Canada’s long awaited anti-spam law (CASL) comes into force as of July 1, 2014. CASL takes the approach of forbidding almost all unsolicited commercial electronic messages (CEMs) and generally speaking, requires intended recipients of CEMs to provide express consent to the receipt of those messages. A CEM is broadly defined to include any message that has as its purpose, or one of its purposes, to encourage commercial activity. It has been suggested that the mere presence of a link to a company website can make an email a commercial electronic message that is subject to CASL. If you send commercial messages electronically to Canadians, you need to comply. Compliance may require updating your communication and marketing practices, as well as implementing potentially costly changes to your IT capabilities.

CASL provides for a few narrow exceptions and details the hoops that the rest of the world will need to jump through to send a CEM. Once in force, CASL will regulate anyone sending CEMs to Canadian recipients. Entities outside of Canada, such as US businesses, could be susceptible to penalties under this legislation as there is nothing in the CASL which limits its effect to domestic senders of CEMs.

There are significant differences between CASL and the law in the United States. Canada has put forward an opt-in, while the U.S. law is based on an opt-out model. Under CASL, CEMs may be sent when the recipient opts-in either with express or implied consent, or one of the exemptions to consent applies. This is the complete opposite of the US Can-Spam Act, which permits CEMs to be sent unless or until the recipient opts out.

The scope of Canada’s law also applies if any element of the commercial electronic message has a purpose to encourage participation in a commercial activity, while in the U.S. it has to be the primary purpose. The good news is that once express consent has been granted it is valid until it is revoked – the situation becomes trickier if you’re relying on implied consent in a pre-existing business relationship.

Express consent can be either in verbal or written form, but to be valid, the recipient needs to understand what the consent is for, be provided with the sender’s contact information and be informed that they can withdraw their consent at any time. Implied consent comes into play when two parties already have an existing business relationship. Implied consent applies to: ‘existing business relationships’, as defined; ‘existing non-business relationship’, as defined; and circumstances where the email address of the recipient was made publicly available or voluntary provided.

CASL’s specifically-defined exemptions permit certain messages to be sent without full CASL compliance. These exemptions include:

• Business to Business – messages sent within an organization by an employee, representative, consultant or franchisee to another employee, representative, consultant or franchisee of that organization in connection with the activities of that organization or to another organization, if the organizations “have a relationship” and the message concerns the activities of the recipient organization.

• Messages sent in the context of a Family Relationship and/or Personal Relationship – Family means individual related by marriage, common-law partnership or a legal parent-child relationship and personal relationship means individuals who had direct, voluntary, two-way communications where it would be reasonable to conclude that they have a personal relationship taking defined factors into consideration.

• Messages Sent in Response to a Request, Inquiry or Complaint or is otherwise solicited by the person to whom the message is sent.

• Messages Sent to Enforce a Legal Right

• Messages Sent and Received on an Electronic Messaging Service provided so long as the form and content and unsubscribe requirements of CASL are readily available and the recipient has consented either expressly or “by implication”.

• Messages Sent to a Limited-Access Secure and Confidential Account

• Messages “Reasonably Believed” to be Accessed in a Foreign State that is listed in the schedule to the Regulations

• Registered Charities and Political Parties, Organization and Candidates

• Third Party Referral exemption allows one message to be sent following a referral by any individual who has an “existing business” or “non-business relationship”, family or personal relationship with the person who sent the message and that disclosed the name of the individual that made the referral and the fact that the message is sent as a result of the referral.

• Exemptions for Telecommunications Service Providers to install computer programs without consent (i) in order to protect the security of all or part of its network from current and identifiable threats to availability, reliability, efficiency or optimal use of its network; (ii) for the purpose of updating or upgrading its network; and/or (iii) solely to correct a failure in the operation of a computer system or a program installed on it.

If your organization is found to have sent non-compliant electronic messages, it can mean up to $1 million fine for individuals and $10 million for corporations. Receivers of the messages can also sue for $200 for each individual communication. CASL will be phased-in in three parts. The first part, which includes the bulk of CASL requirements relating to CEMs, will come into force on July 1, 2014. The second part, which relates to computer program provisions, will come into force the following year on January 15, 2015. The final part, which relates to the private right of action, is scheduled to come into force on July 1, 2017.