AN OVERVIEW HOW WILL CASL AFFECT YOUR BUSINESS AND HOW CAN YOU - - PowerPoint PPT Presentation

CANADA’S ANTI-SPAM LAW (“CASL”) AN OVERVIEW

HOW WILL CASL AFFECT YOUR BUSINESS AND HOW CAN YOU PREPARE FOR IT?

Diane Karnay Wednesday June 18, 2014

Introduction

2

 Most provisions of CASL (including those impacting the

sending of commercial electronic messages) will come into force on July 1, 2014.

 Certain sections (pertaining to computer programs and

software) will come into force on January 15, 2015.

 CASL received Royal Assent (was passed by Parliament)

• n December 15, 2010.

 The CRTC has published the Electronic Commerce

Protection Regulations (CRTC), as well as two compliance and enforcement information bulletins.

 Industry Canada’s final regulations were published on

December 4, 2013.

Intent of CASL

3

 The Industry Canada website states : “The intent of the new

law is to deter the most damaging and deceptive forms of spam from occurring in Canada.”

 The Industry Canada website further states: “Collectively,

these online threats disrupt online commerce and reduce business and consumer confidence in the online marketplace; congest networks, imposing heavy costs on network operators and users, and threatening network reliability and security; and undermine personal privacy.”

 The legislation is meant to provide a secure online

environment for business in Canada, and to combat spam emails; however, it will end up capturing a broader array

• f messages than would normally be regarded as spam.

Enforcement and Penalties

4

 The CRTC will have broad powers to investigate and impose

substantial administrative monetary penalties for violations -

• f up to $1,000,000 for an individual and up to

$10,000,000 for an organization for each violation.

 There will also be a private right of action to allow

consumers and businesses to take civil action against anyone who violates CASL.

 Corporate officers and directors can be held personally

liable for corporate violations and employers can be held liable for violations committed by their employees or agents acting within the scope of their employment or authority. Due diligence to prevent the commission of the violation is a defence.

Characteristics of CASL

5

CASL is a strict and broad piece of anti-spam legislation. CASL will:

 regulate the use of commercial electronic messages;  prohibit the installation of a computer program on any person’s

computer system without the express and informed consent of the

• wner or authorized user of the computer system;

 prohibit the alteration of ‘transmission data’ in an electronic message

without the consent of the sender or the recipient (the practice of pharming); and

 prohibit the unauthorized collection of email addresses through

automated means (address harvesting), and misleading representations in sender information, subject matter information or content of an electronic message.

Spam Reporting Centre

6

The Canadian Radio-television and Telecommunications Commission (CRTC) will have the chief enforcement responsibility under CASL and will host the spam reporting centre, which will go live on July 1, 2014.

Basic Prohibition Against CEMs

7

Section 6 of CASL contains the basic prohibition against sending “commercial electronic messages” without:

1.

consent, and

2.

compliance with certain form and unsubscribe requirements. CASL applies to the sending of CEMs by any ‘person’ – individuals or companies (both for-profit and not- for-profit).

What is a CEM?

8

A commercial electronic message (CEM) is any electronic message (email, instant message, text or similar means) which encourages participation in a commercial activity. Commercial activity does not necessarily mean an activity conducted for profit. Note that broadcast messaging (tweets and posts), will not be caught by CASL. However, sending any message via email or text over social media will be caught. Also CASL does not apply to voice or fax messages.

When is Consent Not Required?

9

 Quotes or estimates;  Messages that facilitate or confirm transactions;  Provision of warranty, recall, safety or security

information;

 Provision of information about:

• ongoing use or ongoing purchases;
• ongoing subscriptions, memberships, accounts,

loans, etc.; and

• employment relationships or benefit plans; and

 Delivery of goods or services, including updates and

upgrades.

Exemptions from CASL Regulation

10

There are certain exemptions from CASL regulation (to which neither the consent nor form and content requirements apply). They are:

 Messages sent to persons with whom the sender has a

personal or family relationship (where there has been direct, voluntary, two-way communication);

 Responses to commercial inquiries;  Messages sent to satisfy legal obligations or enforce a legal

right or obligation;

 Messages sent via a closed messaging system, such as a

proprietary system or a system where ID and unsubscribe are included on the platform;

Continuation of exemptions

11

 Internal business communications (within a

business), provided the message concerns the affairs

• f the business;

 Business to business communications, provided the

• rganizations have a relationship and the message

concerns the activities of the recipient organization;

 Messages sent by charities, when the message has

the primary purpose of raising funds for the charity and the charity is a registered charity in accordance with Canada’s Income Tax Act;

Continuation of exemptions

12

 Messages sent by political candidates or

• rganizations, soliciting political contributions;

 Messages relating to a business located or

provided outside of Canada and accessed while the recipient was visiting Canada; and

 Messages sent to a foreign jurisdiction in

compliance with their spam law.

