CASL's Lawsuit Clause Is Suspended and the Rest Still Applies

Yesterday's announcement

The federal government announced yesterday that it is suspending one part of Canada's anti-spam legislation, usually called CASL. That part is the private right of action, which was due to start on July 1.

The clause would have let individuals and organisations who received messages sent in breach of the law take the sender to court themselves, rather than waiting for a regulator to act.

It has been suspended, not repealed, and no new start date has been given.

Nothing else in the law has changed. The rules on consent, identification and unsubscribing have applied to commercial email since July 2014, and they apply today exactly as they did on Tuesday.

What still applies

Every commercial email, meaning any message that promotes what you sell, still needs all of these.

• Consent, express or implied, before the message is sent.
• Identification: your business name and a working way to reach you.
• An unsubscribe in every message, honoured within ten business days.
• Proof of consent: a record of how and when each person agreed.
• Honest wording in the sender name, subject line and message.

The fourth is the one most small lists are missing. When a complaint is looked into, it is the sender who has to show consent, and a spreadsheet of addresses with no source or date shows nothing.

Who still enforces it

The lawsuit clause was meant to sit alongside public enforcement, which carries on as before.

The CRTC investigates complaints about consent, identification and unsubscribes, and it can issue penalties. Two other federal bodies deal with misleading messages and with address lists gathered by software.

Anyone who gets an unwanted message can still report it to the government's spam reporting centre, and those reports feed the investigations.

Penalties have already been issued to businesses, and the maximums are large.

Why this is not a reason to relax

Suspended means paused. A clause that was written, passed and scheduled can return, and the consent records you keep from now on are the ones that would count if it does.

Your email service has rules of its own. Most require lists built on permission, and an account that draws spam complaints can be suspended long before any regulator hears about it.

Then there is the commercial point. People who asked to hear from you open your emails; people who never agreed mark them as spam, which pushes your next message toward the junk folder.

None of that changed yesterday.

July 1 still matters

One CASL date is unaffected. The three-year transition that let businesses rely on implied consent from relationships that existed before July 2014 still ends on July 1.

An address on your list only because of dealings from before then needs another basis after that day, such as a recent purchase or express consent. Three weeks remain to sort it out.

A worked example

A charcuterie maker sells salami, cured sausages and terrines at three farmers markets and through a small online shop. Once a month it emails the market schedule and news of new batches.

Its list of about nine hundred addresses came from three places: a clipboard at the market stall, a box at the online checkout, and every address in the order history since the shop opened in 2013.

When the owner heard the lawsuit clause had been suspended, the first thought was that the order history was no longer a worry. That was the wrong lesson.

Buyers whose last order was more than two years old had no implied consent under the normal rules, and none of them had ticked the box. The clipboard had no heading saying what people were signing up for.

Sorting it out took an afternoon. Each address was tagged with its source and date, the older buyers came off the list, and recent buyers were marked with the date their implied consent would lapse.

Those recent buyers got one message inviting them to subscribe. The clipboard gained a printed heading naming the business, the monthly email and how to unsubscribe, and the email footer gained a mailing address.

Website forms that hold up

Express consent does not expire, so the sign-up form and the checkout box deserve the most care.

The checkout box must start unticked and sit apart from the terms of sale, with a line saying what the emails will contain. Agreeing to buy is not agreeing to a newsletter.

A confirmation email asking new subscribers to click once more is not required, but it leaves a dated record that the address is real and its owner said yes.

Save the form's wording whenever it changes; the wording on the day someone signed up is part of the proof.

Implied consent runs out

Implied consent comes from an existing relationship, and it has a clock on it.

A purchase counts for two years from the day it was made, and each new purchase restarts that clock. An inquiry, such as a question sent through your contact form, counts for six months.

When the period ends, so does the consent. The sensible move is to invite those people to subscribe while you still have a reason to email them.

Every message, every time

Identification and unsubscribing apply to every commercial email, whichever kind of consent is behind it.

The unsubscribe has to be easy, with no login, and keep working for sixty days after the message goes out.

Requests to leave must be honoured within ten business days. Email services usually handle the link automatically, but a reply saying "please take me off" still needs a person to act on it.

The counter-case

Not every email a business sends is a marketing message.

Receipts, order confirmations and answers to a customer's own question are treated differently from newsletters and offers, and a business that sends only those has much less to manage.

Nothing here is legal advice, only general information, and an unusual situation deserves a lawyer's view.

For anyone sending newsletters or offers, though, keep the consent records and the complete footer exactly as if the clause had started on schedule.

Before July 1

1. Export your list with sources and dates.
2. Tag each address as express, implied or unknown.
3. Note when implied consent lapses for each buyer.
4. Invite recent buyers to subscribe properly.
5. Remove addresses with no basis at all.
6. Check the footer for name, address and contact.
7. Test the unsubscribe link from a phone.

Step two is the foundation for the rest. Until each address carries a label, there is no way to tell which ones can stay, which need an invitation and which have to go.

Collecting addresses in person without overstepping is covered in business cards from a trade show and CASL.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.