Breckenhill

Whether your needs are for contracted or permanent resources, or that highly qualified executive to lead your organization, Breckenhill has the right certified professional for you!

CASL: One and one-half years later
March 31, 2016

Gary Dickson Q.C. Gary Dickson Q.C.
Senior Consultant,
Privacy Expert
Brief History

Since CASL, Canada’s federal Anti-Spam law, has now been in force for more than a year and a half, it is appropriate to reflect on the first 18 months experience and consider what lies ahead for the direct email marketing industry in Canada.  But first here is a brief history of CASL.

CASL had actually been in the ‘works’ since the federal government launched its Anti-Spam Action Plan for Canada in 2004.  Initially, Industry Canada led a private sector task force to look at the problem of unsolicited commercial email (“spam”).  That Task Force on Spam found that, at the time, spam constituted 80% of all email traffic, worldwide.  After consideration and consultation with a round table of national stakeholders, the Task Force issued its final report in 2005 and recommended the creation of an anti-spam statute.

Bill C-27, the Electronic Commerce Protection Act was introduced in Parliament in 2009.  At the Committee stage, many organizations made representations to Parliament on changes they wanted made to the bill. However, before all proposed amendments could be considered and before the bill could be passed by Parliament, a national election was called and the bill died on the Order Paper.

Then Bill C-28, CASL was introduced in Parliament in May of 2010.  It was similar but not identical to Bill C-27 since a number of new features were incorporated that were not in Bill C-27.  CASL (Bill C-28) came into force, for most of its provisions, on July 1, 2014.

Brief Description

CASL is comprehensive and complex.  Chief responsibility for enforcing CASL is vested in the CRTC but the Act also amends other legislation to confer complementary enforcement powers on the federal Privacy Commissioner and the Competition Bureau. The CASL regulatory scheme features administrative penalties and also creates, as of July 1, 2017, a new right of civil action for consumers who have been targeted by businesses in violation of CASL.

The focus of CASL is on commercial activity that is defined to include “…any particular transaction, act or conduct or any regular course of conduct that is of a commercial character…”.  A “commercial electronic message” (CEM) is one that encourages participation in a commercial activity.  CASL prohibits sending a CEM unless the recipient has consented to receiving it.  The consent can be either express (explicit) or implied.  The CEM must include certain prescribed information including: 
  • Identity of the sender (and if sent on behalf of someone else, that person’s identity)
  • Contact information to allow ready contact with the sender, and
  • An unsubscribe mechanism when the recipient no longer wishes to receive these CEMs

There are requirements for the process to obtain someone’s express consent to receive CEMs.  These requirements include clearly identifying the purpose for which consent is sought and the person seeking consent (and if sent on behalf of someone else, that person’s identity).

There are special requirements if someone wants to rely on implied consent to send CEMs.  One of four different situations must apply in order for a business to rely on implied consent.

  • Pre-existing business relationship
    • This is time-limited i.e. 2 years after purchase of a product or 2 years from the day a membership or subscription ends.
  • Pre-existing non-business relationship
    • This may a charitable organization or political party which has received donations or in-kind contributions from the recipient
  • Conspicuous publication
    • This requires that the address of the recipient was disclosed without any restrictions and the CEM relates to the recipient’s functions or activities in a business or official capacity.
  • Previous e-communication from the recipient who hasn’t declared they do not wish to receive these CEMs. 

If a company is relying on implied consent on the basis of a pre-existing business or non-business relationship that existed on July 1, 2014 that consent lapses either on July 1, 2017 or whenever the customer revokes their implied consent, whichever happens first.

Experience to date

Most of the large businesses that utilize direct e-mail marketing in the Canadian market appear to have obtained and now rely on express consent from individuals.  There are reports that for smaller e-mailers, compliance with the requirements of implied consent may be problematic.

The Email Experience Council (EEC) recently undertook a survey of its members in the United States and Canada concerning their approach to CASL compliance and the costs involved in doing so.  76 members responded to the Internet based survey.  Most of the businesses were headquartered outside of Canada but did marketing in this country. Mindful that this was a non-probability voluntary survey, the results are qualitative and cannot be extrapolated to the universe of email marketers, there are nonetheless some interesting findings.

