As reported in prior issues of this Newsletter, Canada’s anti-spam legislation (“CASL”) was passed by the Canadian Parliament in late 2010. However, the Canadian government has delayed bringing CASL into force pending the adoption of regulations to clarify certain obligations under the new legislation.
In very general terms, CASL prohibits the sending of unsolicited commercial electronic messages, which include text messages and e-mails, without receiving express or implied consent from the recipient. It also prescribes form requirements for commercial electronic messages including a mandatory unsubscribe mechanism.
While these so called “anti-spam” provisions have attracted most of the public attention, CASL also contains a number of other provisions to address conduct which discourages the use of electronic technologies by undermining confidence in their use, increasing costs and compromising privacy and security of confidential information. These include malware and spyware provisions, provisions prohibiting altering transmission data, amendments to the Personal Information Protection and Electronics Documents Act relating to harvesting of electronic addresses through use of a computer, and amendments to the Competition Act which specifically address false and misleading representations in electronic messages, including in the sender information, subject matter information or locator.
Organizations need to be concerned about this legislation because of the breadth of the legislation and because of the very high level of potential liability under CASL.
Status of Regulations
CASL regulations are being made by both Industry Canada and the Canadian Radio-Television and Telecommunications Commission (CRTC). Both issued draft regulations for public comment. The CRTC regulations were finalized in March of 2012. These regulations prescribe the form and certain information to be included in commercial electronic messages and requests for consent.
The first draft of the Industry Canada regulations was published on July 9, 2011, followed by a consultation period. Industry Canada just released the much anticipated second draft of its regulations on January 4, 2013, which was followed by a consultation period that ended on February 4, 2013.
The new Industry Canada draft regulations reflect a number of changes related to the anti-spam provisions and are described below.
Family Relationships and Personal Relationships
CASL permits certain exceptions to the anti-spam measures of CASL to be provided for in the regulations. The anti-spam measures do not apply to a commercial electronic message that is sent by or on behalf of an individual to another individual with whom they have a personal or family relationship (as defined in the regulations). Further, the consent requirement does not apply to commercial electronic messages that solely communicate for a purpose specified in the regulations.
The Industry Canada regulations address the definition of family relationship and personal relationship. The proposed regulations define “family relationship” as the relationship between individuals who are connected by a blood relationship, marriage, a common-law partnership or adoption, all as further defined in the regulations.
In the first draft of the regulations the definition of “personal relationship” referred to a relationship between individuals if they had had an in-person meeting and, within the previous two years, a two-way communication. The current draft regulations have broadened that definition to remove the requirement of an in-person meeting, thus permitting virtual relationships, and also removing the arbitrary two year requirement. The definition is now more subjective. It requires that:
those individuals have had direct, voluntary, two way communications and it would be reasonable to conclude that the relationship is personal; taking into consideration all relevant factors such as the sharing of interests, experiences, opinions and information evidenced in the communications, the frequency of communication, the length of time since the parties communicated and if the parties have met in person.
Determining whether the relationship is personal is thus based on a non-exhaustive list of factors. In order to prevent abuse of the exception, the revised regulations allow individuals to express the wish not to receive commercial electronic messages from the sender. The “personal relationship” exception will not apply in those cases.
Excluded Commercial Electronic Messages
As described above, CASL permits the regulations to prescribe commercial electronic messages to which the anti-spam measures do not apply. During the consultation period many stakeholders requested new exceptions to the requirements.
The most recent draft of the Industry Canada Regulations attempts to address some of these concerns by providing for the following exemptions to the anti-spam measures in CASL. New exceptions have been provided for:
- commercial electronic messages sent within a business or sent between businesses that are already in a business relationship, where the messages are sent by an employee, representative, contractor or franchisee and are relevant to the business, role, function or duties of the recipients;
- commercial electronic messages sent in response to a request, inquiry, complaint or otherwise solicited by the addressee;
- commercial electronic messages that are sent or caused or permitted to be sent by a person or computer system located outside Canada and relates to a product, good, service or organization that is located or provided outside Canada but is accessed using a computer system in Canada. This applies only if the person sending the message did not know and could not reasonably be expected to know that the message would be accessed using a computer system located in Canada; and,
- commercial electronic messages sent due to a legal obligation or to enforce a legal right.
