Canada's Anti-Spam Legislation

(Last Updated August 27, 2014)

FREQUENTLY ASKED QUESTIONS (FAQs)

Note: These FAQs are intended to help Holland College staff and faculty members to understand their obligations under CASL. They summarize and simplify the complex requirements of CASL and are not intended to be a substitute for legal advice. These FAQs are subject to occasional updates and may change as more interpretation becomes available.

1. General Questions

1.1 What is Canada’s Anti-Spam Legislation?

The primary purpose of Canada’s Anti-Spam Legislation (usually called CASL and pronounced CASTLE) is to control spam (unsolicited Commercial Electronic Messages, or CEMs). CASL also prohibits the installation of computer programs without consent (eg. viruses, spyware); the unauthorized altering of transmission data; and the provision of false or misleading information in a message.

CASL consists of an Act and two Regulations and is enforced by the Canadian Radio-television and Telecommunications Commission (CRTC), the Privacy Commissioner of Canada and the Competition Bureau.

1.2 When will CASL come into force?

The majority of CASL, including those provisions governing the sending of commercial electronic messages (CEMs), are in force as of July 1, 2014.

The provisions relating to computer programs will be in force as of January 15, 2015, while provisions providing for a private right of action will come into force July 1, 2017.

1.3 Who does CASL apply to?

CASL applies to most individuals and organizations in Canada who send CEMs. This includes Holland College and its employees.

1.4 Does CASL apply to CEMs sent to people in the United States or other countries?

Yes. CASL applies to all CEMs that are sent by Holland College, including CEMs sent to individuals outside Canada. If you are sending CEMs to other countries, you may also have to comply with those countries’ anti-spam laws. CASL also applies to CEMs send into Canada from other countries and would therefore apply to any College operations outside of Canada.

1.5 Does CASL apply if we use a third party to send a CEM?

Yes. CASL applies not only to CEMs we send ourselves, but also to CEMs we “cause or permit to be sent” by third parties, such as direct mail services.

1.6. What impact will CASL have upon Holland College?

CASL will have a fairly modest impact on Holland College because many electronic messages sent by Holland College are not subject to the legislation. For more information about the scope of the CASL, see the following sections of this FAQ.

1.7. What are the penalties for non-compliance with CASL?

The penalty for non-compliance with CASL is a fine of up to $10 million for an organization, and $1 million for an individual. Officers, directors and agents can be held personally liable for their organization’s failure to comply with CASL. Also, effective in 2017, anybody who receives a CEM without providing their consent may have private right of action against the organization sending the CEM, and may be entitled to receive up to $200 per violation.

1.8. What is an example of altering transmission data?

An example is when an individual causes an electronic message to be sent to a destination that is different from that which the sender intended.

2. Scope of CASL

2.1. What kinds of electronic messages are regulated by CASL?

CASL applies to “Commercial Electronic Messages” (CEMs), which are defined as any “electronic messages” having regard to the content of the message, the hyperlinks in the message to content on a website or other database, attachments to the message, or the contact information contained in the message, that encourage participation in a “commercial activity” regardless of whether there is an expectation of profit. The terms “electronic message” and “commercial activity” are defined in the act and shown below.

An “electronic message” is any message sent to an electronic account, e.g. an email, a text message, or a message using social media such as Facebook. Interactive two-way voice communications, fax messages or voice recordings sent to a telephone account are not considered to be electronic messages.

If you’re calling somebody to offer a product or service, that’s not a CEM. Please keep in mind, however, that promotional phone calls may be regulated by the Do-Not-Call List. See Canada’s National Do Not Call List for more information.

A commercial activity is any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, whether or not the person who carries it out does so in the expectation of profit.

In assessing this, consider all aspects of the message including:

• its content and the content of any attachments;
• the hyperlinks in the message to content on a website or other database;
• the contact information contained in the message;
• that CASL applies even if only one of the purposes of the message, not necessarily its primary purpose, is to encourage participation in a “commercial activity”.
• the determination as to whether something constitutes a “commercial activity” or has a “commercial character” should not take into account whether the person expects to make a profit or whether money (or other value) is mentioned or is being exchanged
• after July 1, 2014, an electronic message requesting consent to send CEMs is also considered to be a CEM unless one of the exemptions noted elsewhere in this document apply.

