Canadas Anti-Spam Legislation (CASL) August 19, 2014 Presented by: - PowerPoint PPT Presentation

Canada’s Anti-Spam Legislation (“CASL”) August 19, 2014 Presented by: Dina L. Maxwell Associate Lawyer, Blaney McMurtry LLP Blaney McMurtry LLP - 2 Queen Street East, Suite 1500 - Toronto, Canada www.blaney.com

Summary of Presentation 1. Overview of CAS L; 2. Key exclusions from s. 6 requirements; 3. Explanation of implied consent; 4. Consequences for infringement (administrative penalties; private rights of action); and 5. Compliance strategies.

Overview • Maj ority of CAS L came into force on July 1, 2014. • Applies to all “ commercial electronic messages (CEMs) sent from or received in Canada - including emails, text messages, and instant messages – that promote or encourage commercial activity on the part of the recipient, whether or not there is an expectation of profit (s.1). • “ electronic message” – a message sent by any means of telecommunication, including text, sound, voice or image (s.1(2)). • Does not include CEMs that are “ interactive two-way voice communications” , “ sent by means of facsimile or telephone account” or “ is a voice recording sent to a telephone.” (s. 6(8)).

Section 6 Requirements 1. Consent • The recipient must consent to receiving the CEMs before the CEM is sent. • Consent must be explicit (e.g. obtained via opt-in, rather than opt-out basis), unless one of the exceptions for implied consent applies to the situation. o Consumers can consent by signing or ticking a box, but not by a disclaimer that indicates that silence will be interpreted as acceptance, or using mechanisms such as an unchecked opt-out box or pre-checked opt-in box. o Explicit consent can be given verbally, but keep records to prove that such consent was provided. • The purposes for which the consent is being sought must be made clear to the consumer.

Section 6 Requirements (Continued) 2. Identity of Sender • CEM must contain information identifying the name of the sender and its contact information (email, address, telephone number, website, etc.). • If the message is being sent on behalf of a company by a third-party, the third-party must identify on whose behalf they are sending the message.

Section 6 Requirements (Continued) 3. Unsubscribe • CEM must contain a mechanism through which the recipient can, at no cost, ‘ unsubscribe’ from receiving future communications from the sender. • Once the ‘ unsubscribe’ mechanism is engaged, the sender has 10 days in which to remove the recipient from its lists (s. 11(3)).

Exclusions to Section 6 Requirements  Family or friends (s. 6(5)(a)/ R.(2));  Co-workers - CEMs between employees of the same organization (R. 3(a)(i));  Business to business relationships – CEMs between employees at one company emailing employees at another company, if the companies have a relationship and the message concerns the activities of the organization to which the message is sent (R. 3(a)(ii));  Requests or complaints – CEMs responding to a request or complaint from the recipient (R. 3(b));  Legal – CEMs sent per legal right, obligation or enforcement (R. s. 3(c));

Key Exclusions to Section 6 Requirements (continued)  Electronic message service - CEMs sent on an electronic messaging service if the information and unsubscribe mechanism required under s. 6(2) are conspicuously published and readily available on the user interface through which the message is accessed, and the person to whom the message is sent consents to receive it either expressly or by implication (R. (3)(d));  Limited access secure accounts - CEMs sent to a limited-access secure and confidential account to which messages can only be sent by the person who provides the account to the recipient (R. (3)(e));  Foreign S tate - CEMs sent where sender reasonably believes CEM will be accessed in a foreign state that is listed in the S chedule and CEM complies with the law of the foreign state (R. 3(f));

Key Exclusions to Section 6 Requirements (continued)  Registered Charity - CEMs sent by or on behalf of a registered charity as defined in the Income Tax Act , and the message has the primary purpose of raising funds for the charity (R. (3)(g));  Political Party - CEMs sent by political parties or organizations or candidates to solicit contributions (R. 3(h)); and  Requests for information - CEMs solely consist of a request for info regarding the recipient’ s commercial activity with the sender of the CEM (s.6(5)(b).  **None of the above are subj ect to CAS L requirements**.

Implied Consent (existing business relationships) • Existing Business Relationships • An “ existing business relationship” exists if (s. 10(10) to (12)): • Recipient bought, bartered, or leased goods or services from sender in the last 2 years; • Recipient accepted business, investment or gaming opportunities from sender in the last 2 years; • Written contract between the sender and recipient for anything not mentioned in the above bullets, exists or expired within the last 2 years; or • S ender is responding to an inquiry by the recipient about anything mentioned above within 6 months before the CEM is sent.

Implied Consent (“non-business relationships”)  Existing non-business relationship exists if(s.10(9)(a), s. 10(13)):  S ender is a charity or political organization and the recipient has made a donation in the last two years;  S ender is a charity or political organization and the recipient has volunteered in the last two years; or  S ender is a club, association or voluntary organization, the recipient is a member, or was a member, within the last two years.

Implied Consent (“non-business relationships”)  “ Club, association or voluntary organization” : a non-profit organization organized and operated exclusively for social welfare, civic improvement, pleasure or recreation or for any purpose other than personal profit.  No part of the organization’ s income can be payable to any proprietor, member or shareholder, unless that proprietor, member or shareholder is an organization whose primary purpose is the promotion of amateur athletics in Canada.

Implied Consent (Continued) Other instances where consent will be implied:  Recipient has conspicuously published their address without stating "no CEMs" and message related to recipient's business function (s.10(9)(b)).  Recipient has given electronic address to sender, without stating "no CEMs" and message related to recipient's business function (s.10(9)(c)). Where consent is implied, senders must still comply with the remaining s. 6 requirements, namely the content requirement including the unsubscribe mechanism and identity of the sender.

Implied Consent (continued)  Reg. (4)(1): Consent is not required for the first CEM that is sent for the purpose of contacting the individual to whom the message is sent following a referral by any individual who has an existing business or non-business relationship, or a family or person relationship, with sender and recipient.  CEM discloses the full name of the individual who made the referral and states that the message is sent as a result of the referral.  S ender should still include unsubscribe and identity of sender information.

Implied Consent (continued) Examples  Business card received at an event: A contact providing you with their business card (without indicating a wish not to receive unsolicited CEMs – implied consent.  Contact information found online (company website, social media etc.): You can send CEM to a recipient who has conspicuously published electronic address, provided that there is no statement that the person does not wish to receive unsolicited CEMs and the message is relevant to the person’ s business, role, functions or duties.  S ocial Media: Broadcasting on one’ s own network or wall is not covered, direct messages sent through social media platforms such as Twitter, Facebook, InMail messages on LinkedIn, etc. are subj ect to CAS L. Consent, identification and unsubscribe requirements must be met.

Infringement • Includes administrative penalties and private rights of action. • Up to $1 million per violation for individuals, and $10 million per violation for corporations (s.20). • Administrative monetary penalties will be issued and enforced by the CRTC. • July 1, 2017: private rights of action come into force. • Compensation (s.51) for actual loss and a maximum of: • $200 per contravention up to $1 million per day for violations of s. 6 of CAS L

Compliance Strategies Transition Period • S . 66 provides for a three-year transition period after the Act comes into force for implied consent for existing business and non- business relationships (as defined in s. 10). • Definitions of existing business and non-business relationships are not subj ect to the two-year and six-month limitation periods that would otherwise be applicable under the definitions of “ business” and “ non-business” relationships noted above.