Final CASL Regulations Released by CRTC

The Canadian Radio-television and Telecommunications Commission (CRTC) released the final form of its regulations on March 5, 2012. You can see them for yourself in the Canada Gazette (Canada’s version of the United States’ Federal Register). They are printed in the March 28, 2012 edition. This version is not a call for comments, but rather the release of the actual rules after considering the comments made in response to their prior “Call for comments on draft Electronic Commerce Protection Regulations” which was released last July.

These regulations are not much different than the previous draft, but the differences are significant.  First of all, these regulations make plain that business names are perfectly acceptable for use in consent gathering and notification.  For instance, Section 4(a) has changed from “the name of the person seeking consent and the person, if different, on whose behalf consent is sought” to “the name by which the person seeking consent carries on business, if different from their name, if not, the name of the person seeking consent”. So, you won’t have to give your actual name if you are doing business as a more recognizable entity.

These regulations, like the ones that they replace, continue to point out the basic difference between consent as it is considered from both the American and Canadian legal policy standpoints. The Canadian standpoint here continues to be that consent must first be extended and then may be revoked. The historical American position has tended more toward the idea that consent is something that may be assumed until it is explicitly denied. Canada’s standpoint is that consent is neither blanket nor transferable. Therefore, the law provides that sending electronic messages, altering transmission data, and installing computer programs must all happen by the consent of the user.  These regulations state that the consent step for each of these activities must be separate and distinct acts. With the exception of consent centered around the use of certain computer programs covered in Section 5, that consent may be given orally or in writing. If a computer program will be making changes to the computer on which it resides, or which will be collecting personal information on the computer’s users, then that consent must be obtained in writing, and again must be separate and distinct from any other consent gained.

So, that means that you will need to obtain separate consent for each messaging stream. Additionally, if you are selling computer programs, you will not be allowed to obtain consent to send messages while simultaneously obtaining consent from the user to allow the computer program to make changes to the system or collect personal information about its users.

Here is Section 4, which provides the requirements that must be met to gain consent to send messages:

1. the name by which the person seeking consent carries on business, if different from their name, if not, the name of the person seeking consent;
2. if the consent is sought on behalf of another person, the name by which the person on whose behalf consent is sought carries on business, if different from their name, if not, the name of the person on whose behalf consent is sought;
3. if consent is sought on behalf of another person, a statement indicating which person is seeking consent and which person on whose behalf consent is sought; and
4. the mailing address, and either a telephone number providing access to an agent or a voice messaging system, an email address or a web address of the person seeking consent or, if different, the person on whose behalf consent is sought; and
5. a statement indicating that the person whose consent is sought can withdraw their consent.

Nowhere is Canada’s explicit consent policy more evident than in the consent statements in Section 4 (b) and (c). These sections are the ones that are likely to make the continued use of append problematic for sending to Canadians.  Notice that these sections preclude the granting of blanket consent gained by one person which may then be used by another.

Further, if the person obtaining consent is not going to be the one ultimately using that consent, then both entities must be mentioned together.  Section 4(c) requires a statement which clearly delineates between the person who is asking for consent and the one who will actually be using that consent.

The one “catch” that you may find here is that Section 4(e) may render existing consent granted by your subscribers long ago invalid. While some companies do state that subscribers can leave a list at any time during the subscription process, those who have not historically done so may find that they need to re-gather consent in order to remain within the letter of the law.

Do remember that even though the Canadian statute includes an “implied consent” standard as well, the ExactTarget Anti-Spam Policy continues to require that our customers certify that they “will not use rented or purchased lists, email append lists, or any other list that contains email addresses captured in any other method than opt-in. The use of opt-out lists is prohibited in our system.” The great news there, though, is that this will put you in general compliance with the demands of Canada’s law.

Once you have gained consent, you need to include the proper information in each message. That information is found in Section 2(1) and looks a lot like the information that needed to be gained in order obtain consent:

1. the name by which the person sending the message carries on business, if different from their name, if not, the name of the person;
2. if the message is sent on behalf of another person, the name by which the person on whose behalf the message is sent carries on business, if different from their name, if not, the name of the person on whose behalf the message is sent;
3. if the message is sent on behalf of another person, a statement indicating which person is sending the message and which person on whose behalf the message is sent; and
4. the mailing address, and either a telephone number providing access to an agent or a voice messaging system, an email address or a web address of the person sending the message or, if different, the person on whose behalf the message is sent.

Mainly, this appears to be intended to cover affiliate mailings where one person is sending mail for someone else. Nevertheless, the requirements here are simple, and look much like the requirements that are already in use by marketers who are following the CAN-SPAM Act: Tell people who you are and how to reach you. If someone is mailing for you, then you need to make sure that their information is included too. If it is not practicable to include all of that information as well as the unsubscription mechanism that CASL demands (for instance in the case of marketing by a text message or maybe something like Twitter), then Section 4(2) says that it is okay to put that information on a web page or some other similarly easy to find and view method that does not cost the recipient anything to view.

Finally, all of this information, plus the unsubscription link, must be set out “clearly and prominently” in the message. There isn’t a definition of “clearly and prominently” set out in the regulations or the statute. This is likely meant to prevent some unscrupulous marketers from putting their unsubscription information in a tiny font with a color that matches the background of the message.  However, “clear and prominent” can mean a variety of things. I have seen definitions for the term that range from the US FTC’s “the larger of 12-point type or one-half the size of the largest letter or numeral used in the name of the advertised website” to this one from Canada which says “at least 2.4mm high”. So, the more clear that you can be, the better off you will end up.

We still don’t have the final regulations from Industry Canada, so keep checking back. Our team is continuing to monitor this law as it develops.

Note:  I am not an attorney licensed to practice in any jurisdiction. I can only provide my own understanding as an expert in email related issues. For actual legal advice, you need to pay an attorney for his time so that the vagaries of the law as they may apply in your specific circumstances can be accounted for.