“Commercial character” is not defined in the legislation but we have determined that commercial activities include:

• an offer to purchase, sell, barter or lease a product, goods, a service, land or an interest or right in land (an opportunity or thing that the recipient can choose to accept, decline or counter; an opportunity or thing that the recipient is making available, supplying or providing; something that someone is willing to do for the recipient or others; an invitation – for example an invitation to attend an event or to purchase something);
• an offer to provide a business, investment or gaming opportunity;
• an advertisement or promotion;
• a promotion of a person, including the public image of a person.

It is important to recognize that if the message has multiple purposes, each purpose must be evaluated to understand whether the overall message is a commercial electronic message. For example, a message sent out to past graduates about a reunion event that also encourages the recipient to purchase t-shirts and hats from a third party provider will very likely be considered to be a commercial electronic message. The same email without any reference to purchase would be considered informational and therefore not subject to CASL.

2.2 Which of Holland College’s electronic messages does CASL apply to?

Examples of commercial activities by the College and employees of the College include:

Note: Electronic messages covered by the examples below to college owned email addresses (@hollandcollege.com) are exempt from CASL requirements.

• Specials at the on-campus restaurant or fitness facility
• Promotion and sales events at the College bookstore
• College sanctioned promotions involving a third party (ex. discount credit card)
• Concerts, plays, and sporting events (if charging admission or selling tickets for the event)
• Student housing
• Campus food services
• Recreational services and classes
• Promotions of College sanctioned contests or other draws
• Student recruitment
• Promotion of upcoming courses or the introduction of a new program

The following examples of commercial activities must not be sent using your @hollandcollege.com email:

• Messages seeking donations to a third party (e.g. sponsoring a participant in a run for a charity other than the College)
• Solicitation for sponsorship
• Promotion of the sale of a faculty member’s new book
• Promotion of private sector or co-sponsored conferences or events

Note:

1. Any email to any non-@hollandcollege.com email address that includes one or more of the above activities will be considered a CEM.

2. Any email to any non-@hollandcollege.com email address that includes a signature line promoting some commercial activity of the College will be considered a CEM regardless of the content of the message.

Also, certain types of messages are specifically exempted from the scope of CASL. For example, CASL does not apply to messages sent by registered charities for the primary purpose of raising funds. See the next question for a complete list of all of these exemptions.

2.3 What types of electronic messages commonly sent by the College are exempted from application of the legislation?

The following messages do not require the sender to obtain consent or to comply with the unsubscribe mechanism and identification requirements:

1. Electronic messages sent by Holland College to College employee email addresses provided by the College (@hollandcollege.com) are exempt from CASL as long as the message relates to the business of the College. As Holland College is the owner of these email addresses, any electronic message approved by the College including those promoting third parties (ex. special insurance rates, Canada Savings Bonds, special pricing on non-College events) or internal fund-raising (eg. United Way),  is exempt. The College’s Acceptable Use Regulation (AR-30-07-1) covers any misuse of College computer resources such as advertising or soliciting without College approval.
2. Students of Holland College are members of the Holland College community. As members of this community the College has provided email accounts to students for the purposes of facilitating communications. Electronic messages sent by Holland College to College student email addresses provided by the College (@hollandcollege.com) are exempt from CASL as long as the message relates to College-student relationship.
3. CASL does not apply to informational messages such as news releases and College news publications such as the Benchmark (as long as the publication does not contain any College or third party advertising).
4. An email that is strictly informational in nature, such as an email advising of a room change for a class or meeting, cancellation, or an email about safety or security information.
5. A commercial electronic message that is sent by or on behalf of an individual to another individual with whom they have a personal or family relationship. A personal relationship is defined as a relationship between an individual who sends a message and the individual to whom the message is sent, if those individuals have had direct, voluntary, two-way communications and it would be reasonable to conclude that they have a personal relationship, taking into consideration any relevant factors such as the sharing of interests, experiences, opinions and information evidenced in the communications, the frequency of communication, the length of time since the parties communicated or whether the parties have met in person.
6. A commercial electronic message that is sent to a person engaged in a commercial activity and consists solely of an inquiry or request related to that activity.
7. A commercial electronic message that is sent in response to a person who has made an inquiry or complaint. Please note that this exception applies only to the response or reply (that is, we cannot make a claim that because someone makes an inquiry, we can perpetually send them commercial electronic messages without their consent);
8. A CEM sent to satisfy or enforce a legal or juridical obligation or to enforce a right arising under a law of Canada, of a province or municipality of Canada or of a foreign state. An example of a message to which this exception applies is an instance where the sender has a contract with the recipient and the sender is collecting money owed under that contract (e.g. fees), and the purpose of the message is to enforce that right against the recipient (e.g. collect the fees);
9. If the sender reasonably believes the message will be accessed in a foreign state that is listed in the regulations and the message conforms to an anti-spam law of that foreign state.
10. Electronic messages sent by a registered charity for the primary purpose of raising funds. See Question 2.6 for more information.

