UPDATE: The Government of Canada is suspending the implementation of certain provisions in Canada’s anti-spam legislation (CASL) in response to broad-based concerns raised by businesses, charities and the not-for-profit sector.
The provisions, known as private right of action, would have allowed lawsuits to be filed against individuals and organizations for alleged violations of the legislation.
The provisions were scheduled to come into force on July 1, 2017, but have now been suspended.
The Government supports a balanced approach that protects the interests of consumers while eliminating any unintended consequences for organizations that have legitimate reasons for communicating electronically with Canadians.
For that reason, the Government will ask a parliamentary committee to review the legislation, in keeping with the existing provisions of CASL.
CASL is clear as mud – at best. Knowing whether you need implied or direct consent is perplexing and a maximum $1 million dollar penalty for violation is downright frightening. So, let’s break it down and outline what your organization needs to know to be protected.
Overview
Nonprofits need to know about CASL, or Canada’s Anti-Spam Law as it applies to commercial electronic messages. These are messages intended to encourage participation in a commercial activity such as: purchase a ticket, purchase a membership, etc.
How to send a CEM
To send a CEM to a person, business or organization in Canada, you must have three things:
- Consent
- Identification information
- Unsubscribe Mechanism
What is consent?
You must have the recipients consent to send a CEM. It can come in the form of:
- Express: recipient agrees to receive CEMs
- Implied: on the basis of a relationship between sender and recipient, or action taken by recipient
- Not required: some CEMs are exempt from CASL or the requirement to obtain consent
Express Consent
Express consent is the gold standard. For nonprofits, this could look like: a person signing up for your newsletters, or perhaps a recipient clicking “Yes, I would like to receive emails from your organization”
Implied Consent
A little tougher to decipher – Implied consent can be shown in a few different ways:
- An existing business relationship
- The recipient has purchased a product or service from you
- Relationship is either ongoing or has ended not more than two years before CEM is sent (This is new starting July 1)
- An existing non-business relationship
- If a recipient has donated to, volunteered for or had a membership with sender
- The sender must be a registered charity, political party – organization or candidate, club, association or voluntary organization
- The relationship is ongoing or has ended not more than two years before CEM is sent (Again, new)
There are instances where CEMs are exempt from CASL. Here are some most related to nonprofits
- Employees in same organization
- Employees of different organizations about existing business relationship
- Sent by registered charities for raising funds
- Concerns ongoing subscription, membership or account
- Delivering product/service preciously contracted for by recipient
- Website Exemption – the email is listed publicly and you’re sending information related to them/their organization
- Business Card – you have the email listed on their business card
*ID and unsubscribe mechanism included on platform
What’s changing on July 1?
It’s the end of the transition period for implied consent. Now, the general rule is: Consent is implied two years after relationship ends.
Private Right of Action See above, this has been suspended by the Government of Canada
This is the scary part. Any individual who is the victim of a CASL violation can sue the organization who has violated CASL. Before July 1, only the CRTC, OPC and Competition Bureau could prosecute. For CEM provisions, this is $200 per violation, maximum $1 million each day violation occurred. This could be bad for CEMs sent to a wide range of people. There is potential for class action lawsuits and there is potential director/officer liability. Your organization is also responsible for all violations committed by employees acting in scope of their authority.
The steps your organization should take
- Investigate your databases – what is the basis of your consent? Who is implied and who is express?
- Identify those relationships that will expire. Is the relationship ongoing? If the relationship ended, when did it end? Only implied consent arising from a relationship on or after July 1, 2015 (two years) will be valid
- Implied consent can be used to obtain express consent (Express consent has no expiration)
- Consider seeking express consent from implied recipients
- Review your directors and officers liability insurance in the case of private right of action (This has been suspended)
- Establish a written CASL policy
- Keep comprehensive records
- Implement staff training and involve senior management
- Ask for legal advice if necessary