The new draft regulations also provide for a “third party referral exemption”. Stakeholders were concerned that they could not directly act upon referrals from friends, family and clients without first obtaining consent. In order to strike a balance by allowing third party referrals without undermining the requirements of CASL, this new exemption applies to the first commercial electronic message sent by an individual to an addressee following a referral by a third party who has an existing relationship (whether business or personal) with both the sender and the addressee, provided that the full name of the third party who made the referral is disclosed and states that the message is sent as a result of the referral. The condition permitting the sending of only one message means that the sender will be required to receive consent pursuant to CASL in order to send more commercial electronic messages.
Implications for Charities and Not-for-Profit Organizations
Industry Canada has noted that not all issues raised by stakeholders have been addressed in the draft regulations. In particular, in the Regulatory Impact Analysis Statement issued with the new draft regulations notes that some stakeholders had argued that consents obtained under the PIPEDA should be valid as consent under CASL. In particular, the “opt out” form of consent which may have been relied upon by many charities and not-for-profit organizations will not constitute the express or implied consent required under CASL. The Regulatory Impact Analysis Statement notes in response that CASL is intended to create a higher threshold for the collection and use of consent for the activities being regulated.
For charities and not-for-profit organizations, it is important to understand that the anti-spam provisions of CASL apply only to “commercial electronic messages” which are defined broadly to include any transmission that has a purpose of encouraging participation in a commercial activity. Specifically included are offers to purchase land, products or services and offers to provide a business, investment or gaming opportunity. “Commercial activity” is defined to include any conduct that has a commercial character, whether or not carried on for profit. A challenge for charities and not-for-profit organizations will be to determine which of their activities and electronic messages concern “commercial activity”. It is yet to be seen how these definitions will be interpreted. Industry Canada has stated on its website that “political parties and charities that engage Canadians through e-mails are not subject to the legislation if these communications do not involve selling or promoting a product”.
Charities and not-for-profit organizations faced a similar issue in determining their compliance obligations under PIPEDA. It is likely that certain activities of charities and not-for-profit organizations will be considered to have commercial character and therefore e-mails encouraging participation in those activities will be commercial electronic messages. This will likely include the buying and selling of products and gaming opportunities, such as lotteries. Other fundraising activities where value is exchanged might also fall under this category, such as the carrying on of a related business by a charity, or fundraising dinners and raffles, which would also fall into the gaming category. This lack of clarity is one of the hurdles facing organizations in this sector.
As discussed above, consent for sending of commercial electronic messages is implied only in specific circumstances defined in CASL. CASL sets out several circumstances in which persons will be deemed to have an “existing non-business relationship”, whereupon consent for sending of unsolicited commercial electronic messages will be implied. One such instance is where the sender is a registered charity and the recipient has made a donation or performed volunteer work for the charity in the preceding two years. Another such instance is where a club, association or voluntary organization sends a commercial electronic message to a person who is currently, or who was in the preceding two years, a member of such organization.
If charities seek to rely on implied consent for the sending of commercial electronic messages, it will be necessary to design their contact systems to track whether such a relationship exists and when the “non-business relationship” ends within the meaning of the legislation.
Although perhaps the majority of electronic messages sent by charities and not-for-profit organizations might be considered to be not commercial in nature, it will be necessary to design systems to distinguish between contacts for whom a consent compliant with the anti-spam legislation has been obtained, and those where such a compliant consent has not been obtained, in order to ensure that the electronic messages regarding commercial activities are compliant. This also presents a burden for charities and not-for-profit organizations in terms of the design of their computer and other systems.
Unless further exemptions are obtained for charities and not-for-profit organizations, these organizations will need to plan carefully for these and other issues to ensure that they are compliant when CASL comes into force.