By Alice Tseng
Bill C-28, commonly referred to as Canada’s Anti-Spam Legislation or “CASL”, was passed by the Canadian Parliament in December 2010 and will likely come into force in 2013. This bulletin provides an overview of the anti-spam regime set out in CASL as it stands at the date of publication of this bulletin. A second Blakes Bulletin published concurrently with this bulletin, provides an overview of two recent CRTC guidance documents.
The anti-spam provisions of CASL prohibit, subject to limited exceptions, the sending of a “commercial electronic message” (CEM) unless the recipient has consented to receiving the message and the message meets certain form and content requirements. A CEM is an electronic message that has as its purpose, or one of its purposes, to encourage participation in a commercial activity. This legislation will significantly impact the electronic marketing practices of companies in Canada and foreigners sending CEMs to Canadians.
Unlike the “opt-out” regime of the CAN-SPAM Act in the United States, CASL requires that senders of CEMs obtain consent before sending the message. Further, an electronic message requesting consent to send a CEM is itself a CEM and, therefore, once CASL comes into force, such CEMs cannot be sent without prior consent. There are certain limited exemptions to the prior consent requirement where, for example, the CEM is sent solely to provide a requested quote or estimate, facilitate or confirm a previously agreed upon commercial transaction, provide warranty or safety information, provide factual information about an ongoing subscription or membership, provide information regarding an employment relationship or to deliver a product, good or service under a prior transaction. The Act also provides for the regulations to set out additional exemptions to the consent requirement. To date, no such exemptions have been set out. Such CEMs must still comply with the form and content requirements.
CASL sets out a specific set of circumstances where the consent of the recipient to receive a CEM may be implied. For example, consent can be implied where there is an existing business relationship between the sender and the recipient (such as where a consumer has made a purchase from the sender within the past two years) or an existing non-business relationship (such as membership in a club or volunteer work). The legislation sets out the exact circumstances in which an existing business relationship or an existing non-business relationship may be held to exist. Consent can also be implied where the recipient has conspicuously published his or her address (for example, on a professional website) or has disclosed his or her address to the sender and has not, in either case, indicated he or she does not wish to receive unsolicited CEMs and the CEM relates to the recipient’s business role or function. In all other instances, consent must be express.
In addition to being exempt from consent requirements, the following types of CEMs are also exempt from the form and content requirements, i.e., a CEM:
- that is sent by or on behalf of an individual to another individual with whom they have a personal or family relationship;
- that is sent to a person engaged in a commercial activity and consists solely of an inquiry or application related to that activity; or
- that is of a class, or is sent in circumstances, specified in the regulations (to date, no such circumstances have been specified).
Please refer to our April 2011 Blakes Bulletin for a more detailed discussion of the legislation.
In the summer of 2011, draft regulations were published by the Canadian Radio-television Telecommunications Commission (CRTC) and Industry Canada (IC), and were open for public consultation. The regulations published by the CRTC were finalized in March 2012. However, given the significant concerns raised during the consultation process by industry regarding the IC regulations (including concerns that the draft regulations did not sufficiently clarify obligations or exempt certain activities from being considered spam), IC will be publishing a second version of draft regulations which will likely be subject to a further public comment period before being finalized. We expect such draft regulations to include additional exemptions to both the consent and the form and content requirements. As of the date of publication of this bulletin, the second version of the draft IC regulations has not yet been published but is expected to be published imminently.
FINALIZED CRTC REGULATIONS
The CRTC regulations set out form and content requirements for both (1) requests for express consent to send CEMs and (2) the CEMs themselves. The final CRTC regulations address some of the concerns raised in the consultation period following the publication of the draft CRTC regulations. A request for express consent to send CEMs must set out clearly and simply the purpose or purposes for which the consent is being sought as well as:
- the name of the person seeking consent
- if the consent is being sought on behalf of another person, the name of the person on whose behalf consent is being sought
- a statement indicating which person is seeking consent and which person on whose behalf consent is being sought
- the mailing address and one of a telephone number providing access to an agent or voice message system, or an email address, or a web address of the person seeking consent
- a statement that the person may withdraw their consent.
Although the legislation is not yet in force, given that the CRTC regulations are finalized, where an organization has the opportunity to collect email addresses, it would be prudent to include with that collection an express request for consent to send future CEMs and to structure that request in a way that meets the form and content requirements.
The CRTC regulations also set out the form and content requirements that any CEM must meet once CASL is in force. A CEM must include:
- the name of the person sending the message
- if the message is being sent on behalf of another person, the name of the person on whose behalf the message is being sent
- a statement indicating which person is sending the message and which person on whose behalf the message is being sent
- the mailing address and one of a telephone number providing access to an agent or voice message system, or an email address, or a web address of the person sending the message or the person on whose behalf the message is being sent.
If it is not practical to include all of this information in a CEM, the required information may be posted on a readily accessible web page that is provided to the recipient of the message, free of charge, “by means of a link that is clearly and prominently set out in the message”. CEMs must also include an unsubscribe mechanism that must be “able to be readily performed” (in contrast to the requirement in the draft regulations that it be able to be performed in “two clicks”).
It is expected that once the IC regulations are finalized, there will be some period of delay before the legislation comes into force to allow companies time to bring their practices into compliance with the law.