Anti-Spam Checklist & Action Items for Compliance
by Chris Oates, Associate, Gowling Lafleur Henderson LLP
Canada’s new anti-spam legislation will come into force on July 1, 2014, and will require express consent to send most forms of
commercial electronic message. Implied consent will exist in narrow, defined, circumstances. This document is intended to
provide information regarding some of the key compliance requirements under CASL. For legal advice regarding your specific
circumstances, please seek legal representation.
Consent
A Request for Express Consent to send Electronic Commercial Messages must include:

The purpose for which the consent is sought;

The name under which the person seeking consent carries on business, and if different, the name under which the
person on whose behalf consent is sought carries on business;

An indication which person is seeking consent, and on whose behalf consent is sought (if applicable);

The mailing address, and one (or more) of a telephone number, website, or email address of either the person
seeking consent, or if different, the person on whose behalf consent is sought
Example: [unchecked box] “I agree to receive ______ e-communications from _____ Angel investors group. These
communications may include newsletters, publications, invitations, announcements and other news or information regarding
the startup community and our organization. You may later withdraw your consent. Please refer to our Privacy Policy or
contact us at [mailing address] or [telephone number, email address, or web address] for more details.
Requirements for Implied Consent:

There is an “existing business” or “non-business relationship” between the sender and the recipient,
o
An ”existing business relationship” only exists where: i) the recipient purchased, leased, or bartered goods,
services, or land from the sender within the two years prior to the message; ii) the recipient accepted a
business opportunity from the sender in the two years prior to the message; iii) there is a written contract
between the recipient and the sender about a matter not referred to in i) or ii) that either is in existence, or
expired in the two years prior to the message; or iv) the recipient made an inquiry or application to the
sender regarding anything in i) or ii) in the six months prior to the message.
o
An “existing business relationship” will only exist where: i) the recipient made a donation or gift to or
volunteered for the sender in the two years prior to the message, and the sender is a registered charity, a
political party, organization or candidate; or ii) the recipient was a member in the two years prior to the
message with the sender, and the sender is a non-profit club, association or voluntary organization,
organized and operated exclusively for social welfare, civic improvement, pleasure or recreation.
or

The recipient has conspicuously published their address, or has disclosed it to the sender and:
o
The recipient has not indicated they do not wish to receive commercial messages at that address; and,
o
The message is relevant to the recipient’s business, role, functions or duties in a business or official capacity
Determining whether CASL applies:
HL30B – 101 College Street, Toronto, ON M5G 1L7 | P. 416.628.1458 | F. 416.363.0406 | E. info@nao-ontario.ca | W. nao-ontario.ca
Is there a “commercial” electronic message sent to an “electronic address”?
CASL will apply to “commercial electronic messages” that are sent to an “electronic address”. “Electronic address” is broadly
defined in the law, and includes:




an electronic mail account;
an instant messaging account;
a telephone account; or
any similar account.
This will include email, text or SMS messaging, and potentially emerging communications technologies that are analogous to
an electronic address. CASL is not only about email!
Meaning of “commercial” electronic message: “For the purposes of this Act, a commercial electronic message is an electronic
message that, having regard to the content of the message, the hyperlinks in the message to content on a website or other
database, or the contact information contained in the message, it would be reasonable to conclude has as its purpose, or one
of its purposes, to encourage participation in a commercial activity, including an electronic message that:

Offers to purchase, sell, barter or lease a product, goods, a service, land or an interest or right in land, or that
advertises or promotes any of these;

Offers to provide a business, investment or gaming opportunity or that advertises or promotes any of these;or

Promotes a person, including the public image of a person, as being a person who does anything referred to above,
or who intends to do so.
Note: “commercial activity” means any particular transaction, act or conduct or any regular course of conduct that is of a
commercial character, whether or not the person who carries it out does so in the expectation of profit, other than any
transaction, act or conduct that is carried out for the purposes of law enforcement, public safety, the protection of Canada, the
conduct of international affairs or the defence of Canada.
Commercial Electronic Messages Must Contain:
Under CASL, commercial electronic messages must contain:

The name under which the person seeking consent carries on business, and if different, the name under which the
person on whose behalf consent is sought carries on business;

If applicable, an indication which person sent the message and on whose behalf it was sent; and

The mailing address, and one (or more) of a telephone number, website, or email address of either the person
sending the message, or if different, the person on whose behalf it is sent.

