The Canadian Radio-television and Telecommunications Commission (CRTC) has issued its first Compliance and Enforcement Decision* under Canada’s Anti-Spam Law (CASL). The Commission confirmed the staff finding that Blackstone Learning Corp. had committed 9 violations of CASL by sending almost 400,000 emails in 2014 without proper consent. However, the Commission reduced the administrative monetary penalty originally set in the notice of violation from $640,000 to $50,000. While it is open to Blackstone to appeal the decision, meaning that we may not have heard the last of this case, the Commission’s decision provides useful commentary on its approach to CASL compliance and enforcement. The following are lessons learned under two headings: implied consent, and what we will refer to as “sender conduct”.
Email addresses posted online – ripe for the picking as “implied consent”?
Not so fast, cautions the CRTC. While addresses that have been “conspicuously published” online or otherwise may qualify for implied consent, this “does not provide persons sending commercial electronic messages [CEMs] with a broad licence to contact any electronic address they find online”. The CASL conditions attached to “conspicuous publication” set a higher standard than that. As a starting point, the person who receives the email message must have posted his address himself, or authorized it to be posted. Often, an employer will post contact information including an employee’s email address, which for the purposes of CASL implies that CEMs can be sent IF there is no indication otherwise, and IF the messages are relevant to the person’s business role or function.
As the CRTC points out, if a business chooses to advertise through a third party (our example: an online service provider listing) and includes an employee’s contact information along with the ad, this can be the basis for implied consent to contact the employee in relation either to the ad or to the employee’s role, because the account holder (the employer) caused the publication. Implied consent stops there: if the listing service goes on to copy or sell the list of addresses on its own, new senders can no longer count on the “conspicuous publication” implied consent, because the account holder did not authorize any further publication.
Lesson learned: Implied consent is evaluated on a case-by-case basis. Under CASL, the onus is on the sender to prove consent. The CRTC “stress[es] the importance of detailed and effective record-keeping for this reason.”
What is a “reasonable” monetary penalty under the CASL regime? How important are the sender’s conduct and circumstances?
CRTC staff set out a an administrative monetary penalty (AMP) of $640,000 in the notice of violation issued to Blackstone. Having determined that Blackstone did commit the CASL violations, the Commission considered whether the AMP was reasonable. CASL sets out a number of factors to be taken into consideration.
- purpose of the penalty: the Commission stated that the amount must be representative of the violations, and have enough of an impact on a person to promote changes in behavior, in effect a second chance. An amount high enough to put a person out of business would mean he would no longer have that second chance. An AMP of $640,000 would be too high.
- nature and scope of the violations: while almost 400,000 non-compliant messages were sent, were disruptive to the recipients, and prompted at least 60 complaints to the Spam Reporting Centre, the violations took place over only 2 months, and suggests that an AMP of $640,000 would be too high.
- ability to pay: based on the evidence, an AMP of $640,000 would significantly exceed Blackstone’s ability to pay.
- other factors – cooperation and self-correction: Blackstone’s failure to cooperate with the investigation increased the need for a penalty to ensure future compliance. However, the Commission saw some possibility of “self-correction” going forward, which suggested that a lower AMP would be appropriate.
The Commission decided on the amount of $50,000. The Commission noted that Blackstone did not have the benefit of more recent CASL guidance which is now available to everyone online. This should be read as a thinly-veiled direction to others: the decision cites The Commission’s Guidance on Implied Consent for CASL and also the Department of Industry’s Fightspam information website for businesses and individuals.
Lesson learned: the Commission expects organizations to do their homework, to cooperate with investigations, and to self-correct when they discover mistakes.
We have been assisting many organizations in Canada and other countries to adapt their practices to comply with CASL. Let us know if we can help you.