Electronic messages related to persons who have entered into a business relationship with Holland College (i.e. the activities central to its mandate and responsibilities) are not commercial electronic messages. However, it is important to recognize that if the message has multiple purposes, each purpose must be evaluated to understand whether the overall message is a commercial electronic message. For example, a message sent out about graduation photos that also encourages the recipient to purchase photos from a third party provider will very likely be considered to be a commercial electronic message.

It may be difficult to always draw a clear line between the delivery of messages relating to core activities and messages that are mixed or that are messages about commercial activities. When in doubt, assume it is a commercial activity.

2.4 Is fundraising a commercial activity?

Messages sent by a registered charity (such as the Holland College Foundation) for the primary purpose of raising funds for that charity are not subject to this legislation. Please note that to fit this exemption, the sender must be a registered charity (the Holland College Foundation is a registered charity) and the electronic message must be sent out for the primary purpose of raising funds.

All activities that fall under the Canada Revenue Agency’s definition of fundraising, and which registered charities use to calculate their fundraising ratio, are exempt from the consent requirements.

3. Requirements for Commercial Electronic Messages (CEMs)

3.1 What are the requirements for commercial electronic messages?

Essentially, CASL contains the following three requirements for CEMs:

• You must have the consent of the individual before the message is sent.
• The CEM must meet the two content requirements:

1. You must identify the sender and provide the sender’s contact information. This contact information must be valid for a minimum of 60 days after the message has been sent. Information about the identification requirements is found at question 3.2.
2. You must give the individual a way to “unsubscribe” from further messages. The mechanism must be valid for at least 60 days after the message is sent. The form of the unsubscribe mechanism is regulated in the legislation. Information about the unsubscribe requirements is found at question 5.

Unless an exception applies, each CEM must contain these elements. Information about exceptions is found in question 2.

3.2 What identification information do CEMs have to contain?

All CEMs that are subject to CASL must contain the following information:

• Holland College
• the name of the Holland College department or unit sending the message
• the name of the person who is sending the message and, if different, the name of the person on whose behalf the message is being sent.
• contact information for the person and department or unit (or a link to a website containing this information):
  • mailing address
  • telephone number and/or email address and/or web address

If it is not practicable to include all of the above information in the CEM, then it must contain a clear and prominent link to a webpage that contains the information. Note: This would only apply when the CEM is not an email (ex. twitter or text message).

4. Consent Requirements

4.1. What are the two kinds of consent?

CASL is based on an opt-in system, which means that you need to have the person’s consent before you send them a CEM. An electronic message designed to request a person’s consent is itself a CEM under CASL.

Under the legislation, there are two kinds of consent: implied consent and express consent. With limited exceptions that are detailed in the next question and answer, due to the practical and technological considerations and the numerous risks associated with establishing implied consent, Holland College has decided that those who are sending commercial electronic messages out on behalf of Holland College or the Holland College Foundation must work towards obtaining express consent in order to send out their commercial electronic messages, rather than relying on implied consents.

