New anti-spam law changes bring more confusion for business owners

by Avery Swartz,
Published in The Globe and Mail, June 8, 2017
Click to read on The Globe and Mail's website

Earlier this week, the federal government announced changes to the Canadian Anti-Spam Legislation (CASL), suspending the private right of action provision that was due to come into effect on July 1, 2017. The provision would have allowed class action lawsuits to be filed against individuals and organizations for alleged violations of the CASL legislation by sending unsolicited spam e-mail, text, instant message, Facebook message or any other commercial electronic message. The government says it will also ask a legislative committee to examine the legislation.

Scrapping the class action provision was due in part to a cry from small businesses and charities that were struggling to comply with CASL, fearing fines and lawsuits. With the most draconian provision of this new law off the table, business owners are breathing a sigh of relief. But does it really change what's expected of them?

CASL came into effect on July 1, 2014, confusing business owners and individuals across the country. CASL dictates that in order to send commercial electronic messages, you need to have consent from the message's recipient. Consent can come in the form of "express" or "implied" permission. And the onus is on the individual or business sending the message to keep records of consent – which type of consent it is, and how it was given. Express consent does not expire, but implied consent does, two years after the event that started the relationship.

Express consent is easy – someone signs up for your email newsletter on your website, or actively opts in to receive messages from you. Implied consent is a grey zone, determined by whether or not the sender of the commercial electronic message and the recipient have an "existing business relationship" such as a transaction, an inquiry, an application or a written contract for the purchase or barter of products, goods or services (or an "existing non-business relationship" which covers volunteer work, donations and gifts). Implied consent also includes "conspicuous publication" and "disclosure," meaning the recipient's contact information is published (i.e. listed on the contact page of a website) or given to you (i.e. exchanging business cards at a trade show). If an email sender contacts someone under the conspicuous publication or disclosure provisions of implied consent, the message sent must relate to the recipient's line of work.

Sound confusing? You bet it is. And scary too. The penalty for CASL non-compliance could be up to $1-million for individuals and $10-million for a business. Enough to make a small business owner's blood run cold.

In the months leading up to July 1, 2014, many businesses incorrectly assumed they needed to convert all their email recipients from implied consent to express consent. Or they needed reassurance that express consent was indeed given, and the date of the consent recorded. Emails went flying, asking if you'd still like to receive messages from businesses, and encouraging you to opt-in (again). This had a snowball effect for many small business owners. It seemed like everyone else was sending out these email blasts to their lists, so maybe they should too.

Businesses were given a three-year transition period (from July 1, 2014 to July 1, 2017) to get their house in order. Records of consent, whether express or implied, had to be kept. Keeping those records of every piece of consent proved to be an expensive task for many businesses, especially because implied consent (where the consent expires after two years) creates rolling dates of expiry. Small business owners and marketers have to vigilantly cull their email marketing lists, continually removing anyone whose consent has expired.

With the July 1, 2017 transition period end date looming, some small business owners threw their hands in the air, deciding to send out another round of "do you still want to be on our list" messages in order to record express consent, and deleted all their implied consent email recipients.

 
Between the three-year transition period ending, and the announcement earlier this week, many small business owners are left scratching their heads. What's a small business owner to do? Don't bury your head in the sand. Just because the threat of class action lawsuits has been taken off the table, you can still suffer a penalty for not being in compliance with CASL. Educate yourself on the law and what is required. There are helpful infographics at fightspam.gc.ca to better understand the hazy issue of what is and what isn't valid consent.

Keep records of consent (most email marketing software records express consent when someone opts in to your mailing list, and you can use customer relationship management software to note and track implied consent). Think twice before sending out an email blast just because everyone else seems to be doing it. Talk to a lawyer about your particular situation and what's required for you. You may be in compliance with CASL already, and you don't have to contact your customer list, ticking people off and potentially damaging your brand by sending a "please opt in again" message.

Regardless of the law, spamming people is never a good idea. The most effective forms of email marketing and other commercial electronic messages are targeted to a group of recipients who want to engage with your brand, not impersonal blasts to the masses. Savvy marketers have known this for years, and are in compliance with CASL already. Once you understand what CASL is asking (and not asking) your business to do, you'll likely find that legally sound email marketing is also good email marketing.