The new Canadian Anti-Spam Law (Bill C-28 or CASL) is expected to go into effect in late fall of 2012 or early 2013. This bill is considered the most stringent legislation yet regarding unsolicited electronic communication and includes the toughest penalties for violation.

Individuals violating Bill C-28 can be liable for fines up to $1 million per occurrence; businesses face fines up to $10 million! And, it's important to note that Bill C-28 does not apply only to Canadian spammers, but to any commercial emails sent by anyone in the world to Canadian recipients.

Therefore, any commercial entity that is using electronic messaging to solicit business in Canada needs to understand Canada Bill C-28 and ensure that they have processes in place to avoid running afoul of this legislation.

Provisions of Bill C-28

The primary purpose of Bill C-28 is to create a more secure online environment by deterring the most damaging and deceptive forms of spam. The law addresses the legislative recommendations of the Task Force on Spam, created by the Canadian government and comprised of industry and academic experts, together with consumers, working to design a comprehensive package of measures to combat threats to Canada’s digital economy.

The legislation applies to commercial activity only. It does not apply to personal electronic correspondence, or to political parties or charities, as long as the communications do not involve selling or promoting a product.

Bill C-28 creates six major violations:

Sending unsolicited commercial messages, including those that deliver malware and viruses. The law covers all electronic messages, including instant messaging, text messaging and cell phone spam.

Exceptions include cases where the sender has done business with the recipient in the past two years. However, businesses that rely on this exception will need to have a means of:
1. tracking the two-year time limit and removing names when the period expires; or
2. obtaining explicit consent to continue sending the messages beyond the expiry date.
Other exceptions: Consent is implied if the recipient has prominently published his/her e-mail address without asking not to receive unsolicited messages, or if the sender and recipient have a family or personal (unrelated to business) relationship which involves regular contact within the last two years.
Altering of transmission data without authorization, which addresses malicious activities like network re-routing.
Installation of unauthorized software on computer systems and networks, including programs that can be hidden in a spam message or accessed through hyperlinks to infected websites.
False and misleading practices including false email headers and website content.
Collection of personal information in violation of federal law through access to computer systems.
Automated collection of electronic addresses (address harvesting) and the use of such addresses.

Specific provisions within Bill C-28 include the prohibition of:

Sending commercial electronic messages without prior consent of the person receiving such e-mail. Consent can be written or verbal; however, the sender must keep proof of consent, where it came from, how it was received and when.
Detrimental practices in electronic commerce that effect the integrity of data transmission.
False or misleading online commercial representations.
Collection of personal information via unlawful or unauthorized access to computer systems/networks.

In addition, Bill C-28 provides:

A private right of action for business and consumers.
Extreme monetary penalties for violations; up to $1 million penalties in the case of individuals and up to $10 million in the case of companies.
International sharing of information and evidence to pursue spammers outside of Canada.
The necessity of including “opt out or unsubscribe” mechanisms that can be “accessed without difficulty or delay, and should be simple, quick, and easy for the consumer to use,” and ensure that no unsolicited e-mail will be sent to the consumer after 10 days from receipt of the opt-out request.
Three years to send messages to existing contacts, after CASL comes into force, regardless of when they last communicated.

Information Required in Commercial Electronic Messages

Name of the business or person conducting the business. If the email is being sent on behalf of a third party, that party’s name must also be included.
Physical address, phone number and e-mail or web address of the sender.
Notification that, even if consent has been given, it can be withdrawn at any time.
A means of “opting out”.
“From” address that is consistent with branding presented when the subscriber consented to receiving the e-mails.
Subject lines that are not misleading or designed to induce higher open rates.

Enforcement of Bill C-28

Three Canadian government organizations will have responsibility for enforcing various aspects of Bill C-28, under Industry Canada’s supervision. The Bill sets aside funds for each of the organizations to ensure they have the resources required to effectively enforce the legislation. The organizations responsible for enforcement include:

Canadian Radio-Television and Telecommunications Commission (CRTC), which will handle basic Canadian complaints about spam. The CRTC is generally responsible for ensuring the reliability, safety and effective operations of telecommunications networks and the Internet in Canada.
Competition Bureau, which will take action against fraud and misleading commercial messages. The mandate of this Bureau is to ensure fair marketplace practices for business and consumers.
Office of the Privacy Commissioner, which will ensure that e-mail addresses are not collected without consent. This Office works to protect the personal information of Canadians.

Recommendations to Prevent You and Your Firm from Penalties under Bill C-29

Do not purchase e-mail lists providing e-mail addresses of persons (either individuals or employees of a specific firm) located in Canada. This practice has never been considered appropriate by legitimate e-mail marketers, and Bill C-28 has now effectively ruled it out in Canada.
Request consent before sending commercial electronic messages into Canada, and set up a system to retain the consent, how it was obtained, when and by whom. If possible, get these consents before Bill C-28 goes into effect.
Set up an opt-out system that is easy for the recipient and ensures that you will not send any further unsolicited messages beyond 10 days from receipt of the opt-out information.
Ensure that subscribers are clearly informed, in every electronic communication, that they have consented to receive messages from you.
Make sure all current records identify the permission status and supporting information for each client.
Ensure that your electronic newsletter (e-newsletter) database includes not just the subscriber’s e-mail address, but also the name and date of subscription.
Consult an attorney familiar with Canada’s new Anti-Spam Law to ensure you understand your responsibilities.

The most significant recommendation we can offer legitimate commercial entities selling into Canada: Do NOT ignore Canada’s Bill-C28.

Doing so could subject you to penalties that could destroy your financial and business future.

Sources of Further Information

Bill C-28 – Canada’s Anti-Spam Legislation Readiness Checklist, Inbox Marketer

Canada’s Anti-Spam Legislation, Government of Canada

Canadian Anti-Spam Act Survey Bill C-28, Fasken Martineau

Electronic Commerce in Canada, Industry Canada

*****

Subscribe to the Credit-to-Cash Advisor Monthly e-Newsletter -- It's Free

Disclaimer: The information in this article is not, nor is it intended to be legal advice. It is imperative that any action you take be done on the advice of competent legal counsel, and not based solely upon this article.

ABC-Amega Inc. has provided commercial receivables collection services since 1929 and collects in more than 200 countries worldwide, For further information, contact info@abc-amega.com.