Understanding the New Anti-Spam Legislation


By now, if your business sends out e-mails (dubbed commercial electronic messages or CEM's by the Feds) then you have no doubt heard and thought about the new Canadian Anti-Spam Legislation (CASL) that is set to come into effect on July 1st, 2014.  Many businesses have surely not had the time to really understand the new legislation and how it may impact your current operations.  This post will hopefully help you get going in the right direction.

What is it?


In a nutshell, it is designed to prohibit CEM's from being sent or received in Canada unless each recipient has consented to receiving them from a clearly identified sender, and the message contains an easy, no cost unsubscribe mechanism.

The key word "consent" is defined in two ways:  Express and Implied

"Express Consent" is the easiest to understand. It entails contacting the prospective recipient and letting them know who you are, what information you are planning to send along with a statement indicating that consent can be withdrawn at any time This consent provides the most protection and will endure until the recipient unsubscribes.  However, this request can only be sent by e-mail prior to July 1st, 2014 to respect the legislation and may result in a significant reduction in the size of your list as many people ignore your request or re-evaluate their consent to receive information from your organization. 

"Implied Consent" is a bit more complicated and can be difficult to track.  It provides businesses with a temporary right to send CEM's to recipients with whom they have an existing "business relationship" or "non-business relationship" which is defined as follows:

An "existing business relationship" is defined as when the recipient has purchased a product or service from the sender within the past two years or has accepted a business or investment opportunity from the sender within the past two years; and where a written contract is in force between the recipient and sender, or has expired within the past two years.  It will also be deemed to exist for six months after an individual makes an inquiry to the sender of the CEM regarding the purchase a product or service, or a business or investment opportunity.

A business is deemed to have Implied Consent to send a CEM to an individual if that individual has conspicuously published their email address, without providing a disclaimer that they do not wish to receive unsolicited CEMs, and the CEM is relevant to the individual’s business role.  There is no time limit in this case but the recipient retains the right to unsubscribe at any time.

Finally, consent will be implied as well if the recipient has disclosed their email address to the sender without an accompanying statement that they do not wish to receive unsolicited CEMs and the CEM is relevant to the recipient’s business capacity.  As in the conspicuous publication situation, this form of implied consent is not subject to a time limit. 

Now comes the tough part, what should your organization do?


What should you do?

Many businesses are asking this question right now, especially given the high potential cost of infractions and their desire to play within the rules.  The answer will differ based on your current situation but in all cases you should start by evaluating your particular situation by asking the following question:

What CEM's is your company sending and to whom? 

There is no single strategy but the following may help get you going in the right direction. 

If you are sending prospective e-mails to a purchased list then, if possible, you will want to send them a quick e-mail asking for their express consent before the July 1st, 2014 deadline.  After the deadline, you should stop using those lists.

If you are using a CRM system or an e-mail marketing service and sending e-mails to a targeted list of current customers and prospects who have been given the opportunity to unsubscribe with each mailing then you can either ask for "Express Consent" before July 1st, 2014 or determine whether your list contains current customers and prospects (based on the legislation's definitions) that would be covered by the rules giving Implied Consent.

We have had a few of our Sage CRM clients inquire about developing a process in their CRM to manage the CASL requirements...just another example of the flexibility of a good CRM program to adapt to business needs.  Remember as well that a Sage CRM licence is available at no cost if your organization is current on Sage 300 ERP.

The good news is that despite the timelines set out above, if your business has an existing business or non-business relationship with an individual on July 1, 2014, and already sends that individual CEMs, the implied consent will be deemed to continue until July 1, 2017, or until the recipient withdraws it.  This will provide businesses with additional time to get Express Consent and develop a process for tracking whether a potential recipient is still current with their Implied Consent.

Also, if you are not sending e-mails with an unsubscribe mechanism then you should probably consider implementing a process using either a CRM system or a cloud-based e-mail marketing service (we use Sage E-marketing) that incorporates this feature in their offering.

Lastly, the other thing you may want to consider if you haven't already done so, is making the jump to social networking as part of your marketing strategy.  You would need to commit to posting content such as this article that people freely choose to receive in the manner that suits them.  There are plenty to choose from but the most common would be to start by creating a blog or creating a company profile on LinkedIn, Twitter or Facebook.

For more information, you can visit the CASL website or the Law Firm Emond Harnden's helpful post