In 2014, the anti-spam provisions of Canada's Anti-Spam Legislation (CASL) came into force, creating a wide array of compliance requirements for businesses. On October 7, 2014, the CRTC announced the conclusion of its first investigation and enforcement action under CASL (see our blog post on the enforcement: CRTC Concludes First Enforcement Under Canada's New Anti-Spam Legislation). While the CRTC exercised its discretion and declined to levy fines in that investigation, an investigation alone can generate significant costs and obligations for businesses. If your business is subject to investigation under CASL, there are several ways in which you may be able demonstrate compliance with the legislation and avoid the significant penalties associated with non-compliance. One such option is to prove that you have recipient consent.
CASL and its regulations obligate a person to obtain the consent of the recipient before sending a commercial electronic message (a CEM). The legislation recognizes both express and implied consent.
CASL and the regulations provide several requirements to demonstrate that sufficient express consent was received for the above activities. To have properly obtained express consent, among other things: (i) such consent must have been sought separately for each particular activity; (ii) such consent may not have been obtained through a general terms and conditions agreement for a commercial product or service; and (iii) such consent was obtained through an active, positive act from the recipient (an "opt-in" situation). Additionally, it is important to remember that, although CASL specifically provides for both express and implied consent, either in writing or oral, it is often easier to evidence written express consent.
Implied consent, for example conspicuous publication, the acceptance of a business card, an existing business relationship or an existing non-business relationship, complies with the consent requirements under CASL, but is harder to evidence. It is important to document dates that business cards are received, as well as the cards themselves, and retain records of correspondence or dealings with businesses or individuals that you believe you have an existing business or non-business relationship with. Implied consent in respect of prior business or non-business relationships is generally time-limited under CASL for a period of two years, though CASL allows for a transitional period for implied consent until July 2017.
If your organization has obtained an express consent before CASL came into force (July 1, 2014), this consent remains valid until the individual revokes such consent. In the event of an enforcement action, your organization should locate documentation of any pre-CASL consents.
As CASL creates a positive obligation on a business to obtain consent, businesses investigated for non-compliance with CASL and the regulations must be able to demonstrate that they complied with any and all of the consent requirements for any of the above activities. Accordingly, if your business is subject to investigation regarding electronic transmissions and you are not exempt, you will be required to establish sufficient consent for the transmission in question.
Demonstrating consent can be a time-consuming and expensive process, as the burden of proof is on the investigated business or individual, not the complainant. It may be particularly difficult to demonstrate that oral consent exists “ the same is true for implied consent. As a result, it is prudent practice for businesses to create and maintain a compliance policy which includes a method of tracking and recording consents, both express and implied, as well as detailing revocation of consent by individuals. For more information, visit our Anti-Spam Learning Centre “ you may also be interested in our other blog posts in the series "Defending Enforcement Under CASL."
Defending Enforcement Under CASL Series
- First Steps if You Receive a CASL Enforcement Notice (Feb 10, 2015)
- Establishing Due Diligence (Feb 12, 2015)
- What is a Commercial Electronic Message? (Feb 17, 2015)
- Establishing Consent (This article)
- Establishing an Exemption is Applicable (Feb 23, 2015)
- Compliance with Informational Formalities (Feb 26, 2015)
Bennett Jones