CASL and Implied Consent: Blackstone Learning Corp.: The CRTC'S First Compliance and Enforcement Decision under CASL | Practical Law

CASL and Implied Consent: Blackstone Learning Corp.: The CRTC'S First Compliance and Enforcement Decision under CASL | Practical Law

Canada's first anti-spam legislation (interchangeably, CASL or the Act) came into effect on July 1, 2014. It is considered one of the most stringent anti-spam regimes in the world given its scope and penalties. While the Canadian Radio-television and Telecommunications Commission (CRTC) had previously entered into undisclosed undertakings settling alleged violations of CASL, until now there have been no formal compliance and enforcement decisions under the Act. On October 26, 2016, the CRTC issued its first Compliance and Enforcement Decision CRTC 2016-428. The decision demonstrates the CRTC's stringent expectations of compliance with certain aspects of the Act and, in particular, its strict interpretation of the "conspicuous publication" exemption to establish implied consent for the receipt of commercial electronic messages (CEMs).

CASL and Implied Consent: Blackstone Learning Corp.: The CRTC'S First Compliance and Enforcement Decision under CASL

by Practical Law Canada Commercial Transactions
Published on 29 Nov 2016 • Canada (Common Law)
Canada's first anti-spam legislation (interchangeably, CASL or the Act) came into effect on July 1, 2014. It is considered one of the most stringent anti-spam regimes in the world given its scope and penalties. While the Canadian Radio-television and Telecommunications Commission (CRTC) had previously entered into undisclosed undertakings settling alleged violations of CASL, until now there have been no formal compliance and enforcement decisions under the Act. On October 26, 2016, the CRTC issued its first Compliance and Enforcement Decision CRTC 2016-428. The decision demonstrates the CRTC's stringent expectations of compliance with certain aspects of the Act and, in particular, its strict interpretation of the "conspicuous publication" exemption to establish implied consent for the receipt of commercial electronic messages (CEMs).

Background

On October 26, 2016, the Canadian Radio-television and Telecommunications Commission (CRTC) released its first written reasons issued under Canada's Anti-Spam Legislation, S.C. 2010, c. 23 (CASL). In the reasons for the Compliance and Enforcement Decision CRTC 2016-428, the CRTC found that Blackstone Learning Corp. had committed nine violations under section 6(1)(a) of CASL by sending batches of commercial electronic messages (CEMs) without consent and ordered an administrative money penalty (AMP) of $50,000.
The decision turned on whether Blackstone's sending of nine separate email campaigns, running from July 9th to September 18, 2014, to publically available email addresses, violated CASL. The 385,668 email messages were primarily sent to employees at government organizations who had publicly listed email addresses. These emails sparked over 60 complaints to the CRTC in a two month period. On January 30, 2015, the CRTC issued a Notice of Violation, setting out an AMP of $640,000, which they were given until March 2, 2015 to pay. Blackstone appealed the notice.
CASL applies to all CEMS where a computer system located in Canada is used to send or access the electronic communication, subject to certain exceptions. The CASL prohibits:
  • Sending electronic communications without consent (section 6(1), CASL).
  • Altering transmission data without express consent (section 7(1), CASL).
  • Installing computer programs without express consent (section 8(1), CASL).
  • Making false or misleading representations in electronic messages, including in the sender and subject lines (section 52.01, Competition Act, R.S.C. 1985, c. C-34).
  • Collecting email addresses using computer programs without consent (section 7.1(2), Personal Information Protection and Electronic Documents Act).
  • Collecting personal information through unauthorized access to a computer system (section 7.1(3), Personal Information Protection and Electronic Documents Act).
Unless a statutory exception applies, CASL prohibits sending an electronic communication unless:
  • The recipient consents, either expressly or impliedly.
  • The electronic communication complies with certain form and content requirements.
If challenged, the electronic communication's sender bears the burden of establishing consent or that an exception applies (section 13, CASL).
Messages are exempt from the requirement to obtain consent if they solely:
  • Provide a requested quote or estimate.
  • Facilitate or confirm a previously agreed-on commercial transaction.
  • Provide warranty, recall, safety or security information.
  • Provide factual information about an ongoing subscription, membership, account, loan or similar relationship.
  • Provide information related to an employment relationship or related benefit plan.
  • Deliver a product, good or service under a prior transaction.
(Section 6(6), CASL.)
When a business relies on the implied consent provisions, the electronic communication must comply with the form and content requirements (section 10(9), CASL).

Implied Consent

Consent may be implied in several situations, for instance:
  • When there is an existing business relationship.
  • Where recipients have "conspicuously published" their electronic contact information.
  • Under the "business card" exemption.

