On July 1, 2014 the much talked about Canadian Anti-Spam Legislation (CASL) comes into force. Following in the footsteps of the US, UK and Australia, the Canadian government has passed this legislation to protect both businesses and individuals from spam and online threats. These threats can include obtaining personal information through spyware or phishing, identity theft and malware such as viruses.

Is Your Business Affected?

CASL defines a commercial electronic message as "any electronic message that encourages participation in a commercial activity, regardless of whether there is an expectation of profit." This means that if you use email, phone, text or instant message to market your business then this law applies. 

It does not apply to all of social media, for example broadcast tweets, Facebook and LinkedIn posts are exempt, however if you direct message your followers, this will be included under the law.

The law focuses on the originator of the message. Therefore as a Canadian business owner, all messages sent will be applicable no matter the country the recipient is located.  

How to Comply with CASL

Consent under CASL is divided into two categories implied and expressed. 

Expressed Consent

Expressed consent means someone actively gave you permission to contact him/her. To get express consent you must: 

• Clearly describe the purposes for requesting consent
• Provide the name of the person seeking consent, and identify on whose behalf consent is sought if different
• Provide contact information (mailing address and either a phone number or an email address) of those parties seeking consent
• Indicate the recipient can unsubscribe

Implied Consent

Implied consent means that you have a relationship with someone, but you have not expressly requested their permission to contact them. For example if they have bought or leased a product, good or service from you, but you did not specify that you would market to them. 

Old Contacts Vs New Contacts

It is important that from July 1, 2014 you track how your contacts have been obtained and if you have implied or expressed consent to contact them. Under the new law you cannot keep your implied consent contacts on your list forever. They will expire.

For implied contacts captured before July 1, 2014, you will have three years to send messages to your recipients. From July 1, 2017, you will then need the expressed consent of those recipients.

For implied contacts captured after July 1, 2014, you will have just two years from when the details were originally captured.

Obtaining Consent

While single opt-ins (where no follow up email is sent to confirm consent) are still permitted, pre-checked boxes are not. The contact must expressly tick a box to confirm.

Verbal consent is also permitted, however if you do not record your phone calls, it is important to make sure you log when and how you obtained that consent.  

When collecting business cards at a tradeshow or event, these contacts will be classified as implied consent, as they have not expressly told you they would like to hear from you. It therefore may be better to create a form for people to complete and indicate their consent. This form can then be kept on file, in either paper or electronic form, to confirm how consent was received. 

The Exceptions: When Consent is not Required

There are a few exceptions to CASL, mainly concerning the delivery of customer service through electronic message. For example, you will not need consent to send the following:

• Response to a request for information
• Quotes or estimates
• Receipts or confirmation of transactions
• Warranty, recall, safety or security information on your products
• Information about an ongoing purchase, subscription, membership, account or loan
• Delivery of your product or service e.g. a link to download an eBook or piece of software

There are also exceptions to the law if you have a personal or family relationship with the recipient and there have been voluntary, two-way communications. This can include friends, family friends, partners, spouses and parent-child relationships.

Lastly, you may refer a prospective client to another person if you have an existing relationship with that client. If you receive a referral, you may send one message to that prospect, but it must include the full name of the person who originally referred them.

Penalties for Not Complying

Not complying with CASL can cost you $1 million (individual) or $10 million (company). You can also incur unlimited fines or imprisonment for false or misleading messages. And not only can you be fined by a regulatory body, you can also be sued by the general public. An individual or a group of individuals can seek $200 per message received or $1 million per day, plus compensatory damages. 

For More Information

Visit the Industry Canada, Digital Policy Branch.