Types of Consent

13

Consent may be either express or implied, and either written or oral. Oral consent will always carry an evidentiary burden, so it is recommended that such consent be confirmed in writing. The onus to prove consent will be on senders of CEMs.

Express Consent

14

CASL will, once in force, create an “opt-in” regime for express consent. A positive action will be required to be taken by the person providing his or her consent, such as checking a box on a web page to give consent. Also, the purposes for which consent is sought will need to be made clear. Consent will need to be sought separately for (a) sending CEMs, (b) altering transmission data in electronic messages, and (c) installing a computer program on another person’s computer.

Implied Consent

15

Consent may be implied in various circumstances, including the following:

 in an existing business relationship setting, where:

• the recipient has purchased or leased products,

goods, services or land within two years of the date the CEM was sent,

• there is a written contract with the recipient which

is currently in existence or has expired not more than two years from the date the CEM was sent, or

• the recipient has made an inquiry within the

previous six months;

Implied Consent continued

16

 in an existing non-business relationship setting, where

the recipient has made a donation or gift, or performed volunteer work or attended meetings or attained membership in the organization sending the CEM, all within two years of the date the CEM was sent;

 where the recipient has disclosed his/her address to

the sender without indicating that no commercial messages are to be sent, and the message is relevant to the recipient’s business or official capacity;

Implied consent continued

17

As a result of a grace period offered by CASL, for the first 3 years (until June 30, 2017), there will be implied consent to send commercial messages to recipients where, as of the enforcement date of the legislation, there was an existing business or non- business relationship which included the exchange of CEMs; provided the recipient does not withdraw its consent.

Difference between express and implied consent

18

Businesses and organizations who wish to rely on implied consent will need to strictly manage their lists of recipients, and keep in mind that such consent is of limited duration. Express consent will not have an expiry date. It will be necessary to manage your contact lists to ensure that you can demonstrate consent for every recipient.

Form Requirements

19

1.

CEMs will need to identify the sender and its affiliates (name and address, and telephone number, email or website).

2.

If the sender is sending the CEM on behalf of a third party, the sender must identify for whom the message is sent.

3.

The contact information must be valid for at least 60 days after the CEM was sent.

Unsubscribe Requirements

20

The unsubscribe mechanism must:

• be able to be “readily performed”, so it must be

accessed without difficulty or delay, and should be simple, quick and easy to use;

• be a no-cost mechanism; and
• allow the recipient to unsubscribe by way of the

same electronic means. The electronic address or link for the unsubscribe mechanism must be valid for at least 60 days from the date the CEM was sent.

When to Implement Unsubscribe?

21

A request to unsubscribe must be implemented without delay, and in any event no later than 10 business days after the request was sent.

Third Party Referrals

22

Anyone may refer a prospective client to another person, so long as the person referring has an existing relationship with the prospective client. The person receiving the referral may send one CEM to the prospective client, and such CEM must include the full name of the person who made the referral.

Unknown Third Parties

23

Where a recipient permits a sender to send CEMs and allows such sender to let third parties to also send them CEMs, then the sender can share that recipient’s email address with such third parties. If the recipient no longer wishes to receive third party CEMs, then the sender must let the third parties know. The recipient may withdraw consent from any one of such third parties directly, in which case such third party must inform the original sender and the other third parties.

Questions to ask:

24

 Are you sending commercial electronic messages?  To whom are you sending them, and for what

purposes?

 Is consent required or do you fall within any of the

exemptions in CASL?

 Do you have implied consent?  Should you seek express opt-in consent?  Do you comply with the form and unsubscribe

requirements?

CASL Compliance Checklist

25

 Learn about CASL’s requirements.  Get business buy-in/ownership of compliance.  Do comprehensive inventory of (i) touchpoints, (ii) existing

addresses and consent lists, and (iii) consent collecting practices.

 Identify gaps.  Develop a standard of proof of consent and retain relevant

records.

 Update templates.  Update business processes, as necessary.  Train all staff concerning CASL.  Audit compliance, and repeat!

More Questions?

26

For more information about CASL or for help with your compliance with this legislation and its regulations, please contact: Diane L. Karnay dkarnay@wvllp.ca (905) 944-2950