Yesterday, the Minister of Industry announced that the bulk of Canada’s anti-spam law (“CASL”) will come into force on July 1, 2014, while the remaining provisions will be gradually phased-in by 2017. Subject to limited exceptions, CASL prohibits businesses from sending commercial electronic messages (“CEMs”) unless a prior express “opt-in” consent from the recipient has been obtained.
CASL was introduced in 2010 but its commencement date was delayed while its two sets of associated regulations where being finalized. The Canadian Radio-television Telecommunications Commission registered the final version of its regulations on March 12, 2012, and Industry Canada, following a lengthy consultation period, released its final version of the Electronic Commerce Protection Regulations on December 4, 2013 (collectively, the “Regulations”). CASL, the Regulations, and the related guidelines will govern how businesses communicate with Canadian recipients of CEMs.
Given its reach (it also applies to CEMs originating from outside of Canada) and the significant penalties for non-compliance (including Administrative Monetary Penalties of up to $10 million), CASL will have an important impact on how businesses communicate with consumers in the digital age.
What Should Businesses Know?
The Regulations define key legal concepts in CASL and provide limited exemptions from the requirement to obtain consent prior to sending CEMs. In particular, the final version of the Industry Canada regulations addresses some of the concerns raised by stakeholders during the consultation period. The final Industry Canada regulations provide the following key differences from the previous version:
Messaging Platforms. CEMs sent or received on certain platforms (e.g. instant messaging platforms), where CASL required identification information and unsubscribe mechanisms are clearly indicated and available on such platform;
Limited Access Accounts. CEMs sent to a limited-access secure and confidential account to which messages can only be sent by the person who provides the account to the person who receives the message (e.g., email accounts on electronic banking platforms);
Foreign Recipient. CEMs sent to foreign recipients, where the sender reasonably believes the CEM will be accessed in a foreign jurisdiction listed in the Regulations and where the CEM conforms to the law of that jurisdiction;
Charities. CEMs sent on behalf of a registered charity for the purpose of soliciting donations; and
Political Parties. CEMS sent on behalf of a political party for the purpose of soliciting contributions.
The Regulations also permit organizations to obtain consent on behalf of unknown third parties as long as in CEMs sent by those third parties: (i) the CEM identifies the original person who obtained the consent; and (ii) the CEM contains an unsubscribe mechanism and allows the person who provided the consent to withdraw it, both from the person who originally obtained the consent and any other person who is authorized to use it. According to the Regulatory Impact Analysis Statement from Industry Canada, when a person withdraws his or her consent to receive CEMs from third parties, the onus is on the person who originally collected the consent to notify those other third parties.
CASL will be phased-in in three parts. The first part, which includes the bulk of CASL requirements relating to CEMs, will come into force on July 1, 2014. The second part, which relates to computer program provisions, will come into force the following year on January 15, 2015. The final part, which relates to the private right of action, is scheduled to come into force on July 1, 2017.
Due to its wide-reaching ambit and the significant Administrative Monetary Penalties in case of violations, CASL imposes substantial requirements on businesses that rely on CEMs as part of their business strategy. Given that the Regulations have now been finalized and the implementation date has been announced, businesses should ensure that their internal policies, practice and protocols comply with CASL. It is noteworthy that CASL will also apply to businesses located outside of Canada that send CEMs to Canadian recipients.