Canada’s New Anti-Spam Legislation What you need to know to comply
Gowlings at a glance • Over 700 professionals across 10 offices worldwide • Recognized expertise in business law, advocacy and intellectual property law • Dedicated privacy practice group 2
Gowlings at a glance www.gowlings.com/casl 3
Overview • CASL is federal legislation that comes into force on July 1, 2014, which prohibits: • Sending of “commercial electronic messages” without consent, • Collection or use of electronic addresses without consent (“harvesting addresses”), • Installation of computer programs without consent (coming into force Jan 1, 2015). • Rules relating to the sending of CEMs center on (2) pillars: • Unless the CEM is exempt, there must be express or implied consent to receive a CEM, • The CEM must meet certain content requirements, including an unsubscribe. 4
What is not a CEM? • Interactive two-way voice communications • Messages sent via facsimile to telephone accounts • Voice recordings sent to a telephone account 5
What is a CEM? • A message sent by any means of communication… • email, SMS • voice, sound • image • To an electronic address • email account • instant message account • telephone account • any similar account 6
When is a message “commercial”? • When one of its purposes is the encouragement of commercial activity. • It is irrelevant whether or not the CEM was sent in an expectation of profit • Consider the message content, links in the message and contact information in the message 7
When is a message “commercial”? • Advertisements for goods or services are commercial • Messages that promote a person as someone who offers or intends to offer goods or services are commercial • Messages that seek consent to send further messages are commercial 8
Exceptions to the need for consent CASL creates an exception to the need for consent for certain “transactional” messages. This exception will apply to messages that solely: • Provide a quote or estimate for the supply of a product or service; • Facilitate, complete or confirm a previously agreed upon commercial transaction between the sender of the message and the recipient • Provide warranty information, product recall information or safety or security information about a product or service the recipient has purchased • Provide notification of factual information about the ongoing use by the recipient of a product or service offered under a subscription, membership, account, loan or similar relationship 9
Exceptions to the need for consent (cont.) CASL creates an exception to the need for consent for certain “transactional” messages. This exception will apply to messages that solely: • Provide information directly related to an employment relationship or related benefit plan in which the recipient is currently involved/participating; • Deliver product/services, including updates/upgrades, pursuant to a pre-existing agreement It is essential to note that these messages are only exempt from the consent requirements, they are not exempt from the in message disclosure, including the unsubscribe mechanism. 10
In-message disclosure requirement exemptions Which messages will be exempt? Messages sent by or “on behalf” of a person with a “family” or “personal” relationship with the message recipient are exempt from the consent and message content requirements. “Family” or “Personal” relationship are defined terms: “Family” “Personal relationship” Marriage; Must have had direct, voluntary A common-law partnership; two way communications; A legal parent/child relationship; Must be reasonable to conclude where: the relationship is personal Those persons have had a considering relevant factors such direct voluntary two way as shared interests, opinions, communication. and experiences. 11
In-message disclosure requirement exemptions The regulations provide exceptions for the following message classes: • Messages sent between employees of an organization relating to the affairs of the organization • Messages sent between employees of two organizations with a relationship, where the message relates to the activities of the recipient • Messages that respond to an inquiry, complaint, or other solicitation from the recipient • Fundraising messages sent by or on behalf of a registered charity 12
In-message disclosure requirement exemptions The regulations provide exceptions for the following message classes: • Messages where the person sending the message reasonably expects it to be received in a foreign state listed in the Regulations, if the message complies with the law of that state • Messages sent to a secure account to which only the person providing the account may send messages • Messages sent on a platform that includes compliant disclosure and an unsubscribe mechanism in its interface are exempt from the message requirements, but not the consent requirements. • Messages sent to satisfy a legal obligation, to enforce a legal right, to notify of a legal right 13
Referrals • The regulations allow a single CEM to be sent once to a person if: • The recipient was referred to the sender of the message • The person who gave the referral has an existing business relationship, family relationship or personal relationship with both the person that they referred, as well as the sender of the message • The full name of the person who gave the referral is disclosed in the message, and the message states that it is sent pursuant to the referral NOTE: the sender of the CEM can ask for express consent to send CEMs within the single message, but if express consent is not given, the sender cannot send additional CEMs 14
Implied consent • Implied consent to send CEMs arises when: • The message recipient has (1) conspicuously published his/her electronic address, (2) without indicating that he/she does not wish to receive CEMs, and (3) the CEM is relevant to the recipient’s business, role, function or duty in a business or official capacity • The message recipient has (1) given his/her electronic address to the sender, (2) without indicating that he/she does not want to receive CEMs, and (3) the CEM is relevant to the recipient’s business, role, function or duties in a business or official capacity • The sender and recipient of the CEM have either an “existing business relationship” or an “existing non -business relationship, as defined in CASL 15
“Existing Business Relationship” • CASL defines (3) circumstances in which an “existing business relationship” arises: • Where the recipient of the CEM has purchased or leased a product or service from the sender within the (2) years prior to sending the CEM • Where the sender and recipient are parties to a written contract, which expired within the (2) years prior to sending the CEM • Where the recipient of the CEM made an inquiry or application about a purchase or lease of a product or service within the previous 6 months before the CEM is sent Note: to rely on implied consent, you must have systems that allow you to track expiry dates. 16
Transition period • CASL includes a transition period arising from “an existing business relationship” • If the relationship existed before July 1, 2014, and had involved the sending of CEMs as part of the relationship, CEMs can be sent to the recipient for a (3) year period after the July 1, 2014 coming-into-force date (i.e., June 30, 2017), unless the recipient indicates that they don’t want to receive the message Note: the message must comply with the prescribed message content requirements, including the unsubscribe, which must be honoured 17
Restrictions on sending CEM • C.E.M. provisions come into force on July 1, 2014 • Prohibits sending a CEM to an electronic address unless: • Sender has the express consent of the recipient; • Sender has the implied consent of recipient or an exclusion applies; and • The CEM contains required disclosure. 18
Requirements for seeking express consent A person who seeks express consent under CASL must, when requesting consent, set out “ clearly and simply ”: • The purpose for which the consent is sought; • The name under which the person seeking consent carries on business, and if different, the name under which the person on whose behalf consent is sought carries on business; • If applicable, identify which person is seeking consent, and on whose behalf consent is sought; • Provide the mailing address, and one (or more) of a telephone number, website, or email address of either the person seeking consent, or if different, the person on whose behalf consent is sought • State that consent may be withdrawn 19
Requirements for seeking express consent • Do not use pre-checked boxes! • The CRTC takes the position that express consent must be “positive or explicit” • Other means than a check box are also acceptable provided they are “positive and explicit”. For example, entering an email address if you wish to receive emails, then hitting a “submit” button • “Assumed” consent through a pre -checked box or an opt-out box or an opt-out system will not be accepted 20
Recommend
More recommend