4.2. What is implied consent?

Holland College has determined that implied consent can be established to send commercial electronic messages to the following, limited, groups of recipients:

1. Potential students – CASL has an exemption for CEMs sent in response to a request or inquiry. If a potential student asks for information about the College, the College may send a CEM containing the requested information. However, if the recipient does not respond or make further requests, the College should not continue sending CEMs to that person unless the person falls within the “existing business relationship” exemption. That would permit the College to send CEMs to an individual for six months after the inquiry or application was made, so long as the communication arose from that inquiry or application. Express consent should be sought during that time-frame.
2. Applicants – individuals who have applied to the College and paid an application fee have entered into a business relationship with the College. As long as that student remains active as a pending or enrolled student the College can send CEMs related to student’s status. This would include application status, financial matters, College sporting events, and information such as orientation events, schedules, accommodations info, student union info, and book lists and prices.
3. Students – The existing business relationship applies to persons who have purchased a product or service from the College within the two-year period immediately before the day the CEM is sent to that person. Since the College’s services are provided on an ongoing basis, the two-year period can be considered to begin on the day that the relationship ends – that is, when the student ceases to attend the College. Students who are enrolled in the College and who pay fees fall under this category because they purchased a service from the College. Under CASL, there is implied consent to send CEMs to current students and students who ceased to attend the College within the past 2 years. In these circumstances, the College would still need to comply with the Content Requirements (see 3.1) for CEMs.
4. Donors – a donation or gift has been made by the recipient to Holland College or Holland College Foundation within a 2 year period before the day on which the message is sent. Please note that it is important that the date of the gift be tracked and that the sender verify that the implied consent is still in place prior to sending the message.
5. Volunteers – the recipient performed volunteer work for Holland College or the Holland College Foundation within a two year period immediately before the day on which the message is sent. Please note that it is important that the date that the recipient performed volunteer work be tracked and that the sender verify that the implied consent is still in place prior to sending the message.
6. Members of the Holland College Recreation Centre – the recipient has been a member within the 2 year period immediately before the day on which the message is sent. Please note that it is important that the date that the person became a member be carefully tracked and that the sender verify that the implied consent is still in place prior to sending the message.
7. If individuals have conspicuously published their business contact information and they have not indicated that they do not want to receive CEMs. For example, you could send a business-related CEM to a business if it prominently posts its email on its website. Please note that this type of implied consent only applies to businesses, not to private individuals. Note that it is important to verify each time a message is sent that the business contact information is conspicuously posted and that the recipient has not indicated that they don’t want to receive CEMs.

Please note:

• Relying on the implied consent requirements noted above only excuses the sender from having to obtain express consent of the recipients for a limited time. The implied consent does expire, in most cases, within 2 years (or sooner if the recipient unsubscribes). Therefore, it is recommended that this time-frame be used to procure express consents, which are valid until the recipient unsubscribes.
• The Unsubscribe and identification requirements for the commercial electronic messages still apply.
• If the potential recipient unsubscribes or indicates that they do not wish to receive the CEMs any longer, we can no longer rely on the implied consent exception.
• The burden of proving that implied consent is in place falls on the sender. So, if an individual College employee, department or unit is going to rely on implied consent:
  • The date the implied consent is established must be carefully tracked.
  • The employee, department or unit must check to ensure that the implied consent is still valid before sending the CEM.

4.3. What is express consent?

Express consent should be in writing. Individuals may provide their consent in various ways (e.g. by signing a document, sending you an email, entering information into a webform, or clicking on an “I Accept” button). Once you have secured someone’s express consent, then you may continue to send them CEMs indefinitely unless the individual “unsubscribes” from further messages.

To secure somebody’s express consent, you have to identify:

• the specific purpose for which you are seeking their consent;
• the name of the Holland College department or unit seeking consent;
• the following contact information for the Holland College department or unit seeking consent :
  • mailing address
  • telephone number and/or email address and/or web address
• a statement indicating that the person whose consent is sought can withdraw their consent.

In addition to requesting the individual’s consent, it is also still necessary to provide a privacy statement explaining why you are collecting personal information from the individual.

Please note that the information outlined above must be conspicuously or prominently displayed. It cannot be buried in “fine print”, amongst other terms and conditions or lumped together with, for example, privacy statements.

