With the enactment of Canada’s Anti-Spam Legislation (CASL) around the corner, it’s hard to know what kind of message your business is allowed to send to reach customers, and what kind of message is taboo – especially with the threat of a sizeable fine.
Penalties for non-compliance can reach up to $1 million for individuals, and $10 million for businesses, with statutory damages of up to $200 for each violation of the prohibition. Just one email or text can count as a violation. So with those stakes on the table, how do you ensure you mitigate your risk and comply with CASL?
On Sept. 29, Toronto lawyers Adam Kardash and Joanna Fine held a workshop for 60 attendees from organizations from all over Toronto, explaining who the laws will apply to, and what kind of messages will fall under its scope. Kardash and Fine, who specialize in privacy and information management at Heenan Blaikie LLP, supplied us with more details on CASL, unpacking what it means for businesses.
What kinds of organizations does CASL apply to?
“CASL isn’t meant to stop legitimate business activity. It’s meant to stop rogue spammers,” Kardash said during his presentation. He said CASL will apply to any organization sending commercial electronic messages, focusing on cutting down on spam and preventing Canadians from getting unwanted texts and emails landing in their inboxes.
However, there are exceptions to the rule. During the workshop, one attendee asked whether CASL targets foreign spammers.
“This legislation will have no impact on someone sitting overseas firing off unwanted spam messages,” Kardash said. “What it will do is provide Canada, the last G8 country to get this, with anti-spam legislation … dropping a hammer on someone sitting in Toronto or Montreal. This provides a very clear hammer.”
What kinds of messages does CASL apply to?
CASL isn’t limited to just emails or texts, Kardash said. It can apply to any commercial electronic message sent through any means of telecommunication, including sound and voice messages.
It also includes emerging forms of electronic messaging, meaning in the future, something built “by a guy in his garage” could still be covered under the law. Basically, any form of electronic messaging that encourages the recipient to participate in a commercial activity falls under CASL, Kardash said.
So how can businesses contact customers?
When CASL comes into force, there will still be some exceptions for Canadian businesses. While the rules are very clear about whether businesses can send messages to consumers, those rules are waived when consumers give express or implied consent to receive them.
Express consent can be either in verbal or written form, but it has to be an action on the consumer’s part. They need to know what the consent is for, and they have to be provided with the sender’s contact information. They also need a statement indicating they’re allowed to withdraw their consent at any time. Given the benchmark for express consent is a high one, prechecking boxes saying “I want to receive information about the sender’s offers” doesn’t truly count as consent, Kardash said.
However, obtaining implied consent is a little easier. This happens when two parties already have an existing business relationship. For example, if a recipient has purchased goods or services, or signed a contract with a business, they’ve given their consent to be in contact with that business. Yet this form of consent is time-sensitive, only counting for two years after a purchase has been made or two years after a contract has expired. If a customer has submitted an inquiry or application, the implied consent is only valid for six months, Fine said.
Beyond consent, are there any other opportunities for businesses to send messages to customers?
Businesses still get the green light to send messages that answer customer queries, or that provide quotes or estimates. Those kinds of messages are also OK under CASL when they simply confirm a commercial transaction, Fine said. However, the messages still have to comply with CASL’s consent and unsubscribe requirements, giving recipients a way to say they no longer want to receive those kinds of messages.
What’s also unclear is how CASL will handle cases of businesses running contests. Fine suggested those may be considered as implied consent, with contest entrants agreeing to receive messages from a business for up to two years after the business names a winner. Still, legislators may need to clarify how that will work by the time CASL rolls around next year.