CANADIAN CASL (ANTI-SPAM LAW) PRECEDENTS
Do you need a precedent or checklist
to comply with CASL (Canadian anti-spam law)?
We offer Canadian anti-spam law (CASL) precedents and checklists to help electronic marketers comply with CASL. These include checklists and precedents for express consent requests (including on behalf of third parties), sender identification information, unsubscribe mechanisms, business related exemptions and types of implied consent and documenting consent and scrubbing distribution lists. We also offer a CASL corporate compliance program. For more information or to order, see: Anti-Spam (CASL) Precedents/Forms. If you would like to discuss CASL legal advice or for other advertising or marketing in Canada, including contests/sweepstakes, contact us: contact.
**********
In December 2010 Canada’s new anti-spam legislation was passed (the “Anti-spam Act”) which will, when it comes into force, be one of the strictest anti-spam regimes in the world (see: Anti-spam Act). The Anti-spam Act will require express or implied consent for the sending of “commercial electronic messages” or “CEMs” and also impose form (i.e., disclosure) and unsubscribe requirements for CEMs.
The Anti-spam Act is expected to have significant impacts on companies and individuals that engage in electronic marketing, including through the use of e-mail, text messaging, instant messaging and likely social media. The Anti-spam Act will also require express consent for some other practices, including altering transmission data and the installation of computer programs on other persons’ computer systems.
The Anti-spam Act will also broaden the Competition Bureau’s jurisdiction to regulate misleading advertising in the context of electronic communications – for example, misleading representations made electronically, such as in sender information, subject matter information, electronic messages or locators. The Anti-spam Act includes amendments to the civil and criminal misleading advertising sections of the federal Competition Act (sections 52 and 74.01) and related penalty and enforcement provisions.
Failure to comply with the Anti-spam Act, once in force, will expose individuals and companies to severe penalties of up to C $1 million (for individuals) and C $10 million (for companies). The Anti-spam Act also creates private rights of action, under which actual damages may be awarded, as well as statutory damages of up to $1 million per day of non-compliance. Once in force, class actions may also be commenced.
For Parts 1 and 2 and 3 see: here, here and here.
____________________
MISLEADING REPRESENTATIONS
(ELECTRONIC & ONLINE CONTENT)
The Anti-spam Act broadens the criminal and civil misleading advertising provisions of the Competition Act and related penalty provisions to expressly include misleading representations made in the electronic and online environment.
For example, the Anti-spam Act amends the criminal misleading advertising provisions of the Competition Act to prohibit false or misleading representations made electronically, such as in sender information, subject matter information, electronic messages or locators.
Like the misleading advertising provisions of the Competition Act generally, it will not be necessary to prove that any person was actually deceived or misled. Also like the general misleading advertising provisions of the Competition Act, the general impression as well as the literal meaning will also be relevant in establishing misleading representations made in the electronic context.
UNAUTHORIZED COLLECTION OF
PERSONAL INFORMATION
The Anti-spam Act also amends federal privacy legislation (PIPEDA) to prohibit the collection of personal information by means of unauthorized access to computer systems.
COLLECTION OF ELECTRONIC ADDRESSES
Finally, the collection of electronic addresses using computer programs or using such addresses without permission (“harvesting”) will be prohibited.
This may include the collection of e-mail addresses through the use of, for example, “web crawlers” (computer programs that scan websites, usenet groups and social media websites, trolling for electronic addresses) or “dictionary attacks” (where a computer program guesses real/live e-mail addresses by methodically trying various name variations within a particular group of common e-mail domains – e.g., Gmail, Hotmail, etc.).
ENFORCEMENT
Three government agencies will be responsible for enforcing the new Anti-spam Act as follows:
1. Competition Bureau
The Bureau’s mandate will be to focus on misleading and deceptive practices and representations online, including false or misleading headers, web links and website content.
The Anti-spam Act extends the Competition Bureau’s existing jurisdiction over misleading advertising and deceptive marketing practices in Canada, which already included online advertising and marketing under the criminal and civil misleading advertising sections of the Competition Act (sections 52 and 74.01).
2. Canadian Radio-television and Telecommunications Commission
The CRTC will have primary enforcement responsibility for the new legislation and will have the power to investigate and take action, including imposing significant administrative monetary penalties, against unsolicited electronic messages (i.e., without consent), the alteration of transmission data or the installation of computer programs without consent (e.g., malware, spyware or viruses).