An unsubscribe option that:
o
Allows the recipient to unsubscribe from any commercial electronic messages, or any class of such
messages, from the sender, or – if different – on whose behalf it is sent;
o
Functions through the same electronic means as the message, or another electronic means if that is not
possible; and
o
Specifies an electronic address, or a link to a webpage, to which the request can be sent.
The electronic address or website included in the unsubscribe mechanism must remain active for 60 days after the message
was sent. On receipt of an unsubscribe request, the organization must give effect to the request in no later than 10 business
days.
Third Party Mailing Lists:
CASL creates onerous requirements where consent to send commercial electronic messages is obtained on behalf of an
unknown third party, as would often be done by a commercial list broker. In such a case:
HL30B – 101 College Street, Toronto, ON M5G 1L7 | P. 416.628.1458 | F. 416.363.0406 | E. info@nao-ontario.ca | W. nao-ontario.ca
1.
The party seeking consent must comply with the standard CASL requirements for obtaining consent to send
commercial electronic messages.
2.
The third party allowed to use the consent must comply with the standard CASL requirements for disclosure in a
message (identifying the sender, and providing prescribed contact information and an unsubscribe list). In addition,
the message must identify the person who initially obtained the consent.
3.
The unsubscribe mechanism must allow the message recipient to remove consent from both the person who sent
the message, the person who obtained the original consent or any other person authorized to use the consent.
As a practical matter, these extensive compliance requirements will mean that third party lists must remain separate from the
organization’s own opt-in list to ensure they can be complied with.
Exceptions:
CASL will not apply to:






messages sent between employees of an organization relating to the affairs of the organization;
messages sent between two organizations with a relationship, where the message relates to their affairs;
messages that respond to an inquiry, complaint, or other solicitation from the recipient;
fundraising messages sent by or on behalf of a registered charity;
messages where the person sending the message reasonably expects it to be received in a foreign state listed in the
Regulations and the message complies with the law of that state;
messages sent to satisfy a legal obligation or provide notice of an existing or pending right;
Exception for a single referral message:
A single referral message may be sent where:

The referral is made by an individual who has an existing business relationship, existing non-business relationship,
family, or personal relationship with the message recipient;

The referrer has one of those relationships with the sender of the message;

The message states the full name of the person who made the referral, and states that the message was sent as a
result of the referral.
The Family and Personal Relationship Exception
Neither the requirement to obtain consent, nor the requirement to disclose information regarding the sender applies if the
message is sent by or on behalf of a person who has a “personal or “family” relationship with the recipient, as those
relationships are defined in the regulations.
Penalties:
CASL creates very high penalties that are much more severe than any penalty available under current Canadian Privacy law.
These include:



An administrative monetary penalty of up to $1,000,000 for a violation by an individual.
A administrative monetary penalty of up to $10,000,000 for a violation by a corporation.
A private right of action, that may be exercised by an individual alleging they have been affected by a violation, for
damages and a statutory penalty of $200 per contravention, not to exceed $1,000,000 for each day on which a
contravention occurred. This private right of action will not come into force until July 1, 2017.
Action Items:
CASL will come into force on July 1, 2014. Organizations will need to take actions now to ensure that their existing lists are in
compliance with CASL, and to ensure that their requests for consent and message disclosure is compliant going forward. To
this end, organizations should:
HL30B – 101 College Street, Toronto, ON M5G 1L7 | P. 416.628.1458 | F. 416.363.0406 | E. info@nao-ontario.ca | W. nao-ontario.ca









Audit their current contact list to evaluate their continued ability to send commercial electronic messages to it.
Industry Canada and the CRTC have indicated that existing express consent valid under the current privacy laws will
continue to be valid after CASL. However, implied consent that is acceptable under the current law will not survive,
unless it falls under one of the exceptions, or categories of implied consent, defined in CASL. Organizations should
consider:
o Whether they can demonstrate express consent
o Whether they can demonstrate implied consent, as defined in CASL
o Whether their consent list includes active or non-active members (based on most recent investment
activity or membership paid) that would fall under the definition of an “existing business relationship”
o Whether they cannot demonstrate consent, which would be a compliance issue both under CASL and the
existing privacy law.
Prior to July 1, 2014, initiate an email opt-in campaign to those who have not expressed consent (this can be sent in
tandem with another e-communication i.e. invitation or e-newsletters), to solicit express consent that will survive
CASL. Note that after July 1, 2014, it would be necessary to have consent to send such a message, as a message
seeking consent to send commercial electronic messages itself requires consent to send.
If the organization is unable to establish either express or CASL complaint implied consent by July 1st, 2014, it must
make the necessary deletions to its email list.
Develop an ongoing strategy to ensure express consent is obtained in compliance with CASL, and that documents
express consents (i.e. email policies, sign-up forms, etc.).
Review your procedures for maintaining an accurate and current list for which you can establish implied consent
through an existing business relationship. The ability to rely on implied consent will be much narrower under CASL
than under current legislation.
Review the categories of CEMs you distribute to identify those that fall within exceptions to the consent
requirements.
After CASL comes into force, ensure your CEMs provide the prescribed information and contain a functional
unsubscribe mechanism.
Ensure you are able to honour unsubscribe requests within 10 business days.
Ensure compliance throughout the organization, including by revisiting current employee and contractor processes
and practices. Train any staff and third-party agencies involved in the dissemination of commercial electronic
messages to comply with CASL and your compliance policy. Inform them of the consequences for failing to comply.
TOR_LAW\ 8335188\1
HL30B – 101 College Street, Toronto, ON M5G 1L7 | P. 416.628.1458 | F. 416.363.0406 | E. info@nao-ontario.ca | W. nao-ontario.ca