4.4. Are there any exceptions to the consent requirements?

Yes. The following messages do not require the sender to obtain consent. However, the sender must still comply with the unsubscribe mechanism and identification requirements:

1. Messages that solely provide a quote or estimate if the quote or estimate was requested by the recipient;
2. A message that is solely confirmation of a transaction (ex. sending a receipt or confirming delivery details);
3. Message that solely provides warranty information, product recall information or safety or security information about a product that Holland College sold to the recipient;
4. Messages that provide solely factual information about the ongoing use or ongoing purchase by the recipient of a product, service or good offered under a membership or loan (ex. facility operation hours for the gym sent to a member, information about how to return a textbook rental sent to a student who has rented a textbook, information about how to renew a recreation centre membership or locker sent to a recreation centre member);
5. Messages that solely relate directly to an ongoing employment relationship don’t require consent. Holland College can send unsolicited emails to its employees, as long as those emails are solely for the purpose of managing the employment relationship. Examples of this would include Holland College (or an agent of Holland College) sending information that the employee needs about their benefits.
6. Messages that solely deliver a product, goods or a service, including product updates or upgrades, that the person to whom the message is sent is entitled to receive under the terms of a transaction that they have previously entered into with the sender of the message; and
7. Messages posted on a Facebook wall or sent out as tweets on Twitter, as long as the identity of the sender and the unsubscribe mechanism that meets the legislative requirements are conspicuously published and readily available on the sender’s user interface (profile page or home page).

4.5. How do you request somebody’s express consent?

The easiest way to request express consent is to do so when an individual applies for a service or purchases a good.

You can also proactively request somebody’s express consent by mailing or handing them a printed form to complete and return to you.

Consent must be “opt-in,” not “opt-out.” This means that if you are using a check-box for consent, the individual must check the box to explicitly indicate his or her consent. The box cannot be “pre-checked.”

4.6. If somebody gives you their business card, are they giving you their consent to send them a CEM?

It is arguable under the legislation that in this instance the individual has “conspicuously published” their email address. As long as the proposed recipient did not indicate that they did not wish to receive commercial electronic messages when they gave their business card, the potential sender may send commercial electronic messages to the recipient. Please note, however, that these commercial electronic messages must still comply with the unsubscribe mechanism and identification requirements.

4.7. If somebody has applied to be a Holland College student, does Holland College have their consent to send them a CEM?

Yes. As long as the CEM is related to the application and the processes involved with becoming a student at the College (see 4.2(2)).

4.8. If someone graduated from Holland College five years ago, does Holland College have their consent to send them a CEM?

If this person is a Holland College Alumnus or Alumnae, Holland College has determined that we can claim implied consent to send commercial electronic messages to that person. However, please note that we must still include an unsubscribe option and comply with the identification requirements of the legislation. If the alumnus/alumnae unsubscribes, we can no longer claim that we have implied consent. Also, once a person unsubscribes we cannot subsequently send them a message asking them for their express consent, because such a message is a CEM.

4.9. Can we get blanket consent from students or other individuals for Holland College to send them CEMs?

Unless a contact management system is being used any request for consent should indicate that consent means ‘consent to receive email from Holland College’. The College is adopting an all-or-nothing approach and while this may change in the future, presently if a recipient unsubscribes using the unsubscribe link provided on all outgoing external College email, they are unsubscribing form receiving any further email from the College. Unsubscribe requests submitted to CASL@hollandcollege.com will initiate a procedure to have that email address blocked by the College’s external email server. This means the College email system will no longer permit any email to be sent to that email address. If you happen to receive an unsubscribe request, please forward it to CASL@hollandcollege.com.

Some departments or units of the College may be using a contact management system which by-passes the College email system. The contact management system used must provide full compliance with CASL. Unsubscribing through a contact management system will only affect subscribers through that system.

4.10. Are there differences between obtaining consent under CASL and obtaining consent under PIPEDA?

Yes. The requirements and obligations for obtaining express consent under the CASL are separate and distinct obligations, and differ from the requirements for obtaining consent under PIPEDA. CASL does not alter the Holland College obligations under PIPEDA.

It is important, when you are seeking express consent, that the consent be distinctively and separately sought. The request for consent will not be valid if it is simply included with boilerplate language, fine print or other “consents” such as privacy statements.

For more information about PIPEDA and the requirements for obtaining consent under that legislation, please see Holland College Board Policy 30-08 – Personal Information Protection and Electronic Documents Act (“PIPEDA”).

