Canada’s Anti-Spam Law (CASL): FAQs relevant to all registered charities and nonprofits

Year
2014

The information provided below, while not constituting legal advice, sets out our best policy understanding of the regulations and their requirements, and has been shared with and commented on by the Industry Canada officials responsible for the regulations.

1. How do we know if we need consent to send a message to somebody?

Consent is only required to send a “commercial electronic message” (CEM). A commercial electronic message is:

an electronic message that, having regard to the content of the message, the hyperlinks in the message to content on a website or other database, or the contact information contained in the message, it would be reasonable to conclude has as its purpose, or one of its purposes, to encourage participation in a commercial activity, including an electronic message that

(a) offers to purchase, sell, barter or lease a product, goods, a service, land or an interest or right in land;

(b) offers to provide a business, investment or gaming opportunity;

(c) advertises or promotes anything referred to in paragraph (a) or (b); or

(d) promotes a person, including the public image of a person, as being a person who does anything referred to in any of paragraphs (a) to (c), or who intends to do so.

However, it is important to note that the Regulatory Impact Analysis statement issued alongside the regulations specifies several types of message that are not commercial and to which the regulations do not apply:

  • surveys, polling, newsletters, and messages soliciting charitable donations, political contributions, or other political activities that do not encourage participation in a commercial activity are not included in the definition;
  • if the message involves a pre-existing commercial relationship or activity and provides additional information, clarification or completes the transaction involving a commercial activity that is already underway, it would not be considered a CEM; and,
  • the mere fact that a message involves commercial activity, hyperlinks to a person’s website, or business related electronic addressing information does not make it a CEM under the Act if none of its purposes is to encourage the recipient in additional commercial activity.

2. We think our organization sends CEMs. Does this mean we have to stop?

CEMs can still be sent to individuals who have given express or implied consent.

3. What is express consent?

Express consent is when an individual gives you permission to send them any type of message, including CEMs.

Express consent can be obtained in a number of ways, including:

  • signing up on your website to receive messages;
  • checking a box on a paper form (such as a membership application);
  • providing an email address, if it is clear that you intend to send CEMs; and,
  • oral or written requests to receive messages.

Express consent, once obtained, only expires if the individual withdraws it. In the same way that express consent can be obtained in many ways, it can also be withdrawn in many ways.

4. We send emails asking people to uncheck a box if they want us to stop sending them messages. If they do not uncheck the box, is this express consent?

The CRTC, which will be enforcing the law, has indicated that a “pre-checked box” is not sufficient for obtaining express consent under the new regulations, and has provided guidance as to how express consent could be sought.

However, the regulations grandfather express consent that you may have obtained under the old rules. If you have been sending CEMs using pre-checked boxes, you likely have express consent for your existing email lists.

5. What is implied consent?

Various types of relationship between your organization and an individual provide you with implied consent to send them CEMs. These relationships include instances where an individual or organization has:

  • donated to you in the last two years (either cash or in-kind contributions);
  • volunteered for you in the last two years;
  • been a member of your organization in the last two years;
  • entered into a contract with your organization in the last two years;
  • purchased a good or service from you in the last two years; or
  • made an inquiry about your commercial offerings in the last six months.

Implied consent is transactional. For example, every time someone makes a purchase, the two-year implied consent period begins again.

More information on implied consent is available in the regulations or in a presentation that Industry Canada has prepared.

6. We often have clients referred to us by another organization. Are we still allowed to contact these people?

If your message is not commercial, there would be no restrictions on contact.

In the case of a “third party referral” you are allowed to send one CEM, as long as you specify how you obtained the email address. A message asking for consent is itself a CEM, so if you send such a message and do not receive a response, you may no longer send CEMs to that email address.

7. If we have consent, either express or implied, are there any other requirements?

All CEMs have to contain certain information. This information includes:

  • clearly identifying your organization;
  • providing up-to-date contact information for your organization; and,
  • offering an unsubscribe mechanism.

The unsubscribe option is key to establishing due diligence and responding to any complaints made against you. It does not have to be a technically advanced unsubscribe; asking people to reply to your message with the word “unsubscribe” is sufficient to comply.

You can find out more about the mandatory information in the regulations or in a presentation that Industry Canada has prepared.

8. We have implied consent with somebody. If we send a message asking for express consent, and they do not reply, do we have to stop sending them CEMs?

No. The implied consent will still be valid until it expires. See question 5 above for expiration timelines.

9. What do the regulations mean for our use of social media?

Depending on how you use social media, the regulations are not likely to have much effect.

Posting a message on Twitter, Facebook, LinkedIn, or other social media platforms is considered broadcasting, and not affected by these regulations. Similarly, targeted advertisements you may purchase on social media platforms are not affected.

Direct messages to an individual’s personal inbox on the social media platform may be affected, depending on the type of message being sent and the terms and conditions to which they agreed when setting up their social media account.

10. We use a third-party service for our electronic communications. Are we liable if they violate the rules?

Where a third-party service provider is used, your contract with them should include a requirement that they be CASL-compliant, and assurance from them that they are. This demonstrates due diligence on your part.

11. We’ve heard that the penalties are astronomical if we make any mistakes. How worried should we be?

The maximum penalties for CASL are significant. The CRTC has the authority to impose large fines, and, as of July 1, 2017, there will be a possibility of class-action lawsuits with significant damages.

A number of factors need to be kept in mind:

  • steps you take to show due diligence (such as tracking how you obtain email addresses, or always including an unsubscribe option) will be taken into consideration when assessing the penalty for non-compliance;
  • the CRTC is likely to investigate only in cases where there are a significant number of complaints or there appears to be a major transgression;
  • the CRTC is likely to emphasize education and compliance, rather than punishment, in cases where mistakes are made;
  • in the case of a violation, a compliance agreement with the CRTC eliminates the possibility of private lawsuits; and,
  • frivolous lawsuits may be summarily dismissed, with costs, by a judge.

Organizations that can demonstrate they are acting in good faith, taking reasonable steps to comply, and exercising due diligence are unlikely to face serious consequences if an error occurs.

12. Where can I get more information?

Information for businesses, organizations, and consumers is available at www.fightspam.gc.ca.

If you have specific questions about your own activities, you can make inquiries with the CRTC or with Industry Canada.

CRTC: 1-877-249-CRTC (2782)
Industry Canada: 1-800-328-6189

These Qs and As were issued by Imagine Canada on June 5, 2014 and will be updated periodically as warranted. Check the public policy section of Imagine Canada’s website for the most up-to-date information.