Conspicuous Publication

In the Blackstone case, Blackstone attempted to argue that it had implied consent to send the nine electronic communications batches based on the "conspicuously published" exception because the recipients' email addresses were all published on government webpages.
The CRTC considered what was required to establish "conspicuous publication" for implied consent and determined that the following two conditions must be met:
  • The publication of the electronic address must not be accompanied by a statement that the recipient does not wish to receive unsolicited electronic communications.
  • The electronic communication must be relevant to the recipient's business, role, functions or duties in a business or official capacity.
(Section 10(9)(b), CASL.)
The CRTC found that Blackstone did not meet the two-part test under section 10(9)(b), noting that mere public availability was insufficient to establish "conspicuous publication". The CRTC noted that the second part of the test does not provide the sender with a "broad licence to contact any electronic address they find online" but rather the electronic message must be relevant to each recipient on a case-by-case basis.
Additionally, the CRTC stated that the way the email address is published must infer a reasonable presumption of consent; a simple employee database with published email addresses does not imply consent. Therefore, in these circumstances, the "conspicuous publication" exemption did not apply. The CRTC therefore found that all nine CASL violations by Blackstone, namely sending CEMs without consent, had been established.

The Penalty

Potential penalties under the CASL are substantial and include administrative monetary penalties of up to:
  • $1 million for individuals.
  • $10 million for corporations.
(Section 20, CASL.)
In this case, the CRTC considered the following factors when determining penalties:
  • The purpose of enforcement (which is to ensure compliance rather than to punish).
  • The nature and scope of the violation.
  • Whether the violator has previously entered into any undertakings with the regulators.
  • The financial benefits accruing to the violator resulting from the breach of CASL.
  • The violator's willingness to cooperate with the regulator.
  • The actions the business has taken to improve training and compliance programs and practices.
  • Ability to pay.

Determining an Appropriate AMP

The CRTC weighed the above factors against the fact that if the AMP would preclude Blackstone from continuing to operate on a commercial basis, it would preclude them from participating in regulated activity going forward, which would be against the purpose of the penalty.
In arriving at its decision that Blackstone should pay a penalty of $50,000, rather than the originally prescribed AMP of $640,000.00, the CRTC gave weight to Blackstone's:
  • Financial ability to pay the AMP.
  • Attempts at self-regulation.
  • Violation-free record up to the time of the contraventions.
Blackstone was required to pay the CASL penalty by November 25, 2016. They also have the right to appeal the decision.

Other Considerations

If a sender of an electronic message wishes to obtain CASL-compliant express consent from a recipient, whether written or oral, the following conditions must be met:
  • The person granting the consent must make a positive or explicit indication of consent. According to regulatory guidance, consent must be opt-in consent, meaning that the consumer must take action to give consent. As a result, the common business practice of using an opt-out (or negative option) method for obtaining consent, such as a pre-checked consent box that a consumer has to uncheck to signify that she does not want to receive marketing messages, does not comply with CASL. Businesses cannot rely on consents obtained in this manner before CASL came into effect.
  • Express consent cannot be subsumed in or bundled with requests for consents for other purposes. For example, a sender cannot wrap express consent into its general terms and conditions. Further, a sender cannot condition the ability to purchase a good or service on providing express consent to receive electronic communications.
  • The request for consent must contain certain information. This information includes the name of the business seeking consent and a statement that the person whose consent is being sought may withdraw consent at any time.
An electronic message sent to obtain express consent to send electronic messages in the future is itself an electronic message covered by the CASL. As a result, subject to certain exceptions, the CASL does not permit businesses to send electronic messages seeking express consent.

Conclusion

The Blackstone decision underscores the narrow manner in which the CRTC may interpret the "conspicuous publication" exception under CASL. In particular, "conspicuous publication" will not be established simply by evidence that an email address has been publicly posted, for example, on a government website. Rather, CASL imposes a higher standard on senders of CEMs: there must be a nexus between the content of the electronic message sent and the recipient's business, role, functions or duties in a business or official capacity. This is a higher standard than merely proving that an email address was merely publicly available. The onus for establishing that there has been "conspicuous publication" amounting to implied consent is on the sender of the electronic communication. For this reason, senders of such electronic messages should maintain detailed records of consent to demonstrate all of the required elements of the consent being relied upon. In practice, this may be a difficult task as it may entail keeping records of screen shots showing where the recipient's address was conspicuously published.
The decision also suggests that attempts at self-correction and cooperation in the CRTC's investigative process will assist violators by reducing the quantum of AMP the CRTC will impose.