The Canadian Anti-Spam Legislation (#CASL): The Bane of the Canadian Communication Industry

I attended the Canadian Anti-Spam Legislation (CASL) Session last week in Toronto. The new legislation, effective July 1, 2014 is stirring up the marketing industry, with marketers struggling to really grasp the essence of the new law and what it means to their individual businesses.

Bravo to the DMA for getting all the marketers out. Not surprisingly, a session entitled with such scare and urgency would draw audience within an entire industry.

Here’s the gist of the legislation:

Canada’s Anti-Spam Legislation (CASL), which was passed in 2010, establishes rules for sending commercial electronic messages (CEMs) as well as the installation of computer programs, and prohibits the unauthorized alteration of transmission data. Although CASL is not yet in force, the government announced in December 2013 that CASL will be implemented in three phases; the majority of CASL comes into force July 1, 2014, the rules that apply to computer programs will come into force January 15, 2015, followed by the private right of action on July 1, 2017.

The Competition Act has been amended to prohibit false or misleading representations in the sending of a CEM, whether in the content, subject line, or sender information of a message.

CASL extends beyond email. It also covers texts, SMS, Twitter, Facebook ie any message coming in to an electronic inbox via computer or phone that is commercial in nature.

The Cost of Non-Compliance is Significant

Visible opt-out or unsubscribe policies were part of an established norm set about when Permission Marketing was introduced in the late 90’s. Seth Godin had written some best practices about the use of this-then-new-medium known as email:

Permission marketing is the privilege (not the right) of delivering anticipated, personal and relevant messages to people who actually want to get them.

It recognizes the new power of the best consumers to ignore marketing. It realizes that treating people with respect is the best way to earn their attention.

Almost 14 years later, the digital industry has evolved and the very rules that Permission Marketing established have been dismissed and exploited by “hard-core” Spammers. #CASL and the CRTC are coming to the forefront to crack down on this unrelenting practice and by and large, impose significant penalties for non-compliance. Each violation can mean fines up to $1 million for individuals and up to $10 million for companies. What’s more by 2017, this leaves organizations vulnerable to class action lawsuit.

At first blush, the legislation, while intended to give power back to the consumer, may also hamper business to a large degree. My friend, who has asked to remain nameless, works for a company that not only utilizes database promotions, but also evolved digital communications. Here was his take on what CASL means for this industry:

CASL is about to send Canadian Digital Business back to the stone ages…the intent was spam…but this blunt, overreaching, overkill and unimaginative piece of legislation will impact every attempt to deliver smart and engaged digital media and neuter Canadian businesses ability to compete…

The Radical Change: Explicit Consent

OPT-IN is now the new norm. CASL specifies the following requirements for obtaining express consent:

1. The purpose of consent
2. For whom or what organization for which it’s being obtained
3. Include a statement that can dismiss consent at any time ie unsubscribe
4. Include contact information – mailing address, telephone number, email of web address

What’s important is a that a party must prove (as of July 1, 2017) they’ve obtained consent from all individuals to whom they are communicating. This proof must be disclosed “clearly and simply” ie tangible proof through paper, or electronic message. It will be important for business to keep a copy of all forms and to track the version from which customers have opted in.

For business, the biggest challenge will be converting verbal consent at the point of sale to an audio proof of consent.

Lists are at Risk

The biggest impact #CASL has is within list industry.

Rented Lists are compliant as long as the original list owner obtains user consent on behalf of the list renters and may be stated in this way: “We will, from time to time, send you promotions on behalf of partners and sponsors. Please click here if you consent to receiving these emails.”

As well, the list owner must deploy emails on behalf of the list renters.

Compiled Lists that are purchased have a much rockier road ahead. This industry’s death is imminent. For parties that have purchased lists, it will be imperative to obtain express consent since there is no implied relationship with the base members.

We have a grace period: Transition to July 1, 2017

July 1, 2017 is a critical date. This means that for 3 years up until July 1, 2017 companies can leverage this transitional period to acquire explicit permission from existing business and non-business relationships. That means that if a business has been sending CEMs to a customer prior to July 1, 2014, consent is implied and will continue to be implied up until July 1, 2017 (or until the customer unsubscribes).

In the last few weeks, I have received emails from large organizations (in anticipation of the July 1st legislation) sending out the following emails to their databases:

When I spoke to Matthew Vernhout, Chief Privacy Officer from Inbox Marketer, he noted that companies who send out an email like this en masse  risk losing a large percentage of their customers in one fell swoop. To mitigate this loss, Matthew suggests embedding consent within an existing promotional email. Marketers can, as a matter of practice going forward, include a link at the bottom of promotional emails that allows the consumer to “click to agree to consent”. This should link to a form that captures the date and customer consent.

It’s important to note that no action ie “not” clicking the consent or “not” unsubscribing does NOT constitute consent. Proof of explicit submission must be obtained.

Implied Consent: defined

If a company has emailed an individual prior to July 1, 2014 and that individual has not given explicit consent, the business may assumed implied consent under #CASL rules up until July 1, 2017.  What this means:

• the sender and recipient have an existing business relationship (e.g., the recipient has made a purchase within the past two years, or an inquiry within the past two months);
• the sender and recipient have an existing non-business relationship;
• the recipient has conspicuously published their electronic address(e.g., on a website), has not expressly stated that they do not wish to receive unsolicited messages, and the message is related to the recipient’s professional capacity; or,
• the recipient has disclosed their electronic address directly to the sender, has not expressly stated that they do not wish to receive unsolicited messages, and the message is related to the recipient’s business or official capacity.

#CASL Exceptions

Note there is an extensive list to which #CASL does not apply including:

• those with whom the individual or business has a personal/family relationship
• private networks e.g. online banking
• those currently engaged in business activity
• those employees, consultants, franchises connected to the organization, where messages concern the activities of that organization
• the full list can be found here.

Social Media continues to be the Gray Area

For those of us who practice within this new media space, there was less clarity defining the rules governing real time conversions and B2B social platforms like LinkedIn.  Legal opinions concerning these areas were largely contradictory.

On one hand, a Privacy officer noted that CRTC have exempted public feeds within #CASL. Only DMs (direct messages) apply.  A contrary view from a Privacy lawyer noted that as long as CEMs are sent to an electronic mailbox (where Twitter can provide notifications about “public” activity), this is inclusive of #CASL.

Does #CASL in Social Media imply that “Every Electronic” Communication in 140 characters must include a consent link?

I questioned Matthew Vernhout, Chief Privacy Officer and requested clarity in the following areas:

Hessie Jones

Founder at ArCompany, and Director, International Council on Global Privacy and Security by Design Hessie is a  seasoned digital strategist, and intelligence analyst having held senior positions for top ad agencies including Ogilvy, Rapp Collins, ONE and Isobar Digital. She also has extensive start-up experience in AI technologies, social tech, online publishing and artificial intelligence like Yahoo! Answers, Overlay.TV, Jugnoo and Cerebri AI. Hessie is the co-author of EVOLVE: Marketing (as we know it) is Doomed! She is also  an active writer for Forbes, Cognitive World, Towards Data Science and Marketing Insider Group.