Responses varied with the different questions ranged from a high of 76 to a low of 39.   70 (92%) of the 76 firms that responded to the survey were either in the direct marketing business or provided support services to those businesses that did.

The proportion of revenues directly originating from direct e-marketing to consumers and other businesses for those respondents that had revenues varied from as little as 10% to 100%.  Most of the responding businesses sell to Canadian consumers and businesses.

Two thirds of the businesses that send CEMs to Canadians reported that they had lists consisting of both express and implied consent based lists.

The respondents (measured by the number of subscribers) were evenly distributed (Chart 2).

Nearly one half of the respondents reported sales greater than $1,000,000 with 30% having sales greater than $10,000,000 (Chart 3).  This may be indicative of a capacity to adapt and/or adjust to changes in the regulatory regime.

More than two thirds of the responding businesses ask for express consent (Chart 4).  This suggests that the businesses are well positioned for changes in the consent regime in the summer of 2017.  

Of the companies that contact Canadian consumers, 50% of the contacts are associated with express consent.  Nearly 50% of the companies reported that their contacts with Canadians were 100% express consent based.

With respect to Chart 5, of those respondents who estimated costs associated with converting to an express consent based CEM model, all but three reported conversion costs less than $100,000, but 50% of the respondents indicated that compliance costs were unknown.  It is important to note that the response to this question was the weakest in the survey and it is not obvious that this survey question was addressed by those individuals in the responding companies best equipped to respond.  Still, the response to this question suggests that compliance costs to the respondent may not be a significant deterrent to conforming to new requirements for consent.

With respect to Chart 6, other financial costs were reported in a manner similar to that of question 11 in the survey.  The weakness in the response to this question may be attributable to the vagueness and wording of the survey question.

Enforcement Action

As of February, 2016 the CRTC had received over 500,000 complaints.  More than 94% of complaints dealt with the issue of consent.  Those include both the initial consent and unsubscribe requests.  In response, the CRTC has issued a number of formal Notices of Violation and Undertakings (a kind of settlement agreement).  The CRTC reports that it has also been creating supplementary tools including warnings, citations and advisories.  Some of the compliance issues identified by CRTC include insufficient proof of consent and inadequate records to justify reliance on implied consent and misguided attempts to blame non-compliance on service providers.  A not uncommon problem has been that organizations have been poorly organized to respond in a timely way to an unsubscribe request.  

Since CASL came into force CRTC enforcement actions included:

  • Compu-Finder was issued the first Notice of Violation under CASL.  This meant a $1.1 million administrative monetary penalty for sending CEMs without consent and then offering what amounted to an ineffective mechanism to unsubscribe.

  • PlentyofFish Media provided an undertaking and paid a $48,000 administrative penalty for an alleged failure to offer customers a clear and effective unsubscribe mechanism.

  • Porter Airlines provided an undertaking and paid a $150,000 administrative penalty allegedly for failing to prove consent for CEMs, for transmitting inadequate CEMs and failing to use an appropriate unsubscribe option.

  • Rogers Media Inc. entered into an undertaking and paid an administrative penalty of $200,000 for allegedly offering an inadequate unsubscribe mechanism and lack of timeliness in responding to unsubscribe requests.

  • Avis Budget Group Inc. (and its car rental companies Aviscar and Budgetcar) was the subject of proceedings initiated by the Competition Bureau under CASL seeking $30 million in administrative penalties and compensation to customers for allegedly deceptive marketing of vehicle rental rates in CEMs.

The future

There is some indication that while larger direct marketing corporations have made the transition to an express consent model, smaller businesses are not yet fully compliant with CASL requirements.  This may be attributed to inadequate record systems to enable those businesses to rely on implied consent, lack of capacity or systems to move from implied consent to express consent or lack of awareness of the technical requirements of CASL in order to have a compliant consent.  It remains to be seen what will be the impact of the recent enforcement actions undertaken by CRTC and the relatively large administrative penalties on those smaller direct mailing businesses and their compliance efforts.  

For more information about CASL see the CRTC website at http://crtc.gc.ca/eng/casl-lcap.htm.

Gary Dickson