Enforcing Canadian Anti-Spam Law

The Canadian Anti-Spam Legislation (CASL) has aroused concern among marketers on both sides of the border since it started coming into force in July 2014 (some provisions, such as a private right of action, do not take effect until next year). It has stricter consent requirements than the US CAN-SPAM Act, as well as rules about installing software onto users’ devices. This week, the Canadian Radio-television and Telecommunications Commission (CRTC) issued its first published Compliance and Enforcement Decision under CASL, Blackstone Learning Corp., CRTC 2016-428 (October 26, 2016), offering insights into the Commission’s reasoning and enforcement policies. The CRTC decision confirms an administrative order compelling a relatively small educational and training services company to change its practices in sending marketing emails targeted mostly to government employees, but it also reduces the administrative monetary penalty of $640,000, which the company had appealed, to $50,000.

Blackstone sent emails marketing its learning programs over a period of two months to government employees whose email addresses it harvested from government websites. Some of the recipients reported the marketing emails to the CRTC’s Spam Reporting Centre, which led to an investigation in 2015. The company relied on the statutory “conspicuous publication” exception to express consent, arguing that the appearance of contact details on the employers’ websites indicated implied consent to send relevant commercial electronic messages to the published email addresses.

However, the CRTC views paragraph 10(9)(b) of the Act as setting a higher standard than “the simple public availability of electronic addresses.” The commercial messages sent to those addresses must be relevant to the recipient’s role or functions; the address must be published in such a manner that “it is reasonable to infer consent to receive the type of message sent, in the circumstances”; and there must not be a statement with the published contact details indicating that the person does not want to receive unsolicited commercial electronic messages. Importantly, the CRTC stresses that the burden is on the marketer to evaluate the elements of implied consent and maintain records to prove consent. Blackstone failed to show that it had done so in response to the CRTC’s notice to produce information. The CRTC reduced the amount of the monetary penalty, however, since the company is small and had no prior history of offenses, and the violations occurred over a relatively short period.

This decision suggests that marketing campaigns cannot safely include any automated harvesting of Canadian email addresses from public websites. There should be a human review of the source websites to ensure that there are no relevant restrictions, and that review should be documented. There should also be some basic documentation supporting the relevance of the goods or services marketed to the roles or functions of the individuals whose addresses were obtained from their employers’ websites. (These requirements are not dissimilar to the evolving practices for sending relevant marketing emails to individuals in their business capacity in the UK, Ireland, and Scandinavian countries, which also accept implied consent in limited circumstances for business-to-business marketing).

It is also significant that the CRTC imposed a monetary penalty regardless of whether the commercial electronic messages included the required opt-out mechanism for individuals who did not want to receive further messages. This suggests that at least some Canadian recipients are not satisfied merely to stop future messaging, and that the CRTC will not overlook improper address harvesting in the first instance.

The CRTC has published guidance on implied consent under CASL. Companies most commonly depend on an existing business relationship or a recent transaction or inquiry as the basis for asserting implied consent. The Blackstone decision suggests that in any case the onus will be on the company to document its reasonable grounds for implying consent, so that should be part of the planning for any electronic marketing campaign involving Canadian residents.