CANADA S ANTI-SPAM LEGISLATION: CHARITIES AND NOT-FOR-PROFITS

Transcription

1 CANADA S ANTI-SPAM LEGISLATION: CHARITIES AND NOT-FOR-PROFITS Association of Corporate Counsel's Nonprofit Organizations Committee May 20, 2014 Presented by Tricia Kuhl

2 Overview I. General Obligations under CASL II. Exemption for Registered Charities III. Best Practices to Prepare for Compliance IV. Enforcement & Penalties for Violation V. Canada vs. EU and US VI. Tips of the Trade 2

3 I. General Obligations under CASL When sending a commercial electronic message (CEM) to an electronic address, ensure: Consent has been obtained (express or implied); and Form and content requirements are met 3

4 Key Definitions What is a commercial electronic message (CEM)? Message sent by any means of telecommunication (e.g. text, sound, voice or image) that has as its purpose, or one of its purposes, to encourage the participation in a commercial activity CEMs include electronic messages that request consent to send a CEM 4

5 Key Definitions What qualifies as an electronic address? an an instant messaging account a telephone account any similar account 5

6 Express Consent Requires active opt in May be obtained orally or in writing Sender must set out clearly and simply: Purposes for which consent is being sought Specific information about the person seeking consent and if applicable, the person on whose behalf consent is being sought Statement that the person can withdraw their consent 6

7 Express Consent Example used in Compliance and Enforcement Information Bulletin CRTC

8 Implied Consent Existing Business Relationship Existing Non-Business Relationship During Transition Period 8

9 Form & Content Requirements What information must be provided in a CEM? Specific information that identifies the sender, or person on whose behalf CEM is sent Statement indicating which person is sending the CEM and which person on whose behalf the message is being sent, if applicable Information enabling the recipient to contact the sender of the CEM, valid for 60 days A functional unsubscribe mechanism that meets prescribed requirements 9

10 II. Exemption for Registered Charities CASL does not apply to a CEM that is sent by or on behalf of a registered charity as defined in subsection 248(1) of the Income Tax Act and the message has as its primary purpose raising funds for the charity. 10

11 III. Best Practices to prepare for compliance To whom do you send messages? What is the purpose of the messages you send out? What type of consent do you obtain, if any? Do you use pre-checked boxes? Do you have an unsubscribe mechanism? If so, is it functional? Do you include contact information for your organization? Are you a registered charity? What type of relationships do you have with the recipients of your s? Do you track your communications with the recipients of your s; i.e. do they respond to you? Do they inquire into your organization? Do they participate in events? Do they volunteer? 11

12 III. Best Practices to prepare for compliance REVIEW whether electronic messages are exempt from CASL DETERMINE whether you have express or implied consent ASSESS if the message complies with the form and content requirements UPDATE privacy policies 12

13 IV. Enforcement CRTC Spam, spyware, altering transmission data Competition Bureau False or misleading information in electronic messages Privacy Commissioner Collecting electronic addresses or personal information Private Rights of Action All contraventions under CASL Class actions possible 13

14 IV. Penalties Violation Penalty/Fine/Offence Private Right of Action Sending unsolicited commercial e-messages Altering transmission data Installing computer programs without consent Maximum per breach: $1,000,000 for individuals $10,000,000 for corporations $200 /day per breach, not to exceed $1,000,000 /day up to $1,000,000 /day up to $1,000,000 /day 14

15 IV. Penalties (cont d) Violation Penalty/Fine/Offence Private Right of Action Making false and misleading representations in e- messages Collecting e-addresses using computer programs Collecting personal information through unauthorized access to a computer system Up to 1 year imprisonment and up to $200,000 in fines (on summary conviction) Up to 14 years imprisonment and a fine at the Court s discretion (on indictment) Maximum per breach: $1,000,000 for individuals $10,000,000 for corporations $200 for each occurrence, not to exceed $1,000,000 / day Maximum of $1,000,000 / day 15

16 V. CASL: Toughest in the world? ANTI-SPAM LAW CAN-SPAM ACT EU Directive 2002/58/EC Messages covered all commercial e-messages only applies to (although new case law took expansive interpretation re: social media) most e-messages Consent Regime Requires express opt-in consent (if exemptions do not apply) opt-out mixed Scope applies if any element of the message is commercial applies to messages sent from within or outside of Canada but accessed from within Canada applies only where the primary purpose of an message is commercial applies to any message sent over a public communications network 16

17 V. CASL: Toughest in the world? ANTI-SPAM LAW CAN-SPAM ACT EU Directive 2002/58/EC When consent not required general exemptions (s. 6(5) & (6)) opt-out regime not specified When consent implied exceptions (s. 10(9)) opt-out regime similar to CASL existing business relationship Identification requirements sender person on whose behalf message sent contact info sender s postal address identify message as advertisement or solicitation sender cannot disguise or conceal identity in message Unsubscribe requirements valid for 60 days after message sent sender must give effect immediately valid for 30 days sender can send messages up to 10 days after request e-messages must contain valid address to which unsubscribe request can be made 17

18 VI. Tips of the Trade 1. Identify current practices 2. Assess which electronic messages and computer programs are covered by CASL 3. Assess status of consents 4. Develop appropriate consent language and processes 5. Upgrade and obtain consents as necessary 6. Ensure unsubscribe mechanism is operational and complies with prescribed requirements 18

19 VI. Tips of the Trade (cont d) 7. Implement robust data management and operational controls 8. Adopt internal policies and guidelines and training programs 9. Adjust and adapt contracts 10. Follow-up / audit practices to ensure ongoing compliance 19

20 CONTACT US Tricia Kuhl Montréal Partner