Canadian Anti-Spam Legislation Guide
What You Need To Know At the U of A:
Canadian Anti-Spam Legislation (CASL) came into effect on July 1, 2014
Commercial electronic messages (CEMs) - What are they?
How the University of Alberta is affected by CASL
Messages which are subject to CASL
Beware the "mixed purpose" message
Requirements for unsubscribe mechanisms
Canadian Anti-Spam Legislation (CASL) came into effect July 1, 2014
CASL regulates the distribution and receipt of Commercial Electronic Messages (CEMs) in Canada. CASL also prohibits the unauthorized altering of transmission data; the installation of computer programs without consent (e.g., viruses, spyware); and the provision of false or misleading information either in the content of your message or the sender information.
CASL imposes administrative monetary penalties for non-compliance of up to $10 million for organizations. After July 1, 2017, anybody who receives a CEM without providing their consent has a private right of action against the organization sending the CEM, and may be able to receive up to $200 per violation.
Commercial electronic messages (CEMs) - What are they?
A Commercial Electronic Message (CEM) is defined as any message to an electronic account (e.g. emails, text messages, and messages using social media websites) that encourages participation in a commercial activity. A "commercial activity" is defined under CASL as "any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, whether or not the person who carries it out does so in the expectation of profit." Examples include purchasing, selling, bartering or leasing products, goods or services, or land; providing a business, investment or gaming opportunity; or advertising or promoting any of these activities.
How the University of Alberta is affected by CASL
As a public education institution, the University of Alberta is not a commercial entity and any electronic messages that communicate, support, or promote the U of A's core mission and mandate are not of a "commercial character." Thus, most of the U of A's electronic messaging is not subject to CASL. In addition, the university has taken the position that members of the Alumni Association are members of a "club, association or voluntary organization" within the meaning of CASL, thereby giving the university automatic implied consent to send CEMs to alumni members until that consent is withdrawn. However, if a message, not being sent to alumni, does not relate to the U of A's core mission and mandate, CASL may apply if the message has a commercial character. Please read the following "exemptions" and "subject to" lists carefully to determine whether or not the electronic message you intend to send falls under CASL.
Exemptions from CASL
Any message to alumni, and in addition, key examples of electronic messages that communicate, support, or promote the university's core mission and mandate, or are otherwise exempt from CASL include:
- Communications about U of A's research, teaching, community outreach, and other core activities
- Student recruitment, or promotion of courses or academic programs to prospective or current students
- Faculty or staff recruitment, or promotion of courses or U of A educational programming for the purposes of professional development
- Promotion of U of A-run concerts, plays, art exhibits, summer camps, and athletic events
- Promotion and sale of products and services that are connected to student life and educational programming
- Promotion of student housing services or campus food services
- Promotion of events, activities, and goods that are specifically designed to raise funds for the U of A
- Solicitations for donations to the U of A
Messages which are subject to CASL
Key examples of electronic messages that are likely considered commercial and therefore subject to CASL:
- Promotion of third-party commercial products, goods or services (e.g. preferential credit card rates for alumni, computer discounts)
- Promotion of products and services by UAlberta Bookstore that are not connected to student life and a student's education (e.g. branded merchandise)
- Promotion or recruitment of students for programs run by non-UAlberta organizations
- Promotion of conferences, workshops or events offered or organized by non-UAlberta entities
- Promotion of UAlberta-sponsored events or services that are not related to the university's core education and research mandate (Festival of Ideas, UAlberta Press publications sales, rental of facilities, child care services)
- Messages relating to the licensing and commercialization of discoveries of UAlberta researchers
Beware the "mixed purpose" message
Any electronic communication that includes, even in small part, a commercial electronic message renders the whole communication "commercial" and thus subject to CASL. "Mixed purpose" messages can only be sent to recipients from whom the U of A has implied or express consent. Examples of mixed purpose messages include:
- Newsletters that include advertisements from or promotion of sponsors, affinity partners, or non-educational U of A merchandise
- Newsletters that include the promotion of third-party events, conferences, programs, etc.
Types of consent
Under CASL, CEMs can be sent to recipients who have given implied or express consent to receive such messages.
Implied consent - is given when the recipient begins a business, volunteer or donor relationship with the U of A. Implied consent exists for the duration of the relationship plus an additional two years, unless such consent is otherwise revoked. If and when that relationship ends (e.g. contract ends, term on Alumni Council ends), the University has two years after the date of termination in which to receive express consent. If express consent is not given, communication of CEMs must cease.
Express consent - is not time-limited but must be formally sought from the individual, recorded and stored in order to show proof that express consent has been received. Express consent is best secured in writing, but can also collected orally. Individuals may provide their consent in various ways: e.g., by signing a document, sending you an email, entering information into a webform, or clicking on an "I Accept" button. Once you have secured someone's express consent, then you may continue to send them CEMs indefinitely unless the individual "unsubscribes" from further messages.
