislation.
As of July 1, 2014, consent will be implied where there is a business relationship and an email has been sent to that party in the past. However, it is important to know that as of July 1, 2017, in order to continue sending CEMs, a company must have either the recipient’s implied consent within the two years prior to the sending of the CEM or express consent. Implied consent will exist if you had an existing business relationship with the recipient within the past two years (e.g., between July 1, 2015 and July 1, 2017). In other words, as of July 1, 2017, if the company’s last transaction with a party pre-dates July 1, 2015 and becomes stale, messages sent after July 1, 2017, new consent must be obtained or the CME must benefit from other exceptions in CASL. It is important to note that CASL specifically prohibits sending a CEM in order to solicit consent although other means of communication, such as ordinary mail, may be used to do so. Practically speaking, companies need to keep track of the date of the last transaction with an intended CEM recipient.
In addition to implied consent arising from existing business relationships, consent will be implied in other circumstances. For example:
- if the email is sent to a person from whom an application or enquiry was received;
- if recipient has sent the sender their electronic address, without any restriction, and the message relates to the recipient’s business functions, role or activities;
- if the electronic address is conspicuously published, without any restriction, and the message relates to the recipient’s business functions, role or activities;
- if the CEM answers an information request;
- if the CEM facilitates, completes or confirms an already concluded commercial transaction; and
- if the CEM provides information on warranties, product recalls or safety information for a product already bought.
One of the significant requirements of the new law is that as of July 1, 2014, all CEMs will need to have available an “unsubscribe” function. A key question is how broadly the unsubscribe function should be applied. While consents are to be specific as to the purposes to which a person agrees to receive information (which could be product specific), it may well be that a recipient wishes to receive some but not all messages from a company. CASL appears to recognize this, in requiring that there be a process for a recipient to indicate “ the wish to no longer receive any commercial electronic messages, or any specified class of such messages, from the person who sent the message.” Therefore a single unsubscribe mechanism for ”bundled” categories of CEMs is not permitted.
Messages that are sent in the context of personal or family relationships are exempt from the unsubscribe requirement, as is the requirement for an unsubscribe message when sending an email to a person engaged in a commercial activity consisting solely of an inquiry or application related to that activity.
CASL allows for imposition of administrative monetary penalties, which can be substantial – up to $10 million for a company (up to $1 million for an individual). However, the legislation, in an unusual fashion, specifically notes that, “The purpose of a penalty is to promote compliance with this Act and not to punish.” A number of factors are set out in CASL as to be taken into account in establishing the appropriate penalty, including:
- the purpose of the penalty;
- the nature and scope of the violation;
- any financial benefit that the person obtained from the commission of the violation; and
- the person’s history regarding violations and conduct.
The legislation also provides that a person can enter into an “undertaking”, setting out the conduct that was in contravention of CASL, including any conditions placed upon a party which may extend to requiring payment of an amount. Notably, if an undertaking is entered into, no notice of violation may be served in connection with the act or omission. Accordingly, self-reporting in the event of a contravention could avoid a violation being issued, achieving the aim of promoting compliance rather than punishment.
Link to legislation
Link to regulations and regulatory impact analysis statement