A special thanks goes out to CAUCE director Shaun Brown (nNovation LLP) for summarizing these guidelines and answering our questions on November 1st.
Pre-existing Relationships/Implied Consent
According to the CRTC, data acquired through pre-checked boxes and other such Opt Out Consent mechanism would not comply with CASL, unless.
- There exists a pre-existing business relationship, in which case the sender has 24 months to convert from Implied to Express Consent. This grace period expires unless the recipient makes another purchase.
- The recipient makes a request for information, in which case the sender has 6 months to convert from Implied to Express Consent.
- Similar to the UK’s EC Directive, senders communicating under Implied Consent are limited to content directly related to the auspices under which consent was originally inferred
- The sender collected personal data (including email address) in compliance with Canada’s existing privacy law, PIPEDA. Compliance with this law grants the sender 36 months from the enforcement date (TBD) to convert subscribers to Express Consent. This grandfathering clause would only apply to scenarios where the sender complied AND had active communications with covered recipients.
Express Consent. The CRTC has always taken an informal position that consent has to be opt-in and boxes cannot be pre-checked. This was reflected in their guidelines on the use of toggling, here.
Examples of what CRTC interprets to be compliant consent mechanisms are illustrated here.
Notified Opt-In. As an additional requirement, under the CRTC’s guidelines marketers would need to send confirmation messages to subscribers following their express consent.
While the regulator may not have the jurisdiction to impose additional requirements within interpretive guidelines, not sending a confirmation message may mean enforcement risk. Modifying existing welcome messages may be enough to satisfy this notification requirement.
Oral Consent. The CRTC allows marketers to collect oral consent, but does not specify how this may be achieved, merely requiring that the request and answer be recorded in unedited form or verified by an independent third party. Who or what the third party may be is also unclear and marketers may need to send electronic confirmation messages to comply with the Notified Opt-In requirement.
One possible workaround to the ambiguous recording requirement may be for a call center, during the course of a business transaction (sale or request for information) to send an electronic request for express consent to the caller.
3rd Party Consent. CASL requires all senders to obtain express consent from the individual before sending commercial messages. Similar to the UK’s EC Directive, B2B marketers using trade shows and other prospecting techniques are subject to special rules and exceptions.
For one, while there is no time limitation to convert Implied Consent to Express Consent, B2B marketers are limited in the scope of their communications. For example, an accounting software company may not promote a partner’s servers appliances as this was likely outside the scope of the pre-sale engagement.
Refusal to Deal. Trial period promotions, sweepstakes and other such ‘free’ considerations are still an open question on whether the same rationale for express consent would apply. What is clear from the CRTC’s intentions is that a customer may not be forced to opt-in to commercial communications when buying a product, and cannot be auto-consented through T&Cs and other ‘fine print’.
Given the above, it is possible that giving something away for free in exchange for being enrolled in a marketing program may fall within the scope of CASL’s limited Implied Consent provisions.
3rd Party Content
CASL requires that commercial communications sent on behalf of another entity must clearly identify sender and the entity on whose behalf the message is being sent. In its interpretive guidance CRTC clarifies what this means for entities indirectly involved in the communication chain.
ESPs. The CRTC clarified that in most circumstances service providers would not need to be identified. According to Shaun Brown, marketers and ESPs alike should carefully consider who owns and who is responsible for the content being transmitted — an ESP with professional creative services may be seen as a non-passive agent and may not be strictly exempt. So while the CRTC will likely focus their attention on actual senders, some enforcement risk may exist.
Viral Marketing. Refer-A-Friend programs and other such referral programs would not be exempt from compliance if the brand causes to induce or procure the referral process. This is very similar to the FTC’s ruling in the US that incentivization equals procurement and makes the brand responsible for commercial compliance. In practical terms, a brand should be very careful about offering incentives and allowing referrers to upload entire address books into an RAF form.
Although the CRTC has clarified its regulations under CASL, it is still unclear when CASL will go into effect. We are still waiting for the second principle regulator, Industry Canada, to release its regulations for public comment, a process which can add as much as 6 months to an enforcement timetable. Combined with the grandfathering and Implied Consent grace periods, clients may have as long as 42 months to prepare.
To quote the late and great Douglas Adams, “DON’T PANIC!” We have the time and expertise to help you adjust to the inevitable advent of CASL, whenever that may be…