Contents A. New Canadian Anti Spam Legislation Impacts How Travel Agencies Communicate With Clients 1. What constitutes a commercial electronic message (CEM)? Page 2 2. What must an agency do in order to comply with CASL? Page 3 3. Implied and Express Consent Page 3 4. Transition Period Page 3 B. Canada s Anti Spam Legislation (CASL) Impacts How Agencies Contact Clients Electronically 5. Where does an agency need to be compliant? Page 4 6. Key agency examples (but not all) where compliance is/may be required Page 5 7. Ensure consent is documented Page 6 C. Ensure Compliance with Canada s Anti Spam Law (CASL) 8. What steps can an agency begin today? Page 5 D. CASL Exemptions What Relationships Qualify As Existing 9. What CEMs Are Excluded From the Legislation? Page 8 10. Unsubscribe Mechanism Page 8 E. What Happens If CASL Compliance Is Not Met and the Agency Is Investigated? 11. Penalties Page 10 12. Consumer Anti Spam Reporting Centre (SRC) Page 10 13.Consent Requirements (Examples) Page 11 Articles Written By Coralie Belman CTM(HON), President, Coralium Consulting Page 1
New Canadian Anti Spam Legislation (CASL) Impacts How Travel Agencies Communicate With Clients How travel agencies communicate with clients will be restricted by new legislation aimed at protecting consumers from unsolicited spam commercial electronic messaging (CEM). Businesses that are not compliant could face legal actions, including fines as of July 1, 2014. This deadline is now just two months away. Ask yourself: Is your agency ready? Has the agency reviewed how it communicates with clients to see if there are compliance implications for the business? This legislation is aimed at protecting consumers from unsolicited spam messages. But in the process of doing that it also restricts the ability to communicate information that they may in fact wish to receive because that information falls under the umbrella of a CEM. So that means an agency must meet the objectives of the law. There are two components to the legislation to be considered: (1) Type of consent to be provided by clients (2) Content of the CEM that clients have agreed to receive To understand the implications of this for an agency it is important to start with the knowledge of what is a CEM, what are typical CEM methods that agencies employ and what type of consent an agency may currently have with its clients. Important to Note CASL requires positive opt in consent vs passive opt out consent Agencies should try to obtain Express Consent prior to July 1, 2014 CASL cannot be combined with other forms of consent such as T & C or PIPEDIA What constitutes a commercial electronic message (CEM)? Pretty much any way an agency communicates by an electronic means is considered a CEM. Fax, email, text, newsletter, instant messenger, LinkedIn, Facebook, Tweets, Skype, blogs, or any other similar means of telecommunication. The content of the message encourages participation in a commercial activity. For example: an offer to purchase travel products, an offer to join a home based business opportunity, or promotion of a person carrying out these activities. Many agencies engage in at least one form of CEM, so the legislation basically impacts each and every business. If we didn t wish to capture sales or stimulate interest in purchasing a travel product we would not go to the effort of writing newsletters and sending out tweets about specials. So if we want to continue to apply marketing in this fashion, it s time to get compliant with the new law. Articles Written By Coralie Belman CTM(HON), President, Coralium Consulting Page 2
What must an agency do in order to comply with CASL? An agency must have on record (meaning documented proof) the Express or Implied Consent of the client in order to receive the CEMs from the agency. The onus of due diligence rests with the agency to obtain this consent before the legislation goes into effect on July 1 st. What is the difference between the two forms of consent and which one is best to have on record? Implied Consent is when a business or non business relationship already exists. For example the consumer has disclosed their email address to the agency perhaps by completing a ballot for a draw or by requesting some information on a trip previously. However, that doesn t mean that they agreed to be in an agency s database and be communicated with in various forms of CEM. Therefore Implied Consent is not as strong or all encompassing as Express Consent. Implied Consent may be valid under two conditions (1) Up to a maximum of two years previous where there was communication between the client and agency about a travel purchase. If there has been no further purchase or two way communication since that time then an agency is not allowed to continue to market to the client using CEMs under Implied Consent. (2) If a client contacts the agency requesting information but does not make a purchase within a 6 month period then Implied Consent is no longer valid after that 6 month time frame. Basically to sum it up, Implied Consent has expiry dates. Express Consent is valid until the client says no more, so in effect no expiry unless the relationship changes. An agency may continue to market to the client using a variety of means until the client requests to be removed from the distribution list, Express Consent has three areas to be noted: (1) It must be documented (written proof) (2) It may be obtained verbally or written if obtained verbally a record of how and when the conversation took place needs to be recorded (3) It must be broad enough so that all current forms and potential forms of CEM are considered. An agency does not want to have to go back and get client consent again if for example they do not currently issues newsletters but start to in the future A Transition period for compliance exists The legislation grants business a 3 year window of opportunity to convert Implied Consent clients into Express Consent clients. The catch is once this legislation goes into effect on July 1 st the method of converting a client over cannot be by using a CEM. So it is important to act now to try and obtain this conversion as at this moment agency database programs may be used to generate email broadcasts to a client database but soon this option will expire. Instead consent will need to be obtained either verbally and documented accordingly or by regular mail. This is the main reason agencies need to pay attention to CASL now as obtaining the Express Consent could take some time. For more information agencies may consult www.fightspam.gc.ca 30 Articles Written By Coralie Belman CTM(HON), President, Coralium Consulting Page 3
