Audit, Compliance and Risk Blog

Knowing CASL’s exemptions is key to learning how it applies to your business.

It’s July 2—the day after Canada’s Anti-Spam Legislation (CASL) came into effect. You’ve just started a new job. Your predecessor left behind a binder containing the business cards of clients. You start your day by sending out emails to the addresses on those cards to introduce yourself and to ask if you can put the recipients on your contact list for future potential business offers.

You may have just broken the law.

Nine of the 10 people you contacted had an ongoing relationship with your company through your predecessor, so the emails you sent were probably safe. There’s an implied consent to receive emails from a business when there is an ongoing relationship.

But one of those business cards belonged to someone your predecessor met at a business function but never got around to contacting, and who had no previous dealings with your company.

Your predecessor could have sent an email to that contact with impunity, since consent was given when he was handed a business card. You, on the other hand, did not have that person’s implied consent.

While the above hypothetical situation is unlikely to result in a fine, it is the sort of pitfall businesses need to watch for when implementing policies for complying with CASL, which goes into effect July 1.

The new law can be baffling because it is riddled with exceptions and exemptions. “Businesses need to have a plan with how they’re going to comply with CASL,” said Andrew Aguilar, co-author of the guidebook Internet Law Essentials: Canada’s Anti-Spam Law. “They should sit down and look through the messages that they’re sending, in advance, and determine how many of the messages they send fit into exempted categories. It’s going to be very difficult for people to do on the fly.”

The one rule-of-thumb question businesses need to ask when coming up with a policy on electronic messages is: Does the message have a commercial intent? If it doesn’t, you’re off the hook—it does not need to comply with CASL, which applies only to so-called CEMs (commercial electronic messages.)

If it does have a commercial intent, you need either the implied or express consent of the recipient to send any form of electronic message. Whereas implied consent has a shelf life and will expire, express consent does not expire once granted.

Getting express consent involves the recipient actively signing up on a website, responding affirmatively to an email, giving consent over the phone, agreeing in a sales contract or signing up for it at the point of sale.

Businesses also need to ensure that the messages they send include an unsubscribe option and contact information.

On the technology side, phone calls, voice messages and faxes are exempt. So, after July 1, if you want to approach a prospective new client with whom you have had no prior relationship, it’s safer to make a phone call than to send an email.

But here’s another exception: If you obtained an email address (or phone number, if you are sending a text message) from a publicly published document or website, then that is considered implied consent, meaning you can at least send that initial email. But you can’t continue to send emails, texts or newsletters without the recipient’s express consent.

Generally speaking, CASL does not apply to electronic messages sent to family and friends. Nor does it apply to solicitations for donations from political parties or registered charities.

For Canadian businesses, two of the most important exemptions to be aware of are business-to-business communications and legal communications.

An email sent between businesses—or from a business to a customer—that is legally required does not have to follow CASL guidelines.  And electronic messages sent between businesses that have an existing relationship are generally exempt.

There is also a general exemption for business inquiries. A business that responds to an inquiry is exempt from CASL, unless the response contains quotes and estimates. Another exemption is closed messaging systems, BlackBerry’s BBM being the one most familiar to business people.

So what about sending an electronic message from Canada to a recipient in another country?
Many countries have their own anti-spam laws. Under CASL, Canadians sending CEMs to anyone in 116 countries listed in the legislation must conform to whatever law is in force in that country.

Fortunately, CASL is so overarching that it will likely either meet or exceed the anti-spam requirements in other countries.

“If you are complying with CASL, you are probably doing a lot more than you have to in other jurisdictions,” said Ryan Black, co-author of Internet Law Essentials: Canada’s Anti-Spam Law.
For more information on the new CASL regulations, visit fight-spam.gc.ca.  

Responding to Business Inquiries

Under CASL, businesses can still reply to emailed business inquiries with quotes and estimates, but the message would need to include the following:

• The name of the company sending the message (a PR firm or marketing agency, for example)

• The company on whose behalf the message is sent

• A mailing address

• Phone number, email or Web form allowing for some form of instant contact

• An unsubscribe mechanism (typically a link to a website).