The government has announced when its long-awaited new anti-spam laws will go into effect. While the industry is breathing a little easier thanks to some concessions made to marketers, not every question has been answered.
Canada’s anti-spam legislation (CASL) will come into effect on July 1, 2014, banning the sending of commercial electronic messages – including e-mails and text messages – without prior consent from the recipient.
Businesses and industry associations have lobbied since 2010 for exemptions to the legislation, arguing CASL would render many legitimate marketing practices illegal.
But some changes to the final regulations were greeted as good news for the marketing industry.
“The big win that we’ve been working on for three years is the fact that you do not have to go out and re-qualify your existing express consents in your database,” said John Gustavson, president and CEO of the Canadian Marketing Association (CMA). “The [former] rule that even if you had express consent under our privacy law, you had to go out and get fresh consent… was going to be an enormous cost for big business.”
Industry Canada had continually rejected the grandfathering of consents obtained under the Personal Information Protection and Electronic Documents Act (PIPEDA) – something marketing groups like the CMA lobbied for after the initial draft was published in 2011.
While the regulations do not state consents obtained under PIPEDA will be grandfathered, prior express (or opt-in) consents will remain valid. Industry Canada’s Regulatory Impact Analysis Statement released with the final regulations on Dec. 4 stated that “express consents, obtained before CASL comes into force, to collect or to use electronic addresses to send commercial electronic messages will be recognized as being compliant with CASL.”
However, implied consents will be not recognized, noted Barry Sookman, partner at Toronto law firm McCarthy Tétrault. PIPEDA permits “opt-out consent” for marketing messages, meaning if a person does not clearly decline consent, consent is granted.
“Unless marketers have databases that have differentiated between express consents and implied consents, then it means those aren’t grandfathered at all,” said Sookman. “Everybody understood that the standard was going to move to express consent, but the failure to grandfather the implied consents is going to be a problem.”
Adam Kardash, chair of Heenan Blaikie’s national privacy and information management practice, said there are some helpful changes contained in the regulations. For instance, the right of action, which would allow consumers and business to take civil action against anyone who violates CASL, will be deferred for three years.
“It’s not an outright removal of the private right of action, so that is a very significant concern and will remain so for organizations,” said Kardash. “What it does is just give some breathing room.”
Secondly, CASL will not apply to messages sent to people in countries listed in the regulations as having their own anti-spam legislation. “They basically got rid of double jeopardy,” said Matt Vernhout, chief privacy officer and manager, deliverability at Inbox Marketer in Guelph, Ont. “You don’t have to follow both [sets of regulations]; you follow where the recipient is.”
But Kardash said even with these changes, “there will be considerable operational changes and expense associated with complying with the Act, such as for the centralization and management of consent practices for different types of electronic messages.”
Companies that don’t comply with CASL face fines of up to $10 million. But Vernhout said the CRTC’s goal is enforcing the law, not “putting companies out of business. They will go after companies that are blatantly violating the legislation and they will level fines accordingly.” In fact, CASL was created to deter the most damaging and deceptive forms of spam (those that enable identity theft, phishing and spreading spyware) and help drive out real spammers.
“From a consumer perspective, I’m very happy about it. I think it’s a good piece of legislation,” added Vernhout. “From a marketer point of view, it’s got big scary numbers, but if you’re following good practices and you’re following the opt-in process and you have functional unsubscribes, then compliance really isn’t going to be that big of a challenge.”