Canada s Anti Spam Legislation (CASL) Impacts How Agencies Contact Clients Electronically Canada was the last of the 20G countries to enact Anti Spam legislation and in doing so has set up the most sweeping, hardest to comply with and containing the most nasty penalties according to Jennifer Babe, Associate with Miller Thomson, a leading Canadian law firm. One area of key consideration is the Opt In versus Opt out methods of consent to receive commercial electronic messaging (CEM). Many companies have relied on the Opt out method in the past whereby a consumer had to un click a check box if they did not wish to receive messages. The legislation refers to this as being a passive consent. Under the new law passive consent is no longer legal. Instead agencies must employ an Opt in checkbox for the client to check agreeing to receive CEMs. This is referred to as being a positive consent. In an agency uses an Opt out method of consent on its website or in email they should ensure this is updated by July 1 st when the legislation goes into effect. A check box for each form of consent is required. According to Babe, CASL is very clear on two points within the legislation: that consent cannot be bundled in with terms and conditions nor can it be a passive consent, meaning that the consumer has be aware to un click a consent box. In practical terms this means that an agency must have a separate check box for CASL, the Privacy Act and for Terms and Conditions. Where does an agency need to be compliant? A successful travel business relies on soliciting clients and communicating with them about travel specials and specific interests. Contacting clients that reside in an agency database has been taken for granted as a right. With the implementation date coming soon, agencies should be examining their business for areas of compliance that are required and acting upon them. Important to Note: An agency employee(s) should be assigned the task to ensure the agency s compliance and think about where consent may need to be obtained Agencies should determine any third party compliance requirements that may be required as a result of training or off site booking engines Agencies need to ensure a mechanism is in place to record when and how consent was obtained especially if that consent was verbal because due diligence for consent rests with the sender of the CEM. If an agency has not completed a CASL review yet, the examples that follow may prompt an investigation into business practices to see how compliance may be met. Articles Written By Coralie Belman CTM(HON), President, Coralium Consulting Page 4
Key agency examples (but not all) where compliance is/may be required: Trade show, contest and promotional event client data. Consider how this data is collected and subsequently used by the agency. Is it from a ballot type entry? Has an Express Consent checkbox been added and explained on the ballot? Is Express or Implied Consent documented in the agency s database? Has the agency contacted its client list to advise them of the types and frequency of CEMs that will be sent out and has the client agreed to receive them? Is there an online booking engine as part of the agency s website? Does the server collect and store client data as a result of this booking engine. Are clients using the booking engine aware of this and have they given consent? Are any employees using personal Facebook accounts to promote travel purchases? When Facebook updates are posted consider if it is informational only, or is there a link to book travel products and if so then this changes the primary intent of the update/post to a commercial focus and consent is then required for a consumer to receive the Facebook updates. Corporate travel agencies that allow booking engines at a business location may need to provide software updates to the business (example GDS updates) this is considered a third party access and requires CASL consent. Some travel agencies have been dealing with the provincial travel insurance legislation requirements by having a separate dedicated line, desk or email for insurance bookings at a head office location. If an individual agent is going to refer their client to this dedicated person and their place of business is away from the agency address then consent to transfer client information needs to be collected. Internal email communication between staff members must remain business focused. A staff member can t solicit sponsorship/donations using a business email address unless the colleague gives consent. Have employee manuals and / or office procedures and policy manuals been updated to reflect this compliance? If someone at the agency receives referrals from being part of a Business Networking or Chamber of Commerce group an agency is allowed only one CEM contact with the potential client and if they do not respond the agency cannot continue to contact them unless it obtains Express Consent by a non electronic form. Does the agency have a policy and procedure in place to handle referrals that all employees have been advised about to ensure legislation compliance is met? Ensure consent is documented. Agencies must ensure they have recorded the consent agreement in case they are required to provide proof at a later date. This may mean setting up a dedicated information box in a customer relationship management (CRM) system such as ClientBase where the date, time, purpose and manner of consent are recorded. The onus is on the business to ensure compliance is being met. For complete information on compliance terms and policies agencies may consult http://fightspam.ca 30 Articles Written By Coralie Belman CTM(HON), President, Coralium Consulting Page 5
