Article
Guide to Doing Business in Canada: CASL
gowlingwlg.com
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
a. Jurisdiction “CASL applies to any CEM that is either sent from a computer within Canada or accessed by a computer in Canada.” b. Consent
a. Jurisdiction “even organizations operating solely outside of Canada will, in most cases, be required to comply with CASL if they communicate with Canadian clients or customers.” b. Consent
Response to an inquiry or complaint Any message sent in response to an inquiry or complaint, or which is otherwise solicited by the recipient, is exempt from CASL. “Messages sent to enforce a right, satisfy a legal obligation, or provide notice of a legal right, are exempt from CASL.” e. Use of third-party lists
1. Overview “CASL requires commercial electronic messages to contain certain disclosures and an unsubscribe mechanism.” CASL's computer software provisions are aimed at preventing the installation of unauthorized malware and spyware computer programs; however, they have varying degrees of impact on all types of software applications. Section 8 of CASL requires express consent to install a computer program on another person's computer system in Canada during the course of commercial activity. Enhanced disclosure and consent requirements apply where the software performs certain prescribed functions.
Records of consent CASL places the onus of proving the existence of consent on the person or organization claiming to have it. As such, it is important for organizations that send CEMs to retain records sufficient to establish that they have CASL compliant consent if they are ever faced with enforcement action. The CRTC has indicated that to help establish adequate proof of consent, organizations that send CEMs should retain records, such as any signed consent forms or completed electronic forms from individuals, documentation of the organization's consent processes, records of their policies and procedures in respect of CASL compliance, and a record of all unsubscribe requests and their resulting implementation. Because these records are typically compiled during the conduct of business for the purpose of establishing legal compliance, they are subject to production orders under CASL's regulatory framework. The Federal Court of Appeal in Compufinder required the CEM sender to demonstrate, with admissible documentary evidence, how it either gathered consent or how it satisfied one of the exemptions. Therefore, it is recommended that organizations create and maintain these records. “it is still necessary to comply with other CASL requirements, such as including the message disclosure requirements and unsubscribe mechanism discussed below.” c. Message disclosure requirements
1. Overview “before sending an electronic message that encourages participation in a commercial activity - including most standard promotional or advertising emails and texts - the sender must have either the express or implied consent, as defined under CASL, of each recipient.” CASL's computer software provisions are aimed at preventing the installation of unauthorized malware and spyware computer programs; however, they have varying degrees of impact on all types of software applications. Section 8 of CASL requires express consent to install a computer program on another person's computer system in Canada during the course of commercial activity. Enhanced disclosure and consent requirements apply where the software performs certain prescribed functions.
Consent is the cornerstone of CASL and most of the legislation's complexity lies here. In order to send any CEM, unless the message is otherwise exempt - as discussed later in this chapter - the sender must have the consent of the recipient to send the message. It is important to note that under CASL, the onus is always on the sender to prove consent. “There are two principal types of consent under CASL: express consent and implied consent.” Express consent CASL creates prescriptive requirements for express consent to receive CEMs. Express consent requires clear and informed consent on the part of the person consenting to receive the messages. The form of consent must be opt-in, rather than opt-out, and the person must be aware of the nature of the messages that they are agreeing to receive. Opt-ins cannot be buried in the terms and conditions of another service or contract, and must instead require a positive or explicit action on the part of the person providing his or her consent. Most commonly, express consent is obtained through a checkbox or a confirmation button on a form, web page or digital application. Any such checkbox cannot be pre-checked, and consent should never be assumed. CASL also requires the following information to appear with any request for express consent: An identification of the types of messages that will be received and the purposes of the consent The name by which the person or organization requesting consent carries on business, or their legal name If seeking consent for another person or organization, the name by which that person or organization carries on business, or their legal name, and an indication as to which person or organization is seeking consent for the other (e.g. if seeking consent for an affiliate) The mailing address, and either a telephone number providing access to an agent or a voice messaging system, an email address, or a web address of the person or organization seeking consent A statement indicating that the person whose consent is sought can withdraw their consent
An electronic message that requests the recipient's consent to receive further electronic messages is itself a CEM and, as such, may only be sent with prior consent. “This includes email, texting, instant messages, messages to telephone accounts, or messages sent to any "similar account", such as certain forms of social media messaging or other digital messaging systems where a message is sent by one person to one or more specific electronic addresses.” CASL also does not apply to electronic messages that are displayed to the general public rather than sent to an electronic address. For example, CASL will not apply to display advertisements such as banner or box advertisements, or to social media messages that are published through means more akin to a one-way general broadcasting such as a Facebook wall post. It will, however, apply to private messages sent through those social media platforms to one or more recipients, such as messages sent directly to other users through a two-way direct messaging system.
Referrals CASL allows for the limited sending of messages to new contacts based on referrals. Essentially, CASL will deem the sender to have consent to send a single message to a recipient where another individual has referred that person to the sender and has provided their electronic address. In order for this to apply, the individual who made the referral must be in certain types of prescribed relationships with both the sender and the recipient, and the referral message must contain prescribed disclosures and the prescribed unsubscribe mechanism. “organizations that send CEMs should retain records, such as any signed consent forms or completed electronic forms from individuals, documentation of the organization's consent processes, records of their policies and procedures in respect of CASL compliance, and a record of all unsubscribe requests and their resulting implementation.” Statutorily defined categories of messages A number of prescribed classes of electronic messages are exempt from the requirement to obtain consent, either express or implied, from the recipient. It should be noted that these messages are not exempt from the application of CASL. Rather, the sending of electronic messages under these categories is analogous to implied consent, as it is still necessary to comply with other CASL requirements, such as including the message disclosure requirements and unsubscribe mechanism discussed below. Such categories of electronic message include, but are not limited to, messages sent solely: To provide a requested quote or estimate regarding a product or service To provide warranty or product recall information about a product the recipient has purchased To facilitate or confirm a commercial transaction entered with the recipient To deliver a product or service that the recipient is entitled to receive under the terms of a transaction between the sender and recipient