The web is abuzz at the moment over the Canada Anti-Spam Law. The legislation has been threatened in one form or another for over half a decade. Like a fine wine, Canada has let the legislation slowly age but is now ready to expose it to the world. In fact, the first stage of the law goes into effect on July 1, 2014.
What is CASL?
The Canada Anti-Spam Act [“CASL”] is the equivalent of the CAN-SPAM Act in the United States. The goal is to ban the floods of spam we all receive in our inbox on a daily basis. Unfortunately, the CASL goes far beyond this simple goal and becomes a nightmarish burden for legitimate businesses. The difference between the CASL and the anti-spam law of practically any other country is the CASL works on the assumption that practically any email message a company sends is spam. Specifically, Section 2 of the law defines “commercial electronic messages” as follows:
An electronic message that, having regard to the content of the message, the hyperlinks in the message to content on a website or database, or the contact information contained in the message, it would be reasonable to conclude has as its purpose, or one of its purposes, to encourage participation in a commercial activity…
This language is extremely broad. It can be argued the language extends to practically any email message sent by a business for any reason other than administrative purposes. The Canadian authorities are suggesting they will assert the broadest possible definition during enforcement actions.
Of course, a business can send commercial electronic messages so long as it has the express or implied consent of each intended recipient. Certain very strict requirements must be met to obtain consent, requirements few sites currently meet.
To understand just how high a standard the CASL requires, consider a membership site. Assume 10,000 members have signed up for a free account with the site. Assume further that the terms and conditions of the website contain a clause through which members agree to receive emails from the site, to wit, a standard approach for most sites. The emails the site sends are considered spam under CASL. How so? The CASL regulations specifically note that including a consent request in the terms of a site is insufficient to meet the express consent standard. This one regulatory interpretation invalidates the consent process used by most sites in the United States.
The penalties available under the CASL are significant. An individual found to be spamming can be fined up to one million dollars a day. The fine bumps up to ten million dollars a day for businesses.
The risk of failing to comply with CASL ramps up further in July 2017 when private parties are allowed to start suing companies that send commercial electronic messages without consent. One can expect a flood of lawsuits including numerous class actions.
But My Business Is Not Located In Canada!
Why should a company in Los Angeles or Atlanta comply with legislation enacted by our neighbors to the north? CASL attempts to spread “the long arms of the law” broadly in a bid to capture as many spammers as possible. The drafters of the legislation seek to accomplish this goal by including language in the law detailing that if any part of the transaction or communication in question occurs in Canada, the law applies.
- Your email servers are located in Canada? The law applies.
- Your recipients are located in Canada, even if temporarily? The law applies.
- Are your recipients using a credit card issued by a Canadian bank to buy a product or service from you? The law applies.
This effort to extend the law as far as possible begs a simple question. Will the courts in the United States enforce a Canadian monetary penalty or judgment generated through CASL?
The enforcement of fines and judgments across borders is always a tricky affair. In general, legal judgments obtained in Canada can be enforced in the United States through the Uniform Foreign Money-Judgments Recognition Act. For government fines, Canada and the U.S. have a number of treaties allocating the enforcement of legal rulings, although it is not clear which the Canadians will seek to use for CASL. There are defenses that can be asserted to challenge the judgments or fines. It will be years before we find out how the courts will rule on the matter.
Does this mean you can ignore the CASL? No. If your business if fined or sued under the CASL, the first step of enforcement will be to move for a court order barring your business from appearing online in Canada. A judge will then issue an order to Google, Bing, Yahoo, and other search engines exclude you from their Canadian rankings, which may result in your site being de-indexed in the United States as well. The same process will occur with social media platforms. In short, a disaster.
At this point, the enforcement process moves to the court system of the United States. The courts will be asked to enforce the judgments and penalties established in Canada. If the U.S. judge agrees to the enforcement, you are on the hook for the full amount due. This financial blow will push most companies into bankruptcy.
As a final nail in the proverbial coffin, the government actions under the CASL are considered criminal in nature. The penalty is not a loss of liberty, to wit, jail time. Instead, the protective shields of corporations and limited liability companies will be automatically pierced, and the owners, officers, directors, and employees of the business in question will be held personally liable for the CASL violations.
While this article focuses on email, it is important to note the CASL also applies to direct messages sent through instant messaging and social media. Before sending such messages, you must obtain consent from the recipient.
Starting on July 1, 2015, the CASL will also apply to software downloads, to wit, apps, electronic tools, free software, etc. In these cases, express consent must be acquired prior to the download occurring to avoid violating the CASL. Why? The intent of the law is to prohibit malware and other predatory programs while punishing the individuals spreading such content. Unfortunately, the enthusiasm of the drafters of the legislation sweeps up legitimate businesses in the witch hunt.
The CASL is a complex piece of legislation. Common issues raised by this legislation include:
- What is express consent, how is it obtained and what disclosure must be provided when obtaining the express consent?
- What is implied consent and how long does it last?
- Do you need to seek express consent from a list of newsletter signups or website members developed prior to the law?
- What about Canadians who use a public email service that does not indicate their location such as a firstname.lastname@example.org address?
Do you need to comply with the Canada Anti-Spam Law? An analysis of your business process is required before making the determination, but the answer is typically yes. To avoid a nightmare CASL violation, contact me to discuss the CASL and your business compliance efforts. Express or implied consent must be established prior to July 1, 2014, so do not procrastinate.
Richard A. Chapo, Esq.