Ensure Compliance with Canada s Anti Spam Law (CASL) The July 01 implementation date of Canada s new law is approaching quickly. There are some quick fixes that an agency can do to start meeting compliance and some long term actions that need to be started. Either way agencies should be taking steps now to meet the new legislation. If they don t and if someone puts in a complaint against the agency then fines for a small business are very high. Important to Note Meeting compliance will take some time, July 1 st is around the corner, do not procrastinate What steps can an agency begin today? Review How Your Business Currently Contact Clients Prepare a checklist that each employee can complete about how they currently keep in contact with clients through electronic messaging with commercial messaging. Your agency will need to document what are the methods (fax, email, text, newsletter, instant message, LinkedIn, Facebook, Tweets, Skype, blogs etc.). Then a note about frequency needs to be recorded. Example does the agency send a monthly newsletter, update Facebook pages on a daily or weekly basis. And before you panic remember what is the CONTENT of the message? Is it informational or does it carry a call to action to book travel, which makes it a commercial message. Example if an employee just posts a blog about a trip on a blog site it is not a commercial message. But if they post that blog and then say contact me to find out how you too can experience Ireland then it is no longer just a blog and becomes a commercial electronic message. Start Recording Client Consents In Documented Proof Now Assign each employee to review their clients in the agency s database. Select a blank field where employees can record CASL compliance and make sure that field is consistent for each employee. They will need to record if consent is Implied or Express, the date consent was received and if it was obtained by an oral or written means. It is also good to note how it was obtained. Example trade show ballot. This task is going to be very challenging as agency staff have likely not kept track of how or when clients agreed to be contacted in the past. Or clients may have agreed to receive a newsletter but not other forms of social media. In reality, the agency is probably are starting from scratch to obtain consent again. START NOW. This is going to take some time to receive client replies. And remember that staff training on this procedure and documentation should be completed so it is handled consistently in the office. Add CASL Consents to Current Information Are there any forms employees currently use with clients that need to have a CASL checkbox added? Update the agency s prize or trade show ballot entries so they are ready to go as a template next time they are used. Is positive messaging in place on the agency s website or on certain documents why a client would want to give the agency their CASL Express Consent? Is there a method in place to record verbal consent? Review this procedure with staff so it is handled consistently. Articles Written By Coralie Belman CTM(HON), President, Coralium Consulting Page 6
Put A Policy And Procedure In Place For Unsubscribe Requests All unsubscribe requests must be actioned within 10 days. An unsubscribe option must be included in all of the commercial electronic messaging (CEM) your staff sends out. This may not have been part of the procedure previously. Review some recent CEMs sent out and start now to add the unsubscribe options. This must be an active link that takes the client directly to the unsubscribe mechanism. Test this link and ensure it is working properly. Consider adding a reference line to CEMs reminding clients they are receiving this information because they have Opted In to receive messages from your agency. Ensure Each Form of Consent Has A Dedicated Check Box On the agency s website there is often a box that indicates a client agrees to terms and conditions or has read the agency s privacy act compliance. A CASL box should be added at this point as well. If the agency s website had a paragraph about how the business complies with the Privacy Act add in another paragraph with a heading about the agency s CASL compliance. Review and Update Website Items and Privacy Act References Update the agency s website privacy policies and terms of use. For example adjustments may need to be made about when client records are discarded or destroyed from a privacy perspective as the CASL legislation may have difference requirements. What other documents feature the agency s privacy policy? Example: corporate proposals. These documents may need to be reviewed and updated. Enable Opt In Mechanisms Any CEM sent needs to have an Opt In mechanism to continue to receive information. Most examples in the past were a passive Opt Out mechanism. This could mean a change is required from an IT perspective, Act now. It could take some time to change over an IT system. Third Party Contracts Make a review of any third party contracts that may require CASL compliance and contact those companies to ensure you have everything in place prior to July 1 st. Examples include: automatic cards for birthdays or special occasions, destination reports etc. Also consider from an employee point of view what they may need to Opt In to receive. For example information coming from an employee benefits package provider. Staff Training If a compliance review was to take place at the agency, policies and procedures need to be in place and be handled consistently by staff. As an agency owner don t assume everyone gets it. Ensure that the policy is recorded in Employee Manuals or Handbooks, in any Policy and Procedure documents and that staff review has been completed. Assign one staff member to monitor compliance to the policy. Old habits can die hard. But the onus will be on the business owner to ensure compliance is in place. For complete information on compliance terms and policies agencies may consult http://fightspam.gc.ca 30 Articles Written By Coralie Belman CTM(HON), President, Coralium Consulting Page 7
