Canada's New Anti-Spam Legislation: How can it impact your business?
Canada has passed sweeping new anti-spam rules that will impact business marketing and electronic communications. Canada’s new Anti-Spam Law (ASL) encompasses much more than just email. The new law creates an “express consent” system that applies to email and other electronic messages sent for a commercial purpose, including text messages, instant messaging and social media messaging. The law is expected to come into force sometime in 2012, once the regulations are finalized.
When the new law is in force, it will prohibit:
- Sending commercial electronic messages without the recipient’s consent, including messages to email addresses and social networking accounts, and text messages (IM and BBM) sent to a phone or other mobile device;
- Altering “transmission data” in an electronic message which results in the message being delivered to a different destination without express consent;
- Installing spyware, malware or other computer programs without the express consent of the owner of the computer system;
- False or misleading online representations in the promotion of products or services, particularly online fishing and “pharming” schemes;
- Hacking, scraping or harvesting to collect personal information or email addresses online without permission.
A few of the key points that your business should be aware of as this new law is finalized and implemented:
- In the new law, “commercial activity” is broadly defined as “any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, whether or not the person who carries it out does so in the expectation of profit…” - so it applies very broadly to all types of corporate communication.
- The ASL requires express, opt-in consent from recipients, with only limited exceptions. This means that businesses will have to review their existing email or electronic marketing lists, and consider whether they need to obtain “new” or “fresh” consent from recipients on an opt-in basis.
- A business may rely on implied consent where the sender has an “existing business relationship” with the recipients. But take note: this applies to active customers. (However, the ASL does include a three-year transitional period to permit communications to active customers and inactive customers with whom the sender has a qualifying relationship.)
- Note that this new law is in many ways more onerous than the existing privacy law requirements, which often have “implied consent” provisions or permit negative option consent for marketing messages.
- Enforcement agencies – including the Competition Bureau and the CRTC – can levy stiff penalties for non-compliance. New offences have been created, such as false or misleading subject lines, and e-mail address harvesting and hacking. The law provides for penalties of up to $10,000,000 for corporations.
- The new law will allow individuals to bring a private right of action in court against organizations who have allegedly violated the ASL. The private right of action will allow an applicant to seek actual and statutory damages, so we expect to see some test cases from individuals or advocacy groups in the near future.
The ASL is far-reaching and will affect the way that most Canadian corporations communicate with their current and potential customers. If you wish to determine the impact of this new law on your business, please contact our Business Law Group for advice, and watch for updates on ipblog.ca as the regulations are finalized and the ASL comes into force.