Before You Hit Send: How Canada s New Anti-Spam Law Will Affect You

Transcription

1 Before You Hit Send: How Canada s New Anti-Spam Law Will Affect You International Association of Business Communicators June 17, 2014 Adrian Liu Lawyer (416) aliu@blg.com Outline Canada s New Anti-Spam Law (CASL) Introduction why it is important? Status coming into force on July 1, 2014 Details what is required? Enforcement/Penalties what are the risks? Most importantly what you need to do NOW to prepare -2-1

2 Not Just Spam Not just commercial electronic message any electronic message with a commercial purpose (includes s and text messages) Not just s to the general public Applies to s sent to individuals and businesses Not just mass s Technically a single can be spam Not just in Canada Requirements Prohibits sending a commercial electronic message to an electronic address unless: (1) the recipient has given express or implied consent (a consent requirement) AND (2) the message has certain information about the sender and an unsubscribe mechanism (a content requirement) s sent from Canada, or to a recipient in Canada Can include s sent from outside Canada to recipients in Canada

3 Public Relations World Examples of s Caught Under CASL: s promoting your firm or agents s promoting a PR event or product launch s to TV journalists or media, asking them to plug an event s E-blasts to the general public during PR for your client s cold calling new or potential clients and more! Express Consent Must be OPT-IN consent e.g., the box must be unchecked, and proactively checked by recipient Verbal consent possible, but must keep records

4 Express Consent Request for consent must clearly and simply specify: 1. purpose for which consent is sought 2. for the person requesting consent and the person on whose behalf consent is sought: identity business name and actual name (if different) contact information (mailing address and telephone number, or web address) 3. statement that the recipient may withdraw consent Different from privacy law consent -7- What You Need to Do Before July 1 Have you already obtained consent? Prior consents may be grandfathered Incentive to request consent from your contacts in an before July 1, 2014 Under CASL, cannot request consent to receive commercial messages via Express consent is the gold standard - otherwise, need to rely on an exemption - 8-4

5 Implied Consent When express consent not necessary (use with caution ) Existing business relationship people who bought a product/service from you in the past 2 years people who have a written contract for products/services that is current or expired in the past 2 years Existing non-business relationship members of a club or trade association current or in the past 2 years donors or volunteers of a registered charity current or in the past 2 years Implied Consent Published Business Contact Information Recipient conspicuously published electronic address without prohibition and message is relevant to recipient's business or official capacity Provided Business Contact Information Recipient disclosed electronic address to sender without prohibition and message is relevant to recipient's business or official capacity

6 Exceptions from CASL Messages not considered spam : messages between family members messages between persons with a personal relationship responses to a request for a quote, inquiry or complaint (also gives you 6 months of implied consent) intra-organization messages and messages between organizations, if they have an existing relationship (business to business) messages sent under a legal right or obligation Exceptions to Consent Requirement (content and unsubscribe still required) Pending Transaction Messages that solely facilitate, complete or confirm a commercial transaction previously agreed to by the recipient Previous Transaction Messages that solely provide warranty, recall, safety or security information for a product or service used or purchased by the recipient Factual Notice Messages that solely contain factual information about ongoing use of a product or service under a subscription, membership or account purchased by the recipient messages sent by registered charities with fundraising as the primary purpose

7 CASL and Specific Marketing Practices Third Party Lists still allowed, but must obtain consent to share with third parties recipient must be able to withdraw consent for unknown third parties by unsubscribing from any sender Referrals The Good News (kind of ) Transition Period Consent is implied for 3 years after CASL comes into force if: the sender and the recipient have an existing business or nonbusiness relationship on the date CASL comes into force AND the relationship includes the communication of CEMs no consent required for the first message sent to a potential referral must identify the person who provided the referral and state that the message is being sent due to the referral person providing referral must have an existing relationship (business, non-business, family or personal) with the sender and the referral

8 Content Requirements 1. Information about the Sender Message must clearly and prominently : identify the person sending the message and the person on whose behalf the message is sent e.g., marketing firm for both the person sending the message and the person on whose behalf the message is sent: business name and actual name (if different) contact information (mailing address and telephone number, or web address) -15- Content Requirements 2. Unsubscribe Button Must be effective and free accessible using same electronic means that the message was sent or, if not practicable, an alternative electronic means Must also provide an address or link to unsubscribe Unsubscribe must be implemented within 10 business days

9 Enforcement Liability can be imposed on: sender or persons that cause or permit a message to be sent employers, who are liable for acts of employees/agents within scope of employment /agency corporate directors and officers, who are personally liable if they direct, authorize, or assent to, or acquiesce or participate in a contravention Due diligence defence (burden on defendant) Civil Penalties Administrative (non-criminal) monetary penalties up to $1 million per violation for individuals up to $10 million per violation for organizations can be increased by regulations Unlimited fines and imprisonment for false/misleading messages

10 Private Right of Action Private right of action not in effect until 2017 summary determination (not a conventional trial) compensatory damages private fine up to $200 per message or up to $1 million per day risk of class actions! What Do I Need to Do? 1. WHAT kinds of spam do you send? 2. WHO do you send it to? 3. HOW do you obtain new contacts? Need to talk to your marketing and IT/ management teams

11 Preparing for Compliance Audit/Assessment Audit current practices, assess application of CASL Education Develop policies and training for employees Express Consent Establish procedures to collect, record and prove express consent renew consents before the law comes into effect or during the 3 year transition period for existing business relationships cull lists of non-conforming consents (significant risk of noncompliance) establish opt-in and renewal tools on contest entries, web pages, and applications -21- Preparing for Compliance Implied Consent Establish procedures to verify, record and prove implied consent, including by reference to the 2-year rule difficult to do with organically-developed lists, at least looking backwards develop procedures to refresh lists on a rolling basis Formalities Develop internal procedures to ensure that all CEMs comply with prescribed formalities and are accurate

12 Preparing for Compliance Opting-Out Systems Develop internal procedures to implement opt-out notices no room for error 10 day grace period refresh existing procedures developed for privacy compliance Contracts Review contracts with resellers, distributors and marketing agencies for compliance, and conduct due diligence Preparing for Compliance Due Diligence Establish documented due diligence procedures for directors and officers Bulletins Reports Audits Monitoring/Responding Establish procedures for monitoring compliance and responding to violations in a timely way

13 Preparing for Compliance Insurance Consider insurance coverage (scope and limits) for liability arising from CASL violations Remember the Big Picture Don t forget other privacy and advertising obligations (or common sense) CASL consent is not a replacement for privacy consent -25- BLG Advertising, Marketing and Sponsorship Group National Leaders Alexandra Nicol Montreal anicol@blg.com Eva Chan Toronto evachan@blg.com Regional Leaders LuAnne Morrow Calgary lmorrow@blg.com Victoria Prince Toronto vprince@blg.com Alexandra Nicol Montreal anicol@blg.com Robert J.C. Deane Vancouver rdeane@blg.com

14 Questions? Adrian Liu (416) This presentation is intended to provide general information only to authorized users and does not constitute legal advice. No user should act on the basis of any material contained in the presentation without obtaining legal advice specific to the user s situation