CASL Exemptions What Relationships Qualify As Existing Sometimes legislation can be difficult to interpret. While we want to comply as much as possible we are also hoping for some exemptions to limit our compliance, if we can. There are some forms of commercial electronic messages (CEMs) that are exclusions from the legislation or may be excluded from the consent requirements however they may still be subject to information requirements. What does this mean exactly? What CEMs Are Excluded From the Legislation? Communication between individuals who have a personal or family relationship (spousal/child) Messages sent in response to a request, inquiry or complaint or that is solicited by the person who sent the message to the business. Example a quote provided to a consumer in response to a request by them for information. Messages sent internally within a business by an employee where the CEM concerns the activities of the business. Sending a message asking another employee to sponsor a charity event, buy tickets, or buy a child s fundraising activity is not acceptable, Messages sent between businesses where they have a relationship and the message concerns the activities of the organization to which the CEM was sent. Providing factual information about a product or service offered under a subscription or similar basis. Example if you needed to update a client about a travel purchase they had made where details had changed. Advising a client that their annual insurance policy is about to expire and if they have requested to be notified as a reminder to repurchase. First contact to a referral to quote someone about a travel product purchase. This is a frequent occurrence when an employee may belong to a business networking group. The law allows the agency to contact that referral once and if there is no response then contact by commercial messaging must cease until consent is received. This may mean having to contact the referral by telephone instead and then obtain the referral s verbal consent to continue to contact them by email. In all cases however, these messages should include the unsubscribe mechanism. Examples of Unsubscribe messages from the CRTC website are found below. If it is not practical to include the actual unsubscribe mechanism in the message, the method can be by means of a link in the message as long as it is clear and easily performed. Articles Written By Coralie Belman CTM(HON), President, Coralium Consulting Page 8
Examples from CRTC 2012 548 For complete information on compliance terms and policies agencies may consult http://fightspam.gc.ca Articles Written By Coralie Belman CTM(HON), President, Coralium Consulting Page 9
30 What Happens If CASL Compliance Is Not Met and the Agency Is Investigated? It would be wonderful if we lived in a world where people did not complain or decide that they wanted to catch someone or some business for catching sake. Most of us have at some point come up against the customer who is impossible to satisfy, the disgruntled employee the person who has an axe to grind against us. It only takes one complaint against an agency to perhaps instigate an investigation that could then cost an agency a lot of money and time spent. Both in fines and in immediate compliance costs. What Are the Penalties? There are two types of fines that are monetary penalties. (1) Individuals up to $1 million per violation (2) Corporations up to $ 10 million per violation CASL also allows for a private right of action by anyone affected by a prohibited act, including the right to statutory damages to a maximum of $ 1,000,000 per day. ($200 for each commercial electronic message sent). What this means is: (a) if your agency sends out a CEM to a client list and (b) the agency does not have the consent of someone on that list, and (c) they in turn decide to report the agency, and (d) the government steps in to investigate and (e) finds other recipients have not provided consent to receive CEM (f) the agency could be faced with a whole whack of fines Penalties Impact Individuals and Companies The Act also allows for extended liabilities to officers or directors of a business for wrongful acts or vicarious liability for its employees. What this means is that an individual such as an agency owner can be sued as well as the business. Often Director s Insurance will cover legal fees for representation but it will not cover the fines that may need to be paid. So there is potential for personal financial hardship if compliance is not in place. Consumers Have Access to An Anti Spam Reporting Centre (SRC) Consumers, businesses and other organizations will be able to report CEMs sent without consent or that contain false or misleading content as of July 1 st. They will do this through the government website http://fightspam.ca Articles Written By Coralie Belman CTM(HON), President, Coralium Consulting Page 10
This complaint will be actioned by the three anti spam enforcement agencies (the CRTC, Competition Bureau, and Office of the Privacy Commissioner) under CASL. Consent Requirements Examples from CRTC 2012 548 Use the following examples to formulate the agency s messages for client consent to receive CEMs. Articles Written By Coralie Belman CTM(HON), President, Coralium Consulting Page 11
Articles Written By Coralie Belman CTM(HON), President, Coralium Consulting Page 12
For complete information on compliance terms and policies agencies may consult http://fightspam.gc.ca 30 Articles Written By Coralie Belman CTM(HON), President, Coralium Consulting Page 13