Any business operating in Canada that sends commercial electronic messages must comply with Canada's Anti-Spam Legislation (CASL). This legislation came into effect on July 1st, 2014, but has since included two further updates. Commercial electronic messages include transmissions such as email that promotes a product or service; a practice which many businesses use today to both communicate and market to current and potential customers.
Businesses must comply with CASL by:
- Obtaining consent
- Providing identification information
- Including an unsubscribe button in each message
Knowing the difference between express and implied consent is key
Express consent refers to an individual who has explicitly agreed verbally or in writing to receive commercial electronic messages. In most cases, this is done by "opting-in" on a particular website (usually ticking a box). Express consent is not time-limited, therefore, an individual will continue to receive the commercial electronic messages until they unsubscribe.
Under section 10(9) of CASL, an organization may rely on implied consent to opt an individual into receiving commercial electronic messages. Certain implications, such as having an existing business relationship based on, for example, membership in a club, can also result in a decision of implied consent. When taking the route of implied consent, in the form of an existing business relationship, an organization will be limited under CASL to either two years or six months following the last transaction date.
How to ensure that proper consent is obtained
When looking to obtain consent from a potential recipient, the following must be provided to them:
- The name of the organization or person seeking consent
- A mailing address, phone number, voice message system, or website where recipients can access an agent for more information
- A statement identifying the person on whose behalf consent is being sought
- The identity of a third-party used to obtain consent
- An unsubscribe button that allows recipients to electronically opt-out of communications
Are there consequences for not complying with CASL?
In short, yes. Organizations that do not comply with CASL are subject to penalties ranging from large fines all the way to jail time. Examples of potential penalties include:
- Criminal charges
- Civil charges
- Personal liability for company officers and directors
- Fines up to $10 million
Learn more
Complying with CASL is the law for Canadian organizations and businesses of all shapes and sizes. Understanding the existence of the legislation as well as the "must know" facts outlined in this post is very important. Though, CASL can become much more intricate if you decide to dig deeper.
We encourage those responsible for their company's privacy policy, and even those who are further interested, to visit the Government of Canada's page on CASL to learn more and to see how it can be properly implemented into your company.