Canada’s new anti-spam legislation casts a wide net

From Facebook to Twitter to YouTube to LinkedIn, sending electronic communications to others through the use of social media is becoming a central tenet of doing business. At the same time, the increasing use of social media has also contributed to the ongoing problem of “spam.”

Spam has become the vehicle for a wide range of commercial online threats that affect individuals and businesses. In an attempt to address the problem, new anti-spam legislation will take effect in Canada on July 1, 2014, introducing one of the most onerous pieces of legislation surrounding the regulation of commercial electronic messaging. In recognition of the fact that Canada ranks as one of the highest originating sources of spam in the world,[1] Canada’s anti-spam legislation (“CASL”) is intended to deter damaging and deceptive forms of spam from occurring in Canada. However, its broad scope and onerous compliance issues, coupled with severe monetary penalties for breaching its provisions, have serious implications for businesses.

Broad applicability

The new law will affect any individual, business and organization that: (1) makes use of “commercial electronic messages”; (2) is involved with the alteration of transmission data; or (3) produces or installs computer programs. A “commercial electronic message” is defined as “any electronic message that encourages participation in a commercial activity, regardless of whether there is an expectation of profit”.[2]  The scope of CASL is not limited to activities in Canada. This means that businesses located outside of Canada that send messages to computers located in Canada or install computer programs on devices in Canada will also be subjected to CASL requirements.

The broad definition of “commercial electronic message” will likely apply to almost all electronic messages sent for a commercial purpose. This means that many everyday business activities will now be subject to detailed legislation, including activities such as marketing campaigns, sending email messages to customers and making mobile apps available for download. It would also seem to capture business activities that are communicated through the use of any social media outlet.

Onerous compliance provisions

At the heart of CASL is the requirement that businesses and individuals obtain “express consent” prior to engaging in any activities falling under the purview of CASL. Therefore, unlike “opt-out” type consent procedures governing anti-spam legislation in other countries, CASL requires that the recipient “opt-in” before receiving the communication.

For commercial electronic messages, CASL will require businesses to: (1) obtain consent from the recipient before sending the message; (2) include information that identifies the sender; and (3) enable the recipient to withdraw consent by unsubscribing to the communications.[3] As a result, all businesses will require significant changes to their existing technology practices to avoid the new penalties under CASL.

Severe monetary penalties

The Canadian Radio-television and Telecommunications Commission (CRTC) will have power under Canada’s new anti-spam legislation to enforce its provisions. For example, individuals can be liable for up to $1 million per violation and businesses can be liable for up to $10 million per violation. In addition, a Private Right of Action provision will come into force on July 1, 2017, which will allow individuals who are subjected to “spam” to sue other individuals and businesses for violations of CASL.[4]  This, in turn, could lead to a dramatic increase in class action suits against individuals and businesses that are found to be in violation of CASL.

Future action

In order to address the new challenges facing businesses in the post-CASL era, it is important for businesses to develop new compliance plans to ensure that all of their electronic communications are compliant with CASL. For example, businesses should review their existing policies and identify how their organization can be compliant with CASL. Ongoing compliance will require ongoing monitoring and review of existing policies. The broad scope of electronic communications that can trigger the CASL provisions will require individuals and businesses to scrutinize their existing practices to ensure compliance with CASL and avoid the severe monetary penalties for breaches of the new legislation. It remains to be seen how the new anti-spam legislation will cope with the increasing rise of social media and the new technological advances in electronic messaging.