4.11. Do you have to keep a record of the consents you have secured?

Yes. This is absolutely essential. If you send a CEM without being able to prove that the recipient has consented to receive it, you are placing Holland College and yourself at risk of a substantial fine under CASL. In some cases, sloppy record-keeping may invalidate an entire mailing list.

5. Unsubscribe Mechanisms

5.1. What are the requirements for unsubscribe mechanisms?

CASL requires all CEMs to give subscribers the opportunity to unsubscribe from future CEMs without cost to them. Your unsubscribe mechanism must be easy to access and use. An unsubscribe mechanism must be valid for at least 60 days after you send the CEM. If you receive a request to unsubscribe, you must comply within 10 business days.

The College has implemented a process that attaches the following to all email to external addresses (internal means any email with @hollandcollege.com in the address):
Unsubscribe from further Emails from any department or individual with an @hollandcollege.com email address.

This unsubscribe request initiates an email to CASL@hollandcollege.com. Upon receiving the request a procedure to have that email address blocked by the College’s external email server is commenced. Blocked means the College email system will no longer permit any email to be sent to that email address.The College has chosen to implement an all-or-nothing approach and while this may change in the future, presently if a recipient unsubscribes using the unsubscribe link provided on all outgoing external College email, they are unsubscribing form receiving any further email from the College (Note: some exceptions as permitted under CASL may apply).  If you happen to receive an unsubscribe request, please forward it to CASL@hollandcollege.com.

Unsubscribers may change their status by submitting a ‘subscribe me’ request to CASL@hollandcollege.com. All requests are considered by the CASL Contact and approved requests are forwarded to Computer Services to have the email address removed from the blocked list.

When you send CEMs by text message, then you must offer both of the following unsubscribe methods:

• replying to the text message with the word “STOP”; and
• clicking on a link that will take the individual to a web page where he or she can unsubscribe

5.2. Do I have to keep track of unsubscribe requests?

Yes. It is essential to track which electronic addresses have submitted unsubscribe requests to ensure that CEMs are not sent to them against the recipient’s wishes. It is also essential to track the date that the recipient submitted the unsubscribe request and also the date that Holland College complied with the request in order to show that the recipient was unsubscribed within the legislated 10 day period.

Any unsubscribe request received that specifies all Holland College email addresses must be forwarded to CASL@HollandCollege.com. The request and any communication relating to it is saved. Computer Services also retains a record of all work orders for unsubscribe and subscribe.

6. Other CASL Requirements

6.1. What are the other CASL requirements?

In addition to the requirements related to CEMs, CASL also contains the following prohibitions:

Installing unwanted computer programs: In order to prevent the installation of viruses, spyware, and other unwanted programs, CASL prohibits the installation of any program without the consent of the computer owner.

Altering transmission data: CASL prohibits the alteration of transmission data in an electronic message so that the message is delivered to a destination other than that specified by the sender.

Providing false or misleading information: CASL prohibits false or misleading information in CEMs, including:

• any representation in the body of the message that is false or misleading in a material respect;
• any false or misleading representation made in a “locator”, i.e. a name, URL, or other information used to identify the source of data in a computer system; and
• any false or misleading representation in the “From” or “Subject” line of a message.

Harvesting addresses: CASL prohibits the use of programs that “harvest” email addresses to create mailing lists.

Collecting personal information: CASL prohibits the use of computer systems to collect personal information without authority.

7. More Information

7.1. Where can I get more information about privacy?

In addition to CASL, you must also consider privacy issues whenever you are collecting, using or disclosing personal information. For more information, see Holland College Board Policy 30-08 – Personal Information Protection and Electronic Documents Act (“PIPEDA”).

7.2. Where can I get more information about CASL?

General information on CASL and its requirements can be obtained from the Canadian Radio-television and Telecommunications Commission (CRTC) and the Government of Canada at www.fightspam.gc.ca.

For specific information relating to CASL at Holland College contact the College’s CASL contact at CASL@HollandCollege.com.

Please note that Holland College employees are expected to comply with the guidelines and interpretations of the legislation adopted and communicated by Holland College. This is part of ensuring that Holland College can use the defense of due diligence in the event that a fine is levied against Holland College for noncompliance or in the eventuality that a lawsuit is commenced against Holland College by private citizens claiming noncompliance.