If you are sending emails or other electronic communications to Canadian residents, you need to be aware that Canada is moving closer to finalizing the last set of highly anticipated regulations implementing Canada’s Anti-spam Legislation (CASL) . On Jan. 5, 2013, Industry Canada published regulations for a 30-day comment period, closing Feb. 4, 2013.

CASL is similar in concept to the U.S. CAN-SPAM law, but it is considered one of the strictest pieces of anti-spam legislation in the world. The Canadian Parliament passed the anti-spam legislation in December 2010, but the law and all accompanying regulations will not take effect until specified by an order of the federal cabinet (anticipated to occur later in 2013). CASL regulates the sending of commercial electronic messages (CEM), defined to include text, sound, voice and image messages, sent to an electronic mail account, an instant messaging account, a telephone account or any similar account. CASL also governs the installation of computer programs on another’s computer system (such as cookies). CASL applies to Canadian and non-Canadian companies or persons who transmit to Canadians.  The law (i) prohibits sending CEM unless the person to whom the message is sent has consented to receiving it (unless it is an exempt communication), with consent being either express or implied under the law, and (ii) requires specific form and content for the message (the latter being similar to the U.S. CAN-SPAM law).

CASL further provides for two sets of regulations, (i) one from the Canadian Radio-television and Telecommunications Commission (CRTC), and (ii) one from Industry Canada. Prior to Jan. 5, 2013 only CRTC issued regulations. The Industry Canada regulations provide key clarifications on when prior consent is required to send a CEM and new exemptions for obtaining consent.

Key provisions of the CRCT regulations affecting all forms of CEM include (i) consent (now being clarified by the Industry Canada draft regulations), (ii) contact information, and (iii) unsubscribe mechanisms. To briefly summarize the CRCT provisions:

  • Consent. In the absence of express consent, implied consent suffices only for pre-existing business relationships; all other situations require prior express consent. Soliciting consent must include a statement that consent may be withdrawn at any time.
  • Contact Information. The CEM must identify the sender, mailing address of sender, telephone number, email or web address.
  • Unsubscribe Mechanism. The CEM must provide that the recipient can readily perform the unsubscribe mechanism: it must be user-friendly, accessed without difficulty or delay, and be simple, quick and easy to use. (Who hasn’t experienced those frustrating unsubscribe mechanisms that require you to go to a different website address and click through a list of questions and/or prompts before you are successfully unsubscribed!)

According to the CRTC’s most recent guidelines, we know that consent may be obtained orally or in writing and that electronic forms are acceptable. It is also clear that the burden of proof that valid consent was obtained is on the sender of the CEM. Implied consent is limited to existing business, or non-business, relationships — however, if no business dealings have occurred within the previous two years, the business relationship is no longer considered to be existing. All messages sent without such a pre-existing relationship require express consent from the recipient prior to sending the CEM. The CRTC guidelines also set forth acceptable consent mechanisms for the use of toggles/check boxes to obtain express consent.

The draft Industry Canada regulations provide additional exemptions to obtaining prior consent for certain types of commercial electronic messages. The exemptions are clarified in the regulations for (i) family relationships, (ii) personal relationships, (iii) employee or other business representatives communications to other employees or other business representatives within an organization, or between organizations that have an existing business relationship at the time the message is sent, and where the message concerns the affairs of the organization or the role of the person within the organization, (iv) responses to an inquiry solicited by the person to whom the message is sent, (v) certain messages sent from outside Canada for goods or services outside Canada when the person sending the message did not know, or could not reasonably be expected to know, that the message would be accessed using a computer system inside Canada, (vi) certain rights or obligations under the law, or enforcement of law or legal obligations, and (vii) certain third-party referrals (one time communication for referrals from friends, family, and clients).

As the comment period for the newly issued regulations comes to a close and the comments are considered by Industry Canada, there will undoubtedly be more to follow to clarify the scope of the prior consent requirements. Industry Canada intends to issue interpretive guidelines and other guidance material to provide additional clarity.

In looking at both CASL and CRTC, privacy professionals queried how one could possibly comply with the law to obtain prior consent before sending an email in a non-exempt communication, raising debate about how this could logically be accomplished. Would you have to send a letter by post, or ask in a face-to-face contact? There is no clarification on this question in the Industry Canada regulations.