CASL and the U of S
Does CASL apply to the university?
The university is subject to CASL. However, there are exceptions to the rules regarding CEMs that may apply to some types of messages sent by the university. For example, fundraising activities by University Relations or messages sent to employees of the university concerning the activities of the university are not subject to the rules regarding CEMs.
Who is responsible for compliance?
Each college, department and unit is responsible for ensuring its outgoing electronic messages comply with CASL. Compliance is overseen by University Communications, with support from Information and Communications Technology and Corporate Administration.
Consequences of non-compliance
Non-compliance with the consent and content requirements for CEMs under CASL may result in a fine against the university of up to $10 million. Further, commencing July 1, 2017, any individual who receives a CEM in contravention of the consent and content requirements for CEMs under CASL will have the right to sue the university for up to $1 million per day that the university is in contravention of these requirements.
Commercial electronic messages
What are CEMs?
A CEM is an electronic message (including email, text message, automated telephone message or social media message) that has as its purpose, or one of its purposes, to encourage participation in a commercial activity, including an electronic message that offers to purchase, sell, barter or lease a product, goods or a service; offers to provide a business, investment or gaming opportunity; or advertises or promotes such products, goods, services or opportunities.
A commercial activity is broadly defined as any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, whether or not there is an expectation of profit.
While some activities of the university are clearly commercial in nature and electronic messages sent in relation to these activities would clearly fall under CASL, there are other activities and related electronic messages that are not clearly commercial in nature and the application of CASL is less clear. As relatively new legislation, it remains to be seen how the courts will interpret the provisions of CASL in the university context.
It should be noted that the primary purpose of the message need not be the encouragement, advertisement or promotion of commercial activities; if a generally non-commercial message also includes information about commercial activities (for example, an alumni newsletter that contains an advertisement), it may be considered a CEM.
An electronic message that contains a request for consent to send a CEM is itself considered a CEM and must meet the consent and content requirements as set out in CASL.
Rules and limits
The university can only send CEMs to recipients who have consented to receiving such messages, with very limited exceptions. The consent may either be express or implied.
When seeking express consent, the request should set out clearly and simply:
- the purpose or purposes for which the consent is being sought;
- the name of the university unit seeking consent;
- the mailing address; and either a telephone number, email address or web address of the unit seeking consent; and
- a statement indicating that the person whose consent is sought can withdraw their consent at any time.
Express consent may be obtained orally or in writing and is valid until revoked. Verbal express consent should be properly documented by the university. Written express consent is preferable and can be provided by the individual in a variety of ways including:
- signing a document;
- confirming via email;
- entering information and submitting a webform; or
- clicking on a checkbox or an “I accept” button on a web page.
Express consent must always be “opt-in,” meaning that the individual must take positive action to provide their consent. For example, a check box must not be pre-checked and the individual must take steps to check it themselves.
While consents covering related purposes are acceptable, blanket consents that cover multiple purposes (or multiple units/departments) should generally be avoided.
Parties that are in an existing business relationship with the university (eg. active students, current participants in programs, etc.) will be considered to have given implied consent to receiving CEMs unless they advise otherwise (by revoking consent or unsubscribing). Existing business relationships arise out of:
- the purchase, lease or bartering of a product, goods, a service, land or an interest or right in land within the past two years;
- the acceptance of an investment or gaming opportunity within the past two years;
- a written contract entered into respecting any of the above matters if the contract is currently in existence or expired within the past two years; or
- an inquiry or application, within the six-month period immediately before the day the message was sent respecting any of the above matters.
Implied consent also arises from non-business relationships. In the university context, non-business relationships arise out of:
- a donation or gift made within the past two years;
- volunteer work performed in the past two years; or
- membership in the U of S Alumni Association.
Implied consent may arise where a proposed recipient has conspicuously published or otherwise disclosed to the sender their business contact information and has not indicated a wish to not receive unsolicited CEMs, and the message is relevant to the recipient’s business, role, functions or duties in a business or official capacity.