3. Office of the Privacy Commissioner of Canada
Finally, the Privacy Commissioner will have the power to take measures against the collection of personal information through unlawful access to computer systems (i.e., contrary to federal law, such as the Criminal Code) or electronic address “harvesting”, where bulk e-mail lists are compiled through mechanisms, including the use of computer programs that automatically mine the Internet for e-mail addresses.
PENALTIES
Administrative Monetary Penalties
Persons or companies contravening the Anti-Spam Act will be subject to “administrative monetary penalties” (essentially civil fines or “AMPs”) of up to C $1 million per violation for individuals and C $10 million per violation for corporations.
Private Actions
Private individuals or organizations affected by a violation of the Anti-spam Act will also have a right to commence private actions.
In this regard, in addition to allowing awards of damages for actual loss or damage suffered a court may also order persons that contravene the Anti-spam Act to pay statutory damages for each day on which a contravention occurred – for example, for violation of section 6 (the unauthorized sending of CEMs) C $200 for each contravention up to a total of C $1 million per day.
Class Actions
Class actions will also be possible once the Anti-spam Act is in force.
Director and Officer Liability
The Anti-spam Act contains broad director and officer liability provisions, which provide that directors and officers of a company that commits a violation are liable for that violation if they “directed, authorized, assented to, acquiesced or participated in” a violation.
This potential liability will be subject to a due diligence defense.
********************
Tips For Complying With
CASL (Canadian Anti-Spam Law)
Canada’s federal anti-spam legislation (CASL) came into force in 2014. Since then, electronic marketers and their advisors have been working to comply with what remains a complex law with outstanding uncertainties in some key areas. Having said that, many of the core requirements of CASL are not overly difficult to comply with (though still continue to be misunderstood in many cases).
The following are some key legal tips for complying with CASL:
Express Consent. If you cannot rely on any category of implied consent (e.g., an existing business relationship within two years of a purchase) or a CASL exemption, ensure that you have collected and documented express consent from recipients. Express consent requests must include all of the information set out in CASL and its regulations otherwise the consent will not be valid. The failure to correctly collect consents is the top CASL compliance issue we see and a key basis for CRTC enforcement. For more information, see: Anti-Spam Law (CASL), Anti-Spam Law (CASL) FAQs and Canadian Anti-Spam (CASL) Precedents.
Implied Consent. If you are relying on one or more categories of implied consent to send commercial electronic messages (CEMs) (e.g., an existing business relationship within two years of a purchase or six months of a product inquiry) ensure that all of the requirements of the particular type of implied consent are met. Remember that there is not a single blanket type of implied consent under CASL, but rather many different kinds of implied consent each of which with their own specific requirements. Also, as with express consent, CEMs that rely on implied consent must still include the prescribed sender identification information and unsubscribe mechanism. For more information, see: Anti-Spam Law (CASL), Anti-Spam Law (CASL) FAQs and Canadian Anti-Spam (CASL) Precedents.
Consent For Third Parties To Send CEMs. Under CASL, consent to send CEMs can be requested for a sender themselves, an identified third party (or multiple identified third parties) or unidentified third parties (i.e., entities whose identities are not yet known when consent is requested). Importantly, however, each type of consent request has specific requirements for the request and, in the case of consent requests on behalf of unidentified third parties, somewhat complex additional requirements. The failure of marketers to correctly request consent for third parties (e.g., partners, affiliates, co-sponsors in promotions, etc.) is another of the most frequent CASL-related error that we regularly see. For more information, see: Anti-Spam Law (CASL) FAQs and Canadian Anti-Spam (CASL) Precedents.
CASL Exemptions. Like implied consent, there isn’t a single exemption from CASL but many types of exemptions. If you are relying on a particular exemption (e.g., the “business-to-business” exemption) it is important to ensure that all of the requirements of the exemption are met. Importantly, there is little or no case law interpreting many of the CASL exemptions. This means that there is generally more potential risk relying on an exemption than express consent. Express consent is the strongest under CASL and does not expire unless a recipient unsubscribes.
