Canada’s new anti-spam law (“CASL”, S.C. 2010, c. 23), due to come into force in July 2014, will bring a considerable change in the way commercial electronic messages (spam) sent by businesses are handled.
CASL’s main purpose is to prohibit outright the sending of spam in the course of a commercial activity, unless the recipient’s consent has been obtained (subject to exceptions). As well as applying to any organization or person making use of commercial electronic messages, CASL will also apply to businesses that take part in altering transmission data, or that produce or install computer programs.
Summary of the main provisions
- An organization and its employees are prohibited from sending a commercial electronic message (email, SMS, and so on), or permitting one to be sent, unless the recipient has consented and the message complies with the rules set out in s. 6. A message containing a request for consent to send such a message is itself also treated as a commercial electronic message (s. 1(3)).
- A commercial activity is any particular transaction, act or conduct, or any regular course of conduct, that is of a commercial character, whether or not the person carrying it out does so in the expectation of profit (s. 1(1)).
- A commercial message is defined in CASL as an electronic message which, having regard to its content, the content of any website or other database to which it gives access by hyperlink, or the contact information it provides, it would be reasonable to conclude has as its purpose, among others, to encourage participation in a commercial activity, including any electronic message that, as the case may be: (a) offers to purchase, sell, barter or lease a product, goods, a service, land or an interest or right in land; (b) offers a business, investment or gaming opportunity; (c) advertises or promotes anything referred to in paragraph (a) or (b); and (d) promotes a person, including that person’s public image, as being a person who does, or intends to do, any of the acts referred to in paragraphs (a) to (c).
- For a message not to be treated as a commercial electronic message, it must be free of any content soliciting participation in a commercial activity. CASL excludes from its application messages sent to persons with whom there is a personal or family relationship, messages whose sending is permitted by regulation, and messages concerning an enquiry – such as a request for information – relating to commercial activities (s. 6(5)).
- The Act will also prohibit sending false or misleading representations and harvesting email addresses using computer programs.
- Organizations are responsible for the acts of their employees within the scope of their authority (s. 32, s. 53). Liability falls on officers, directors or agents where they direct, authorize, assent to or participate in a prohibited act (s. 31, s. 52). A person is not liable for a violation of the Act if that person proves they exercised due diligence to prevent it (s. 33, s. 54). The monetary penalties are very severe, running up to $1 million for an individual and $10 million for anyone else (s. 20(4)).
Starting to prepare
Until the new Act comes into force, organizations should prepare and take certain steps (here are a few suggestions):
- Inform all employees of the risks attached to organizational practices that do not comply with CASL, and of the procedures to follow for handling consents and opt-outs (N.B. the measures an organization has implemented matter if it becomes the subject of a complaint under CASL).
- Implement a mechanism allowing recipients to opt out of receiving spam.
- Put in place a system that records consents to spam.
- Make sure the electronic messages to be sent contain all the information CASL prescribes.
- Designate someone responsible for applying CASL.
Given the complexity of applying these new provisions and the severity of the monetary penalties, it is essential that organizations prepare properly. Note, however, that they will have a three-year transition period beginning when the Act comes into force, and that the private right of action will not take effect until July 2017*.
*See sections 47 and 66 of Canada’s anti-spam legislation.