On July 1, 2014, the central provisions of the Canadian Anti-Spam Law (“CASL”) came into force. ^[1] These provisions generally prohibit the sending of a Commercial Electronic Message (“CEM”) without a recipient’s express consent, and unless the CEM contains certain proscribed sender identification information and an effective unsubscribe mechanism. CASL provides a number of nuanced exceptions to the express consent requirements of the law. The primary enforcement agency of CASL is the Canadian Radio-television and Telecommunications Commission (CRTC). The CRTC has several compliance tools to enforce CASL, including the issuance of Administrative Monetary Penalties (AMPs) against individuals and organizations that have violated CASL’s provisions.

Due to CASL’s broad applicability, exacting standards, and potentially severe financial penalties, companies that do business in Canada are advised to implement appropriate compliance measures to address the provisions of CASL. Companies sending emails to recipients in Canada must tailor their compliance programs to CASL’s complex set of consent exceptions and patchwork of guidelines, interpretations, and enforcement actions. To date, the CRTC has brought only four major CASL enforcement actions, but many investigations are ongoing and further clarification with regard to the most heavily utilized exceptions is expected. The following provides a snapshot of information concerning the Canadian Anti-Spam Law:

Consent Exceptions: 

1. CASL does not apply to electronic messages sent:
   1. Internally within an organization.
   2. Between organizations in a relationship, where the message concerns the recipient.
   3. In response to an inquiry from the recipient.
   4. To satisfy a legal right or obligation.
   5. From Canada and accessed in another “listed” country, and the message complies with the “listed” country’s spam laws. 
   6. By a sender who has a “family” or “personal” relationship with the recipient. 
   7. By or on behalf of a charity soliciting donations. 
   8. By or on behalf of a political party soliciting donations. 
2. CASL applies, but consent is not required where a CEM only:
   1. Provides a quote or estimate.
   2. Facilitates, completes, or confirms an existing transaction. 
   3. Provides a warranty, a product recall, or safety information. 
   4. Provides factual information about products or services. 
   5. Delivers products, updates, or upgrades that the recipient is entitled to receive. 
3. CASL applies, but consent from the recipient is implied where:
   1. The recipient and sender have an “existing business relationship.” 
   2. The recipient and the sender have an “existing non-business relationship.”
   3. The recipient has conspicuously published or provided his or her email address. 

Questions to consider when evaluating CASL: 

1. Have you performed an assessment of your organization’s electronic communications to determine if they qualify as CEMs?
2. Do any consent exceptions apply to your organization or your organization’s CEMs, or do you have a special relationship with the recipient such that consent is implied?
3. If no consent exception applies, have you implemented a procedure to capture “express consent,” including providing: (i) the purpose of requesting consent; (ii) the name of the entity requesting consent; (iii) a mailing address plus phone number, email, or web address; (iv) a statement that consent can be withdrawn; and (v) an affirmative opt-in mechanism?
4. Do your CEMs include the proscribed sender indemnification information and a functioning unsubscribe mechanism?
5. Do you honor all requests to unsubscribe within 10 days?
6. Does your mailing list include any recipient that has either unsubscribed from your CEMs or no longer qualifies for a consent exception?
7. Do you scrub your mailing list against your organization’s “do not e-mail list”?
8. Have you implemented procedures to test the effectiveness of your unsubscribe mechanism?
9. Have you reviewed your vendor contracts to determine each party’s responsibilities with regard to CASL compliance?
10. Does your CASL compliance program include senior management involvement, a written policy, risk assessments, record keeping, staff training, and a complaint-handling process?

[1] An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act, S.C. 2010, c. 23, Assented to 2010-12-15 ("CASL"), http://lois-laws.justice.gc.ca/eng/AnnualStatutes/2010_23/FullText.html.

[2] CASL, Section 20(4). 

[3] Government of Canada, CRTC Notice of Violation: 3510395 Canada Inc. (Compu.Finder), (March 5, 2015), http://www.crtc.gc.ca/eng/archive/2015/vt150305.htm.

[4] Government of Canada, Canada’s Anti-Spam Legislation – FAQs for Businesses and Organizations, (January 15, 2015), http://fightspam.gc.ca/eic/site/030.nsf/eng/00304.html.

[5] CASL, Section 91.

[View source.]