Additional information on what constitutes implied and express consent can be obtained from the U of A's Office of General Counsel.What to include in your CEMs
Under CASL, all CEMs must include:- A clear method for the recipient to unsubscribe from the list or to alter his or her preferences regarding electronic messages
- The name of the UAlberta unit sending the message
- Contact information for the unit (or a link to a website containing this information):
- mailing address
- telephone number and/or email address and/or web address
It is best practice to include such information in non-commercial electronic messages as well.
Requirements for unsubscribe mechanisms
All electronic messages must give recipients the opportunity to unsubscribe from future communication of CEMs. Your unsubscribe mechanism must be easy to access and use. Your unsubscribe mechanism must be valid for at least 60 days after you send the CEM. If you receive a request to unsubscribe, you have to comply within 10 business days.When you send CEMs by email, you may offer one or both of the following unsubscribe methods:
- Unsubscribe by email
- Unsubscribe by clicking on a link that will take the user to a web page where he or she can unsubscribe
- Unsubscribe by replying to the text message with the word "STOP"
- Unsubscribe by clicking on a link that will take the individual to a web page where he or she can unsubscribe
Securing express consent
- The specific purpose for which you are seeking their consent
- The name of the University of Alberta unit seeking consent
- The following contact information for the University of Alberta unit seeking consent (or a link to a website containing this information):
- mailing address
- telephone number and/or email address and/or web address
- a statement indicating that the person whose consent is sought can withdraw their consent
- be capable of being verified by an independent third party, OR
- be contained within a complete and unedited audio recording of the consent
In addition to requesting the individual's consent, it is also necessary to provide a privacy statement explaining why you are collecting personal information from the individual. Model consent and privacy language is included in the FAQs.
Learn More
How do you request somebody's express consent?
The easiest way to request express consent is to do so when an individual applies for a service.
You can also proactively request somebody's express consent by mailing or handing them a printed form to complete and return to you. However, after July 1, 2014, the CASL restricts your ability to request express consent using electronic messages, such as emails. When you send an electronic message requesting consent, this message is itself a CEM. Therefore, after the CASL is in force, you can only use an electronic message to request express consent if you have prior implied consent to do so. In other words, what you are really doing is "converting" implied consent into express consent.
If somebody gives you their business card, are they giving you their consent to send them a CEM?
This is not express consent because express consent must be in writing. This might, however, be implied consent if the individual is inquiring about entering into a business relationship with the U of A.
If someone graduated from the U of A five years ago, does the university have their consent to send them a CEM?
No, you would not have implied consent to send them CEMs because the individual has not been in a business relationship with UAlberta within the last two years. Generally speaking, you would have two years after graduation in order to obtain express consent.
Are there differences between obtaining consent under the CASL and obtaining consent under the FOIPP Act?
Yes. The requirements and obligations for obtaining express consent under the CASL are separate and distinct obligations and differ from the requirements for obtaining consent under the FOIPP Act. The CASL does not alter the U of A's obligations under the FOIPP Act.
For more information about the FOIPP Act and the requirements for obtaining consent under that legislation, please see the U of A's Information and Privacy Office website.
Do you have to keep a record of the consents and consent withdrawal requests you have secured?
Yes. If you send a CEM without being able to prove that the recipient has consented to receive it, you are placing U of A at risk of a potentially substantial fine under the CASL.
Does CASL apply to CEMs sent to people in the United States or other countries?
Yes. CASL applies to all CEMs that are sent by the U of A, including CEMs sent to individuals outside Canada. If you are sending CEMs to other countries, you may also have to comply with those countries' anti-spam laws.
Does CASL apply if we use a third party to send a CEM?
Yes. CASL applies not only to CEMs we send ourselves, but also to CEMs we "cause or permit to be sent" by third parties, such as direct mail services.
Where can I get more information about the CASL?
You may direct your questions about the CASL and its impact on the U of A to the University's Office of General Counsel.
General information on the CASL and its requirements can be obtained from the Canadian Radio-television and Telecommunications Commission (CRTC) and the Government of Canada at www.fightspam.gc.ca.
Where can I get more information about the other aspects of the CASL?
Information about the other aspects of the CASL; specifically, where an organization is involved in the alteration of transmission data and/or where an organization produces or installs computer programs, can be obtained by contacting the U of A's IT Security Office at vpit@alberta.ca.
Where can I get more information about privacy?
In addition to the CASL, you must also consider privacy issues whenever you are collecting, using or disclosing personal information. For more information, see the U of A's Information and Privacy Office's website.