CASL - Canadian Anti-Spam Law
This guide should not be considered as legal advice. It is being provided for informational purposes only. Please review your email program with your legal counsel to ensure that your program is meeting appropriate legal requirements.
What is CASL?
The Canadian Anti-Spam Law (CASL) went into force in July 2014. CASL and was put into place to protect Canadians while ensuring that businesses are able to compete in the global marketplace.
Who does CASL affect?
Anyone sending email TO a recipient accessing emails in Canada or sending email FROM Canada is covered by CASL. If your organization is located in the US, EU, or anywhere in the world and sends Commercial Electronic Messages (CEM) to Canada, you are still responsible for complying with CASL.
What are the penalties of non-compliance?
For organizations, violations of CASL may result in payment of an administrative monetary penalty (AMP) up to $10 million per violation . Directors, officers, agents and mandataries of a corporation may face individual liability under CASL and be subject to an AMP up to $1 million per violation.
What are the requirements of CASL?
Summarized from CRCT FAQ
There are three general requirements for sending the CEM to an electronic address - (1) consent, (2) identification information and (3) an unsubscribe mechanism.
Consent
All senders must obtain either express or implied consent before sending commercial electronic messages (CEMs) to individuals. The onus is on the sender to prove they have obtained consent to send a message. Sender should document when consent was obtained, why consent was obtained, and the manner in which it was obtained at minimum. When obtaining consent, it needs to be clear to recipients that even if they give consent now, they can revoke it in the future.
The CRTC has issued an information bulletin to provide guidance and examples of recommended or best practices. Main points to note from this bulletin:
“Requests for consent must not be included in, or bundled with, requests for consent to the general terms and conditions of use or sale. The specific requests for consent in question must be clearly identified to the persons from whom the consent is being sought. For example, persons must be able to grant their consent to the terms and conditions of use or sale while, for instance, refusing to grant their consent for receiving CEMs.”
A separate tick-box for each form of consent, which must be proactively checked by the person whose consent is being sought, is considered complaint forms of consent. Pre-checked boxes are not considered acceptable to obtain express consent. More information on the use of toggling as a means of obtaining express consent be found here.
Unsubscribe
Unsubscribe mechanisms must be included in a CEM and must be set out clearly and prominently. The unsubscribe must be readily performed, accessed without difficulty or delay and should be simple, quick and easy for consumers to use. Any unsubscribe requests must be honored immediately or within 10 days. The unsubscribe must be valid for a minimum of 60 days after the message has been sent.
Identification
Each CEM must identify the sender of the message and contact information. A mailing address consists of the sender’s valid, current street (or civic) address, postal box address, rural route address, or general delivery address. In addition a phone number and/or website address must be included.
What is Private Right of Action?
Beginning on July 1, 2017 CASL will allow individuals and organizations that are affected bring a private right of action in court against organizations or individuals that have allegedly violated CASL. This will allow an individual or organization to seek actual and statutory damages against the sender of the email.
How can I be sure I am complying?
Contact your legal counsel to ensure your program is meeting legal requirements. Read more at the CRCT website FAQ and Compliance and Enforcement Bulletin.