Canada’s Anti-Spam Law: requirements for sending commercial electronic messages

Since July 1, 2014, Canada’s Anti-Spam Law has been imposing a change in the way you solicit clients electronically.

Canada’s Anti-Spam Law (CASL) regulates unsolicited commercial electronic messages (CEM) – or Spam – on Internet and wireless networks, including those sent via email, instant messaging or phone (e.g. SMS text messages) and, in some cases, via social networks.

The notion of “CEM” under CASL

A CEM is a message sent to an electronic address, the content of which (or the website to which it is linked) is aimed at encouraging participation in a commercial activity, whether for profit or not. This can take the form of an infoletter, a newsletter, an advertisement or any other electronic communication containing offers of services or property (movable or immovable), business or investment opportunities, or promoting things or persons.

Until July 1, 2014, it was possible to send a CEM to a recipient without obtaining their prior consent. It was also possible to solicit consent to receiving a CEM via email or text messaging, but this has no longer been permitted since that date (see section 1 hereafter concerning the prohibition of asking for consent via electronic message). In order to avoid any dispute which could arise as to the circumstances leading to the obtaining of consent prior to July 1, 2014, it was recommended to follow CASL’s rules concerning prior consent.

Since July 1, 2014, save for a few exceptions, the sending of a CEM has been requiring:

1. the obtaining of the recipient’s express or implied consent to receiving the CEM;
2. clear and simple identification of the sender of the CEM; and
3. the inclusion of an unsubscribe mechanism.

1) Consent

Express consent

The prior express consent required under CASL may be written or verbal and remains valid until withdrawn. However, an email, text message or equivalent form of messaging cannot be used to seek the required consent. In addition, the burden of proof of the circumstances and conditions under which consent was obtained rests on the sender of the CEM.

Essentially, the request for consent must state clearly and simply the following information:

• the purpose for which the consent is being sought;
• information allowing identification of the person seeking consent or the person on whose behalf consent is being sought (name, address, telephone number, email address or website);
• a statement to the effect that consent may be withdrawn at any time.

For more details, please refer to the Guidelines on the means of obtaining express consent under CASL.

Implied consent

In the absence of express consent, CASL provides for certain situations where the sender may presume the implied consent of the recipient to receiving a CEM, including:

• if there is an existing business relationship between the sender and the recipient due to the existence of a contract for the purchase, sale or lease or for a service concerning movable or immovable property (e.g. BCS, BCP, BCL in progress);
• if there is an existing non-business relationship between the sender and the recipient due to a donation or gift or volunteer work performed by the recipient for the charity, political party or candidate to publicly elected office sending the CEM, or due to membership in the club, association or charity sending the CEM;
• if the electronic address of the recipient has been given or published without indicating a wish not to receive unsolicited CEMs at that address. However, the message sent must be relevant to the person’s business or functions within such business (for example an electronic address published on a website or a business card given in a context reasonably leading to believe that there is consent to receiving a CEM).

In the context of an existing business or non-business relationship mentioned above, CASL assumes the implied consent of the recipient to receiving a CEM for a two-year period following the end of the relationship. However, CASL provides transitional measures for cases where such relationships already exist as of July 1, 2014. In this context, CASL assumes the recipient’s implied consent to receiving a CEM until such consent is withdrawn or on July 1, 2017 at the latest.

Consent not required

CASL also provides for certain exceptions to the requirement of obtaining the recipient’s prior consent, including for a CEM, whose purpose is to:

• provide a quote or estimate for the supply of a product, goods, a service, land or an interest or right in land at the request of the recipient;
• confirm a commercial transaction that the recipient has previously agreed to enter into with the sender;
• provide factual information to the recipient regarding a subscription, membership, account, loan or similar transaction.

The sending of a CEM in the following circumstances is also exempt from the obligation for the sender of obtaining prior consent:

• when it is a first CEM sent in order to contact the recipient following a referral by an individual who has an existing business, non-business, family or personal relationship with the sender and the recipient of the CEM. In this case, the CEM must include the name of the individual who made the referral and a statement to the effect that the CEM is sent as a result of such a referral;
• when it is sent to an employee, a representative, a consultant or a franchisee within the same organization and concerns the activities of the organization;
• when it is sent to an employee, a representative, a consultant or a franchisee of another organization if the respective organizations maintain a relationship and the message concerns the activities of the recipient organization;
• when it is sent to satisfy or enforce a right, a legal obligation, a court order or judgment.

To learn more about whether or not prior consent is required, please refer to Canada’s Anti-Spam Law and the regulations thereunder.

2) Identification of the sender

CASL requires that the CEM contain information allowing identification of and easy communication with the sender. To this effect, the sender must ensure that the contact information is valid for at least sixty (60) days following the sending of the CEM.

3) Unsubscribe mechanism

CASL also requires that the CEM contain a description of the mechanism to withdraw consent, allowing the recipient to cease receiving messages. This mechanism must be simple, quick and easy, for example via an electronic address or a webpage. The sender has an obligation to ensure that the address or site provided remains valid for at least sixty (60) days following the sending of the CEM. The sender must also ensure that the recipient’s wish to withdraw consent is executed without delay, no later than ten (10) working days following receipt of the recipient’s notice, without further intervention being required on the part of the recipient. On this topic, we encourage you to read the Guidelines on the means of obtaining express consent under CASL.

Email lists

Once prior consent has been obtained, CASL does not prohibit the legitimate collection and compiling of distribution lists, provided the rules regarding consent and the legislation concerning protection of personal information are complied with. What CASL does prohibit is the compiling of unauthorized lists of electronic addresses.

Penalties

Since July 1, 2014, a violation under CASL could result in fines of $1,000,000 for an individual and $10,000,000 for a company. In the latter case, the directors, officers, agents or mandataries who ordered, authorized, assented to or participated in the violation are also liable. The same applies to an employer, who is responsible for a violation committed by his employee within the scope of his employment.

Civil proceedings

On June 7, 2017, the government suspended the implementation of the private right of action, which was to come into effect on July 1, 2017. This right would have allowed individuals and organizations who suffer harm as a result of an act or omission in violation of CASL to file a civil action before the courts against any individual or company alleged to have violated CASL and to claim statutory and compensatory damages. In this context, a review of current CASL provisions by a parliamentary committee will be conducted in the near future.

Voluntary disclosure of a violation of the law

Given the importance of the penalties, it is important to know that a voluntary disclosure procedure is provided under CASL, which means that the sender who has violated the law may enter into an agreement with the CRTC to negotiate terms or a fixed penalty set by the organization.

Additional information

• Canada’s Anti-Spam Law
• Electronic Commerce Protection Regulations (Governor General in Council’s Application Regulations)
• Electronic Commerce Protection Regulations (Telecom Regulatory Policy CRTC)
• Information Bulletin 2012-548 (Guidelines on the interpretation of the Electronic Commerce Protection Regulations (CRTC))
• Information Bulletin 2012-549 (Guidelines on the use of toggling as a means of obtaining express consent under Canada’s anti-spam legislation)
• Industry Canada’s Frequently Asked Questions
• CRTC’s Frequently Asked Questions
• From Canada’s Anti-Spam Legislation (CASL) Guidance on Implied Consent

You may also check the National Do Not Call List (DNCL) website and CRTC-2007-48 and CRTC-2007-48-1 decisions of the Canadian Radio-television and Telecommunications Commission.