Passive Consents. Remember that under CASL express consent or a category of implied consent is generally required to send CEMs unless a CASL exemption applies. As such, passive types of consents (e.g., language in general terms and conditions) will not be CASL compliant unless a sender does not need express consent (i.e., can rely on a category of implied consent or a CASL exemption).
Sharing Lists With Third Parties. Consider the potential risks of sharing e-mail or other electronic marketing lists with third parties. While this is certainly possible under CASL, marketers need to be aware that there are specific requirements that must be met depending on who a list will be shared with (e.g., to expressly identify a third party with whom consent is being gathered on behalf of, including their contact information and other requirements for unidentified third parties). Marketers should also be aware that there is also potentially not only risk if they themselves violate CASL (e.g., send CEMs without consent), but also if they assist a third party that violates CASL. As such, it is often prudent for marketers that want to share electronic marketing lists with third parties to ensure that they have list sharing agreements in place with parties with whom they share e-mails. For more information, see: Anti-Spam Law (CASL) FAQs, Anti-Spam (CASL) Compliance Errors and Canadian Anti-Spam (CASL) Precedents. See also: Influencer, Co-Sponsor and List Sharing Agreements.
Sender Identification Information. Ensure that all CEMs include the prescribed sender identification information required by CASL unless an exemption applies. For more information, see: Anti-Spam Law (CASL) and Anti-Spam Law (CASL) FAQs.
Unsubscribe Mechanism. Ensure that all CEMs include a CASL-compliant unsubscribe mechanism. For more information, see: Anti-Spam Law (CASL) and Anti-Spam Law (CASL) FAQs.
Document Consent. Under CASL, the onus is on senders of CEMs to document consent. As such, it is important to document the type of consent (express or implied) or exemption being relied upon, evidence of consent (e.g., subscription logs, forms, dates and names/e-mail addresses), divide lists according to the type of consent or exemption being relied upon and to scrub lists after recipients have unsubscribed or the relevant time period for a category of implied consent has expired (e.g., two years after a purchase). The failure to adequately document consent is another of the most common CASL-related compliance errors we see, including not documenting consent at all, not segregating distribution lists and inadequately documenting consents or types of implied consent. For more information, see: Anti-Spam Law (CASL), Anti-Spam Law (CASL) Compliance and Canadian Anti-Spam (CASL) Precedents.
CASL Compliance Program. Consider adopting a CASL compliance program, particularly if electronic marketing is a core aspect of your marketing strategy. The CRTC has issued guidance on CASL compliance programs including key recommended elements. For more information, see: Anti-Spam (CASL) Compliance and Canadian Anti-Spam (CASL) Precedents.
CASL and Specific Types of Promotions. Care should be taken in relation to specific types of promotions under CASL. Just one of many examples is friends and family type promotions (e.g., contests where entrants can gain more entries for sharing with or tagging a friend). While there is an exception to the unsolicited CEMs section of CASL (section 6) for messages sent to a person with whom the sender has a personal or family relationship, these terms are very specifically defined. For example, “family relationship” is limited to spouses, common-law partners and parent-child relationships. “Personal relationship” is defined in a multi-factor and case-by-case fashion, such that it is often impractical to rely on this exception for any broad “friends and family” type promotion. Marketers should also be aware that there is potential risk for both themselves and their clients in running friends and family type promotions, if they cannot meet the specific definitions of “family relationship” and/or “personal relationship” under CASL for a promotion. For more information, see: Anti-Spam (CASL) Compliance Errors and Running a Friends-and-Family Promotion in Canada? Cruel, Cryptic CASL Strikes Again.
____________________
SERVICES AND CONTACT
I am a Toronto competition/antitrust lawyer and advertising/marketing lawyer who helps clients in Toronto, Canada and the US practically navigate Canada’s advertising and marketing laws and offers Canadian advertising/marketing law services in relation to print, online, new media, social media and e-mail marketing.
My Canadian advertising/marketing law services include advice in relation to: anti-spam legislation (CASL); Competition Bureau complaints; the general misleading advertising provisions of the federal Competition Act; Internet, new media and social media advertising and marketing; promotional contests (sweepstakes); and sales and promotions. I also provide advice relating to specific types of advertising issues, including performance claims, testimonials, disclaimers, drip pricing, astroturfing and native advertising.
For more information about my services, see: services
To contact me about a potential legal matter, see: contact
For more regulatory law updates follow me on Twitter: @CanadaAttorney
