CASL Lawsuits Become Possible Next July

What is scheduled for next July

CASL, the federal anti-spam law, has covered commercial email and text messages since July 1, 2014. Until now, enforcement has been in the hands of federal regulators.

On July 1, 2017, two further parts of the law are scheduled to take effect on the same day.

The first is a private right of action: individuals and organisations affected by a message sent in breach of the rules will be able to take the sender to court themselves.

The second is the end of the three-year transition for implied consent from relationships that existed before the law began. Contacts emailed on that basis since 2014 will need a newer one.

Why the lawsuit part matters

Until now, a recipient who objected to a message could complain to a regulator, and what happened next was up to the regulator.

From July, the recipient has another route. The law as written lets a court order compensation for actual losses and, on top of that, an additional amount for each contravention, up to a daily maximum.

The law also makes the sender prove consent. A business that says it had permission has to show it.

That turns record-keeping from good housekeeping into the main defence. A business that cannot show where an address came from, and when, is in a weak position whatever the truth.

What to check before July

Most of the work is finding out what you already have.

• Every list, including spreadsheets, point-of-sale systems and staff address books.
• Every sending tool, from the newsletter service to someone's Outlook.
• Where each address came from, and on what date.
• What kind of consent you have for it, express or implied.
• How unsubscribes travel between those tools.

The fifth is the one that catches businesses out. An unsubscribe recorded by the newsletter service does nothing to stop a salesperson emailing the same person an offer from a spreadsheet exported last year.

Express and implied consent, briefly

Express consent means the person actively agreed: they ticked an empty box, signed a form or asked to be added, after being told who was asking and that they could withdraw. Keep the wording and the date.

Implied consent usually comes from a relationship, and it runs out: a purchase supports two years of messages, an enquiry six months.

The transition added a third kind. Where a business relationship existed before July 1, 2014 and already included email, consent has been implied since, and that ends on July 1, 2017.

So a customer who bought in 2012, has bought nothing since and was on your list before the law began can be emailed today, and probably cannot after next July unless they say yes.

Ask the older contacts while you still can

The useful detail: a request for consent sent by email is itself a commercial message under CASL.

So you can only ask by email the people you are already allowed to email. Once the transition ends, pre-2014 contacts with no newer basis can no longer be asked that way.

The months before July are therefore the window. A short, plain message asking whether they want to keep hearing from you, with a button that records the answer, is enough.

Those who say yes become express consent with a date attached. Those who never answer should come off promotional sending on July 1.

A worked example

An RV dealer at the edge of a Fraser Valley town sends a monthly email with new arrivals, service specials and open house dates.

The list was built from 2008 onward from three sources: buyers, service customers and ballots from a prize draw the dealer ran at RV shows. Nobody had recorded which address came from where.

The buyers were easy to date from the sales records, and most had bought before 2014. The ballots were harder: nobody could find a copy of their wording, so there was no way to show consent.

The unsubscribe link worked, but only in the newsletter service. Two salespeople sent their own offers from Outlook to addresses in an old spreadsheet, and those emails had no unsubscribe at all.

This fall the dealer sent its pre-2014 buyers a plain request to stay on the list, set the ballot addresses aside, and moved all promotional sending into one tool with one unsubscribe list.

Every address in that tool now carries its source and date: the record the business would need if anyone asked.

The unsubscribe that has to work

Every commercial message needs a working unsubscribe, and the request has to be honoured within 10 business days.

Test yours from a phone, with an address that is on the list. It should take a click or two, with no login, and the address should not receive the next campaign.

Then check that it is missing from the next send in every other tool, including those staff use themselves.

Each message must also say who sent it, with a postal address and one way to get in touch: phone, email or web. That belongs in the template footer.

Records that show reasonable care

The law allows a business to show that it exercised due diligence to prevent a contravention, and records are how that is shown.

Reasonable care looks like a written note of who may send commercial email and from which tool, sign-up forms that record wording and date, paper sheets kept or scanned, and a check of the list before each campaign.

None of it is complicated. All of it is easier to start this fall than to reconstruct after a complaint.

The counter-case

A business that sends nothing promotional, only receipts, appointment confirmations and warranty notices, has far less to do, since those messages are treated differently.

A business whose whole list signed up through a clear checkbox with a recorded date is in good shape, and mainly needs to test its unsubscribe.

This post is information, not legal advice. A business that relies heavily on email, buys lists or sends text messages in volume should have a lawyer review its practices before July.

For everyone else, the advice stands: know where every address came from, ask the older contacts now, and make the unsubscribe work everywhere.

Before next July

1. List every place addresses are kept.
2. List every tool that sends commercial email.
3. Record the source and date for each address.
4. Ask pre-2014 contacts for express consent now.
5. Set aside addresses you cannot account for.
6. Test the unsubscribe across every tool.
7. Write down who may send, and how.

Step four has a deadline built into it. After July 1 the request itself can no longer go by email to contacts with no newer basis, so the only time to ask them is before.

Keeping receipts and confirmations separate from promotions is covered in unsubscribes that should not stop order emails.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.