CASL – 5 Types of Consent – Part 1 – Express Consent

Canada’s new anti-spam law was passed in December 2010 and, following a Governor in Council order, it entered into force on July 1, 2014. The law will help to protect Canadians while ensuring that businesses can continue to compete in the global marketplace. On January 15, 2015, sections of the Act related to the unsolicited installation of computer programs or software came into force.

The new law generally prohibits the:

  • sending of commercial electronic messages without the recipient’s consent (permission), including messages to email addresses and social networking accounts, and text messages sent to a cell phone;
  • alteration of transmission data in an electronic message which results in the message being delivered to a different destination without express consent;
  • installation of computer programs without the express consent of the owner of the computer system or its agent, such as an authorized employee;
  • use of false or misleading representations online in the promotion of products or services;
  • collection of personal information through accessing a computer system in violation of federal law (e.g. the Criminal Code of Canada); and
  • collection of electronic addresses by the use of computer programs or the use of such addresses, without permission (address harvesting).”

Let’s begin with the 5 forms of consent under CASL.

EXPRESS CONSENT
An individual intentionally opts-in using transparent language. This is the gold standard of consent, meaning an individual both wants and intentionally requests being added to your email list. These people want the kind of information and offers you intend to send them. If you are using electronic messaging (primarily email and SMS text messages) to solicit new customers this law changes the game, as it is far more difficult to get express consent from people who do not yet know your brand of what you offer. If you intend to use email or SMS text marketing for new customer acquisition, you must come up with strategies to request express consent. Under CASL, you cannot even send one email to ask for consent.

The CRTC is the main enforcement agency and their description is “Valid consent given in writing or orally. The Recipient gave you a positive or explicit indication of consent to receive commercial electronic messages. Your request for consent set out clearly and simply, the prescribed information. Express consent is not time-limited unless the recipient withdraws his or her consent. Keep records of how you obtained implied or express consent, since in both cases you have the onus to prove consent.”

If the recipient is filling out a form to sign up for your email newsletter, the act of providing their email address is their “positive action”. The positive action can be an unchecked checkbox must have specific open and transparent language. The fact that an individual has to take the action of checking the box makes it a “positive action”.

The “prescribed information” is:
a) You must clearly state Company Name and mailing address
b) Describe what type of information they can expect and how often
c) Provide a contact name and 2 ways to contact them (can be a link)
d) State “You can unsubscribe at any time”

You must store the proof and be able to produce that proof upon request. The contact information contained in each commercial electronic message (CEM) must be valid for 60 days from the date the message was sent.

Here is an example from the Direct Marketing Association of Canada:

Note the contact name and details can be a link but the details must be easily accessed when an individual clicks on that link. Do not bury this information in 7 pages of your Privacy Policy and expect the individual to find it somewhere in the linked document.

The following is an extract from the law. Note this section includes Section 8 – the downloading of software. Section 6 deals with electronic messaging.

Express consent — sections 6 to 8

10 (1) A person who seeks express consent for the doing of an act described in any of sections 6 to 8 must, when requesting consent, set out clearly and simply the following information:

(a) the purpose or purposes for which the consent is being sought;

(b) prescribed information that identifies the person seeking consent and, if the person is seeking consent on behalf of another person, prescribed information that identifies that other person; and

(c) any other prescribed information.

Marginal note: Exception

(2) Despite paragraph (1)(b), for the purposes of section 6, if a person is seeking express consent on behalf of a person whose identity is not known,

(a) the only information that is required to be provided under that paragraph is prescribed information that identifies the person seeking consent; and

(b) the person seeking consent must comply with the regulations in respect of the use that may be made of the consent and the conditions on which the consent may be used.

Article courtesy of the Direct Marketing Association of Canada