Spam accounts for over 65% of messages transmitted through the Internet. The negative effects of spam are felt by Internet providers, as well as businesses and individuals. Spam can be anything from annoying to illegal, and places tremendous costs on society in terms of energy, bandwidth, and effective communication. For these reasons, the Canadian Government created a Task Force on Spam in 2004. Recommendations from this Task Force have ultimately led to the passing of the “Canadian Anti-Spam Legislation” (CASL). CASL is defined as:

An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act.

This new law is designed to protect Canadians from spam, hacking, spyware, address collection and other privacy invasion. The law covers emails, text messages, social media and even applies to future technologies not yet invented. CASL has not yet been called into force or fully implemented, however this is expected to happen before the end of this year.

How does it work?

Canada remains one of the last developed countries to implement anti-spam laws, yet has responded with some of the toughest legislation in the world. There are three prongs which give CASL serious teeth.

1. Restrictions on sending commercial emails

The legislation starts from the standpoint that sending any “commercial electronic message” is illegal. The law then goes on to craft certain exceptions to the default rule. These exceptions are limited and will be challenging for companies to comply with.

2. Opt in system, not opt out

CASL goes against the trend in other countries by adopting an “opt-in” approach rather than an “opt-out” approach. This means that recipients must agree to have a message sent to them prior to it being sent, as opposed to having to unsubscribe to opt-out of receiving further messages. In other words, you need consent in order to ask for consent. This creates a conundrum for companies wanting to establish electronic marketing programs.

3. Severe penalties

The penalties are stiff, up to $10 million per violation for a company and $1 million for individuals. What’s worse is that there is potential legal exposure for individual directors and officers of a company. Three governmental agencies are involved in the enforcement of the laws; the Canadian Radio-television and Telecommunications Commission, Competition Bureau, and Office of the Privacy Commissioner.

How are Individuals Affected?

For individuals, CASL promises greater control over the type of electronic messages they receive. Consent must be obtained for each type of message being sent and unsubscribing must be easy and acted on promptly. When the new legislation comes into effect, individuals may find companies they have previously given consent to seeking re-consent in order to comply with the new stricter laws. CASL also allows for individuals to sue spammers directly, which could lead to new class action suits.

Will individuals see an effect once the new law is in force? Probably not. Most spam is being filtered out by Internet service providers and email services already. In this respect, the new law may be too late. Further, most spam originates from outside of Canada. Technically, the Canadian law applies to senders outside Canada that send electronic messages into Canada, but it remains to be seen how effective international cooperation will be in enforcing CASL in other countries, or how it will be achieved.

How are Businesses Affected?

Although individuals may not notice the new laws, businesses certainly will. The new rules make commonplace marketing practise illegal, and create a mess of red tape to navigate. Social media strategies, including viral marketing, will need to be reviewed to ensure they are compliant with the legislation. For most businesses, prior consent will not be sufficient under the new rules and fresh consents will need to be sought from existing recipients. For small companies, CASL may create another barrier to expanding with new customers. Large companies utilizing electronic messages may find themselves as defendants in a private class action lawsuit unless they scrupulously follow CASL’s rules.

The harsh penalties and potential liability of officers and directors will make companies take notice of the new rules. The severe penalties and potential impact on marketing may give rise to a constitutional challenge, as critics have suggested that the laws may impinge on freedom of expression.

If one thing is clear, it’s that individuals and businesses must now take action in order to prepare themselves for the new rules under CASL.

How can Businesses Prepare?

CASL captures all commercial electronic messages that are sent to, through, or from Canada. Two major requirements of CASL that businesses must pay particular attention to are the:

(1) consent; and

(2) content of messages.

1. Consent Tips: Unlike legislation in the United States, which uses an opt-out approach, CASL uses an opt-in approach. This means that recipients must agree to have an electronic message sent to them. For example, sending an email about a retail sales event without prior consent will violate CASL because the recipient has not opted-in to receiving the electronic message.

CASL requires consent to be explicitly obtained from the recipient for each particular type of electronic message. As a result, businesses are encouraged to update their existing consent to ensure it is CASL compliant. For example, a consent must be obtained for a promotional sales message and another consent would need to be obtained for an educational newsletter.

In addition, businesses are required to do the following in relation to the consents obtained pursuant to CASL:

• Keep records of all existing consents in order to have an audit trail.

• Remind the recipient how and when they provided consent in each message so that the electronic message is not mistakenly reported as spam.

• Alternatively, businesses can use third party email service providers that are CASL compliant to send their electronic messages. In this case, businesses must ensure CASL compliance is an obligation in their service agreements as well as liability protection in the event of non-compliance by the service provider.

2. Content Tips:

• Businesses are required to ensure the electronic messages that they send satisfy all of the CASL requirements, some of which include:

• the identity of the sender;

• the sender’s contact information (email, URL address and postal address); and

• a mechanism to unsubscribe.

• Businesses should provide an easy and clear mechanism to unsubscribe from receiving future electronic messages. The mechanism to unsubscribe must remain active for 60 days and businesses must honour a recipient’s opt-out request within 10 days.

• Businesses are encouraged to be consistent with the frequency, form and content of the messages so that the recipients become accustomed to the electronic message and do not consider it spam.

Tips for Individuals

CASL gives individuals certain rights against anyone who violates CASL. The federal government has broad investigatory powers and has set up an email account where individuals can notify them of any non-CASL compliant electronic messages that they receive. Also, individuals can specify that they do not consent to receiving any electronic message where their personal information is published, therefore making it illegal for businesses to use this information for that purpose.

Mitigating the Impact of CASL on E-Commerce

If small businesses wait until CASL is enforced the new rules could inhibit their growth as they would be inundated with the consent and content requirements for all their electronic messages. Large businesses could be burdened with the sheer magnitude of record keeping that CASL requires for sending electronic messages. The financial costs, disruption to business and the time investment associated with implementing procedures and policies to comply with CASL can be significantly reduced if businesses respond promptly to CASL requirements.