The web is abuzz at the moment over the Canada Anti-Spam Law. Canada has been on the cusp of enacting this privacy law in one form or another for over half a decade. Like a fine wine, Canada has let the legislation slowly age but is now ready to expose it to the world. The first stage of the Canada Anti-Spam Law goes into effect on July 1, 2014.
The Canada Anti-Spam Act [“CASL”] is the equivalent of the CAN-SPAM Act in the United States. The goal is to ban the floods of spam we all receive in our inbox daily. Unfortunately, the CASL goes far beyond this simple goal and becomes a nightmarish burden for legitimate businesses. The difference between the CASL and the anti-spam law of practically any other country is the CASL works on the assumption that almost any email message a company sends is spam. Specifically, Section 2 of the law defines “commercial electronic messages” as follows:
An electronic message that, having regard to the content of the message, the hyperlinks in the message to content on a website or database, or the contact information contained in the message, it would be reasonable to conclude has as its purpose, or one of its purposes, to encourage participation in a commercial activity…
This language is comprehensive. It can be argued the language extends to practically any email message sent by a business for any reason other than administrative purposes. The Canadian authorities are suggesting they will assert the broadest possible definition during enforcement actions.
Of course, a business can send commercial electronic messages so long as it has the express or implied consent of each intended recipient. Specific stringent requirements must be met to obtain consent, requirements few sites currently meet.
To understand just how high a standard the CASL requires, consider a membership site. Assume 10,000 members have signed up for a free account with the site. Assume further that the terms and conditions of the website contain a clause through which members agree to receive emails from the site, to wit, a standard approach for most sites. The emails the site sends are considered spam under CASL. How so? The CASL regulations specifically note that including a consent request in the terms of a website is insufficient to meet the express consent standard. This one regulatory interpretation invalidates the consent process used by most sites in the United States.
The penalties available under the Canada Anti-Spam Law are significant. The government can fine spammers violating CASL up to one million dollars a day. The fine bumps up to ten million dollars a day for businesses.
The risk of failing to comply with CASL ramps up further in July 2017 when private parties can start suing companies for violating CASL. One can expect a flood of lawsuits, including numerous class actions. In particular situations, business executives can even be held personally liable for CASL violations.
But My Business Is Not Located In Canada!
Why should a company in Los Angeles or Atlanta comply with legislation enacted by our neighbors to the north? CASL attempts to spread “the long arms of the law” broadly in a bid to capture as many spammers as possible. The drafters of the legislation seek to accomplish this goal by including language in the law detailing that if any part of the transaction or communication in question occurs in Canada, the law applies. Are your…
- Servers in Canada?
- Recipients located in Canada, even if temporarily?
- Recipients using a credit card issued by a Canadian bank to buy a product or service from you?
This effort to extend the law as far as possible begs a simple question. Will the courts in the United States enforce a Canadian monetary penalty or judgment generated through CASL?
Enforcement in the United States
The enforcement of fines and judgments across borders is always a tricky affair. In general, parties can enforce Canadian judgments in the United States through the Uniform Foreign Money-Judgments Recognition Act. For government fines, Canada and the U.S. have several treaties allocating the enforcement of legal rulings, although it is not clear which the Canadians will seek to use for the Canada Anti-Spam Law. There are a few defenses companies can assert to fight the effort. It will be years before we find out how the courts will rule on the matter.
Does this mean you can ignore the CASL? No. If your business if fined or sued under the CASL, the first step of enforcement will be to move for a court order barring your business from appearing online in Canada. A judge will then issue an order to Google, Bing, Yahoo, and other search engines exclude you from their Canadian rankings, which may result in your site being de-indexed in the United States as well. The same process will occur with social media platforms. In short, a disaster.
At this point, the enforcement process moves to the court system of the United States. Victors in the Canadian courts will ask judges in the United States to enforce the judgments and penalties established in Canada. If the U.S. judge agrees to the enforcement, you are on the hook for the full amount due. This financial blow will push most companies into bankruptcy.
As a final nail in the proverbial coffin, the government can bring criminal claims under CASL. The penalty is not a loss of liberty, to wit, jail time. Instead, a court will set aside the protective shields of corporations and limited liability companies and the owners, officers, directors, and employees of the business in question will be held personally liable for the CASL violations.
While this article focuses on email, CASL also applies to direct messages sent through instant messaging and social media. Before sending such messages, you must obtain consent from the recipient.
Starting on July 1, 2015, the CASL will also apply to software downloads, to wit, apps, electronic tools, free software, etc. In these cases, a company must obtain express consent before the download occurring to avoid violating the CASL. Why? The intent of the law is to prohibit malware and other predatory programs while punishing the individuals spreading such content. Unfortunately, the enthusiasm of the drafters of the legislation sweeps up legitimate businesses in the witch hunt.
The CASL is a complex piece of legislation. Common issues raised by this legislation include:
- What is express consent, how is it obtained, and what must a company disclosure when obtaining the express consent?
- What is implied consent, and how long does it last?
- Do you need to seek express consent from a list of newsletter signups or website members developed before the law?
- What about Canadians who use a public email service that does not indicate their location, such as a email@example.com address?
- Does a carve-out exist such as the existing business relationships exemption?
Do you need to comply with the Canada Anti-Spam Law? An attorney needs to analyze your business process before making the determination, but the answer is usually yes. To avoid a nightmare CASL violation, contact me to discuss the CASL and your business compliance efforts. You must establish express or implied consent prior to July 1, 2014, so do not procrastinate.
Richard A. Chapo, Esq.