CASL: What is Canadas Anti-Spam Legislation?
By Kristopher Morrison @KrisJayMorrison | June 2, 2014
Canada’s Anti-Spam Legislation (CASL) comes into effect on July 1, 2014. On July 1, 2017, the Private Right of Action section of the legislation comes into force.
Make no mistake, this legislation will affect almost all Canadian businesses. In a series of articles, we will be breaking down what CASL is, what kinds of penalities you could face, and how to best protect your business and comply with the legislation.
First, what is CASL?
Broad-reaching and packing significant penalties, CASL significantly limits the way Canadian companies and organizations send electronic commercial messages, like emails, as well as collect and use electronic addresses.
More subtly, the law also impacts things like the way software is installed and updated on computers, in an effort to curb the distribution of malware and spyware.
Most businesses understand that once the new law takes effect, they will need to change the way they collect and communicate electronically.
What CASL Encompasses
There are two aspects to CASL. The first has to do with electronic messaging, the second is software. In this article, we will address the first. (It should be noted, however, that software designers need to pay special attention to the changes taking place, as this law dramatically changes the way “additional” software can be installed on a computer.)
CASL applies to commercial electronic messages sent to any electronic address.
A commercial electronic message is a message sent by any means of telecommunication, including a text, sound, voice or image message.
This includes email, text messages, Voice-over IP phones (VOIP), digital radio, digital TV and even some aspects of how people communicate in social media.
An electronic address is an address used in connection with the transmission of an electronic message to an electronic mail account, an instant messaging account, a telephone account or any similar account.
As a result, CASL will impact the way you:
- collect and use electronic addresses, particularly in regard to communication lists,
- send messages and content in those messages, and
- manage those electronic addresses, particularly your lists.
In addition to the legislation itself, CASL also includes amendments to four other pieces of federal legislation: Personal Information Protection and Electronic Documents Act (PIPEDA), the Competition Act, the Telecommunications Act and the Canadian Radio-Television and Telecommunications Commission Act (CRTC).
- Amendments to the Competition Act will give the Competition Bureau more targeted enforcement tools to address false or misleading commercial representations online.
- Amendments to PIPEDA include addressing the use of address-harvesting and programs that collect personal information from computers.
- Amendments to the CRTC, granting the authority to impose financial penalties and creating “private rights of action.”
Explicit consent: The heart of CASL
The biggest impact CASL will have on Canadian businesses is the new requirement that, for everyone outside of your existing customer base and a few other limited contact types, you must now get explicit consent before you can send a commercial message to an electronic address.
Simply put: Unless you have done business with an individual or organization, expect that you will be required to get explicit consent under CASL.
What is explicit consent? In a nutshell, to gain explicit consent you must:
- Clearly and concisely explain what you are seeking consent for, such as adding an email address to a distribution list.
- Clearly and concisely explain who the consent is being given for.
- Have the user opt-in, by doing an intentional action such as checking a box, in order to have their electronic address be approved for use outlined in the first step above.
There is a critical difference between the opt-in and opt-out approach: under CASL, opt-in is the only acceptable approach.
Above is an example of opt-in. The checkboxes are unchecked by default, which means the user needs to choose to accept the additional changes to their software. If they were pre-checked, the options would be considered opt-out and would violate the terms of CASL.The same principles apply to signing up for newsletters and agreeing to electronic communication.
Explicit consent is forever, unless and until the other party choses to withdraw. Once they communicate the request to end such communication, all consent is withdrawn. In that respect, you must provide a way for people to easily remove consent, such as an unsubscribe button, in every message you send.
How can you tell if a person or organization has given implied consent? Implied consent is granted to those with whom you have “existing business relationships” and “existing non-business relationships.” CASL sets out the following criteria.
Existing business relationships. An existing business relationship is between two parties which have:
- Engaged in financial transactions, such as the purchase or lease of goods, services, land or interest in land in the last two-years.
- Have signed contracts still in effect.
- Have engaged in barter in the last two-years.
- If one party has made an inquiry related to any of the above within the last six-months.
Existing non-business relationships. This term is confusing because it could be interpreted to mean that there are situations where businesses may be able to send electronic commercial messages to people with whom they have no business relationship. This is not correct.
A non-business relationship exists in cases where:
- A person whom has made a donation or gift in the last two years (in the case of a charity or political group/candidate) is considered to have given implied consent.
- A person whom has performed volunteer work in the last two years (also in cases of a charity or political group/candidate) is considered to have given implied consent.
- A person whom has a membership (such as to a club, association or voluntary organization) is considered to have given implied consent
Conspicuous published electronic addresses.
When someone publishes an electronic address in a publication and does not include a statement notifying readers that the person does not wish to receive commercial electronic messages at that address, this is deemed to be conspicuous publication, which means that implied consent is granted.
For more information on consent, visit this section of the Justice Laws Website (Government of Canada).
Now that we know the basics of CASL, what should businesses do? How should companies handle unsubscribe requests? What are the fines for failing to comply? What civil actions can be taken by individuals against companies who do not comply?
In coming articles we will take a look at fines and penalities, the three-year transitional period and what that means for your business, your compliance check-list, advice from experts and more.