Here are ten things to know about Canada’s CASL:
1. It applies to small businesses.
For example, if your business ever:
- Blasted an email to a list of addresses that you bought from a third-party company?
- Sent social media messages (eg, Messenger, WhatsApp, LinkedIn, etc) to friends, family and supporters to tell them about your newest service?
- Texted old customers to keep them in loop on new promotions?
2. Why and when did it come into force?
The purpose is to protect the public from getting unwanted and also potentially dangerous emails that attempt to scam or phish people, or violate their privacy rights. It initially came into force in 2014, with later amendments.
3. When & who it applies to:
It applies to anyone sending certain communications for a “commercial activity”. A “commercial activity” means any particular transaction, act or conduct that is of a commercial character, whether or not the person who carries it out does so in the expectation of profit…”
This means, it can apply to a sole-proprietor, a small business-owner, a not-for-profit or a charity.
4. What it applies to: it applies to any commercial electronic message:
It applies to commercial electronic messages (CEMs) that are sent to electronic addresses.
As noted in 1), emails, texts, and messages on social media are included.
5. Is it ever ok to send CEMS? If yes, how can I eliminate risk to my business?
Provided you comply with the law, you can send out CEMs. You must a) have the consent of the recipient, b) clearly identify yourself (or whomever its sent for), and c) provide an unsubscribe mechanism.
For example, is/ does your current system:
- allow you to keep track of each person’s consent?
- ask people to opt-in to get communication from you, instead of asking them to opt-out?
- allow recipient’s to easily unsubscribe from your CEMs?
6. Consent: explicit , implied, and exemptions
In all cases, the sender that must be able to prove that they have the recipient’s consent, whether its explicit or implicit.
a. Explicit Consent: If someone opts in or agrees to receive your CEMs, this is explicit consent. Explicit consent does not expire, but the recipient can withdraw it at any time.
b. Implied Consent: In some cases, for a limited time, the recipient’s consent may be implied. Eg.:
-
- if they were a recent customer of your business
- If someone gave you their business card and did not make a statement that they did not wish to receive promotional material from you and the CEM you send relates to their role, function and duty in an official or business capacity.
- where you are a club, association or voluntary organization, and you send CEMs to the membership.
c. Exceptions: CASL contains exceptions and may allow you to send CEMs: after receiving a referral, due to a business-to-business exemption or the conspicuous publication exemption
7. Can someone make a complaint against me? What are the penalties if I breach CASL?
- Yes, they can report you to the Consumers’ Association of Canada.
- CASL is one of the strictest anti-spam laws in the world; maximum penalties can be $10 million CAD.
8. Here are some risky scenarios that may apply to a small business*:
Here are some examples of where a sender of CEMs could put themselves at risk:
a) Small business buys email addresses from a vendor
You are a small business and need an inexpensive way to spread the word about your services to tons of people. You buy a list of email addresses from a 3-party vendor. That vendor created that list by using “web crawler” software to mine the Internet for email addresses. The 3rd party vendor did not get everyone’s consent. Is this ok?
b) Organization collects addresses for one purpose, then sells them for another
You have a website for a Great Dane owners club. Several of the members complain that they are getting spam emails trying to sell them dog food. It appears that your company sold a list of its members’ addresses to the dog food company without the consent of the dog owners. Is this ok?
c) Not collecting, but generating addresses
A tech-savvy entrepreneur wants to sell email address lists to marketers. But this entrepreneur does not want to “steal” from any individuals. So instead of using actual people’s email addresses, she uses a tool that generates email addresses. Her list includes common names with common email domain names.
She claims that she did not “scrape” these email address from the web. She offers very low prices, but you find out that she did not get any consent from individuals to use their email addresses. Can you use her list?
* Scenarios from https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/canadas-anti-spam-legislation/casl-compliance-help-for-businesses/casl_guide/
9. For more information:
Three government bodies, in partnership, enforce Canada’s Anti-Spam Legislation together: Canada’s Competition Bureau, the Office of the Privacy Commissioner, and the Canadian Radio-television and Telecommunications Commission (CRTC). They all provide information, including:
a. Canada’s Anti-Spam Legislation website: fightspam.gc.ca
b. Competition Bureau Canada: FAQs about Canada’s anti-spam legislation:
https://www.competitionbureau.gc.ca/eic/site/cb-bc.nsf/eng/03765.html
c. Canadian Radio-television and Telecommunications Commission (CRTC): Enforcement Advisory of notice for businesses and individuals on how to keep records of consent:
www.canada.ca/en/radio-television-telecommunications/news/2016/07/enforcement-advisory-notice-for-businesses-and-individuals-on-how-to-keep-records-of-consent.html
d. Office of the Privacy Commissioner of Canada
Guidelines for obtaining meaningful consent: https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gl_omc_201805
Helpful Tips for Businesses doing E-marketing:
https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/canadas-anti-spam-legislation/casl-compliance-help-for-businesses/casl_tips_org/
10. Test your knowledge!
Try this quiz to test your knowledge: https://fightspam.gc.ca/eic/site/030.nsf/eng/00016.html
Amee Sandhu has been a business lawyer in Ontario for 20 years. She created Lex Integra Professional Corporation in 2019 and focuses exclusively on business law and corporate ethics.
In her current practice Amee advises clients on commercial, corporate, integrity, anti-corruption, ethics and compliance, and supply chain risks.
Lex Integra:
Understand your risks. Perform with Integrity.
The purpose and contents of this blog is to provide information only, and it does not constitute legal advice. Reading this blog does not create a solicitor-client relationship between the reader and Amee Sandhu or Lex Integra. It is recommended to engage (hire) a lawyer if you require or are interested in legal advice.
Connect with Amee