Rob Aske
Rob Aske, Stewart McKelvey
 

Legislation comes into effect July 1, 2014

You have probably heard about Canada’s Anti-Spam Legislation (CASL).  Indeed it comes into force for the most part on July 1, 2014.  What does it mean for your business?

In terms for commercial electronic messages (CEMs) which consists of emails, texts and other messages, the basic prohibition under the law is that any such messages which encourage participation in commercial activity can only be sent if you have the consent of the recipient, and certain content is included in a message including contact information, and an unsubscribe function.  The unsubscribe function must be able to be “readily performed”, and must be valid for 60 days after the message is sent.

While it is not yet clear exactly where the threshold for encouraging participation in commercial activity will lie, it is fair to assume that if the message directly or indirectly encourages the purchase of your products or services, then you should give the new law careful consideration.

You should also be aware that penalties can be $1 million for individuals and $10 million for companies, and directors and officers can be liable for the acts of their employees.  But a due diligence defence is available if you can show your business had policies and practices to ensure compliance.

Exceptions

There are many important exceptions to the applicability of the new law.  Some of these exclude the application of the law entirely, and others simply provide relief for the requirement of express consent.

Exceptions where the law does not apply to CEMs

The most important exceptions in this category are as follows:

Business to business communications:  The law does not apply to CEMs sent between different organizations (including their respective employees, representatives and consultants) provided the organizations have a relationship, and the CEM concerns the activities of the organization to which the message is sent.  The nature of the “relationship” is not defined under the law, and will hopefully be broadly interpreted.  As long as any two organizations have an ongoing relationship, this provides a very broad exception.

Charities:  Another important exception is for charities, so that a CEM sent by a registered charity which has the primary purpose of raising funds is not subject.

Other important exceptions where the law does not apply are included for family and personal communications, responses to commercial inquiries, internal business communications, legal communications, social networking services, limited access secure systems (such as banking) and political party solicitation.

Consent exceptions

Other critical exceptions are available where the sender is deemed to have implied consent.  In this situation, the email must still include the form requirements with contact information and the unsubscribe mechanism.  But there is no need to have express consent in hand.

The first exception providing implied consent is where the sender and recipient have an “existing business relationship”, which is generally defined so that within the last two years there has been a purchase of products or services or the acceptance of a business or investment opportunity, or within the last six months there has been an inquiry from the CEM recipient to the sender in respect of such transactions.  This existing business relationship exception is essentially a retail type exception, so that businesses which deal with individuals from time to time can track the most recent relationships, and will have implied consent to continue to communicate with individuals on this basis.

There is also a similar existing non-business relationship exception providing implied consent, if within the last three years there has been a donation of time or money to a registered charity, political party, organization or candidate, or, membership in a club, association or volunteer organization.

The existing business and existing non-business relationship exceptions database systems to track these time periods.

There is also a critical grace period, where for the first three years under the Act, there is implied consent to send CEMs to individuals if at any time in the past there has been an existing business or non-business relationship, which included communication by electronic messages.  This provides businesses with broad latitude to reach out to their contacts and to use that opportunity to seek express consent if they wish.

The other important exception for implied consent applies if a recipient has conspicuously published their email address, or has disclosed their address to the sender, without indicating that they do not wish to receive unsolicited CEMs, and the CEM that is sent is relevant to their business, role, function or duties in a business or official capacity.  This is a very important exception for many businesses which provide services to other businesses.

Note that implied consent can be explicitly revoked, so that one cannot rely on the exceptions providing implied consent if the recipient has explicitly indicated that they do not wish to receive CEMs.

Other exceptions for consent

There are other exceptions where neither express nor implied consent is required, and many of these are obvious such as the following:

  • Providing a quote or estimate requested by the recipient.
  • Facilitating a commercial transaction that the recipient agreed to enter.
  • Providing warranty, safety, recall or security information about a product or service purchased by the recipient.
  • Providing notice of factual information about an ongoing subscription, membership, account, loan or similar relationship.
  • Providing information directly related to a current employment relationship or benefit plan.
  • Delivering a product, good or service, including updates and upgrades, further to an existing relationship.

There is also a specific exception for the use of third party referrals, where a single message may be sent to a recipient without consent based on a referral by a third party, provided that third party has a relationship (business, family, personal or non-business) with the sender and the recipient.  The CEM must disclose the full name of the referring person and that the message was sent as a result of the referral.

If your organization works through these exceptions carefully, and reads the fine print as necessary, then you may find there are very reasonable ways to deal with Canada’s new anti-spam law.

Please see our guide to the new law at www.stewartmckelvey.com/getready.

*****

Rob Aske is a partner with the law firm Stewart McKelvey, in its Halifax office. Rob maintains a diverse commercial practice largely related to intellectual property, information technology, entertainment, media and privacy. He is a trade-mark agent, and teaches Entertainment Law at Dalhousie University.