Expiration of implied consent after two years
Where there is implied consent, the university does not need express consent. However, in most cases, implied consent expires two years after the event that initiates the business or non-business relationship unless there has been subsequent activity.
Best practice is to obtain express consent while you have valid implied consent. Express consent is in place until revoked.
It is important to have a proper records management or customer relationship management program in order to record consent. Important elements to record are:
- when consent was obtained;
- the manner in which it was obtained;
- whether the consent is express or implied;
- whether express consent was obtained in writing or verbally;
- when implied consent expires; and
- when either express or implied consent is revoked.
If challenged under CASL, the onus is on the university to establish consent.
For more information on express consent versus implied consent, visit the CRTC website.
What needs to be included in a CEM?
A CEM must contain the:
- identity of the sender or person on whose behalf the message is sent;
- contact information for the sender or person on whose behalf the message is sent, including the mailing address, and either a telephone number, email address or web address; and
- information about how to unsubscribe from future CEMs.
If it is not practical to include all of the above information in the CEM, then the message must contain a clear and prominent link to a webpage that contains that information.
For more information respecting information to be included in a CEM, visit the CRTC website.
An unsubscribe mechanism must enable a recipient to indicate, at no cost to the recipient, the wish to no longer receive any CEMs, or any specified class of CEMs, from the sender, using the same electronic means by which the message was sent or any other electronic means that will enable the recipient to indicate the wish. Further, the mechanism must specify an electronic address, or link to a webpage, to which the indication can be sent. The electronic address or webpage must be valid for at least 60 days after the message is sent.
Where consent has been withdrawn, it must be given effect within 10 business days.
When sending CEMs by email, examples of unsubscribe methods that may be offered include:
- sending a reply email or email message to an email address specified by the sender; or
- clicking on a link that will take the individual to a web page where they can unsubscribe.
When sending CEMs by text message, examples of unsubscribe methods that may be offered include:
- replying to the text message with the word “STOP”; or
- clicking on a link that will take the individual to a web page where they can unsubscribe.
Exception to the consent and content requirement
There are types of messages that fall outside of the consent and content requirements of CASL, meaning you do not need express or implied consent and you do not need to provide an unsubscribe mechanism. These CEMs include ones sent:
- by an individual to another individual with whom they have a personal or family relationship;
- to a person who is engaged in a commercial activity and consists solely of an inquiry or application related to that activity;
- by an employee of the university to another employee of the university and the message concerns the activities of the university;
- by an employee of the university to an employee of another organization if the organizations have a relationship and the message concerns the activities of the organization to which the message is sent;
- in response to a request, inquiry or complaint or is otherwise solicited; or
- by or on behalf of a registered charity and the message has as its primary purpose raising funds for the charity.
Exception to the consent requirement
Consent, either express or implied, is not required for a CEM that:
- provides a quote or estimate that was previously requested by the recipient;
- facilitates, completes or confirms a commercial transaction the recipient previously agreed to enter into;
- provides warranty, product recall, or safety or security information about a product, goods or a service the recipient has used or purchased;
- provides notification or factual information about the ongoing subscription, membership, account, loan or similar relationship with the sender;
- provides information directly related to an employment relationship or related benefit plan in which the recipient is currently involved, participating or enrolled in;
- delivers a product, good or service, including product updates or upgrades, which the recipient is entitled to receive under the terms of a transaction previously entered into by the recipient; or
- is sent to satisfy a legal or juridical obligation or to provide notice of, or enforce a right, legal or juridical obligation, court order, judgment or tariff.
These messages must, however, contain the content required of CEMs, including identifying the sender and an unsubscribe mechanism.
Even if it is believed a message is exempt from CASL, it is recommended that the university follow CASL requirements where possible to avoid the risk that the message inadvertently includes elements that bring the message under the scope of CASL and in order to address other privacy considerations.