Business Checklist for CASL Compliance: Canada’s Anti-Spam Legislation
How to prepare for Canada’s New Anti-Spam Legislation:
|
1. Business Awareness |
Identify a key individual or individuals in your business and form a committee of one or a committee representative of each department affected to address CASL going forward.
|
Item |
Responsibility of |
√ |
|
Identify a key individual or CASL Team in your business. |
|
|
|
Training on CASL Compliance. |
|
|
|
Develop and document a CASL compliance plan |
|
|
|
2. CEM (Commercial Electronic Message) Inventory and Review |
Identifying what kinds of CEMs are currently being sent, what form these CEMs take, to whom they are sent, and why are they sent?
|
Item |
Responsibility of |
√ |
|
Take inventory of all databases: CRM (customer), email marketing lists and databases. |
|
|
|
Review all online forms that capture data (e.g. newsletter signup form) |
|
|
|
Review all offline forms for data capture (e.g. trade shows, phone leads, received business cards, etc.) |
|
|
|
Review all email marketing campaigns, manual email marketing campaigns and automated email notifications. |
|
|
|
Review all social media notifications and messages. |
|
|
|
3. Know Your Exemptions |
Identifying Exemptions – categorizing (with appropriate supporting information) CEM recipients who fall under one or more of the exceptions to CASL; such as, where the sender (a) has a family or personal relationship with the recipient, (b) is responding to the recipient’s request, inquiry or complaint, (c) is enforcing a legal right, (d) is sending a business-to-business CEM (within and between firms) in the context of an ongoing business relationship, or (e) is a foreign business sending a CEM to a foreign recipient who accesses the CEM while roaming in Canada.
|
Item |
Responsibility of |
√ |
|
Identify all of your exemptions. |
|
|
|
4. Consent Reconfirm and Tracking |
Once CASL comes into force (July 1st , 2014), you can’t send an electronic message requesting consent because it will be considered a CEM.
Should there be any question about compliance with CASL, you need to be able to say when, where and how you received permission. The easiest way to track permission is to have people electronically grant permission – then the database shows a date, time and method of permission. The onus is on you to clearly prove permission.
|
Item |
Responsibility of |
√ |
|
Review all your current contacts for express or implied consent. |
|
|
|
Consent check – Send out email re-confirmations to achieve opt-in express consent. So, email to your implied contacts to supersize them to express consent. E.g. Language like “We want to make sure our subscribers receive the right information. Please verify your address here.” |
|
|
|
If you are recording signup manually, maintain those records. |
|
|
|
5. Database Review and setup for CASL. |
Some changes should be made to the technology you use for the purpose of tracking CASL consents and related information.
|
Item |
Responsibility of |
√ |
|
Create a database/tracking system to track express and implied consent. CRM solution, email marketing solution, Excel etc. Maintain records for three years. |
|
|
|
Segment all databases by their consent level: express and implied consent. |
|
|
|
If implied consent you will need to tract the two year rule. What is their “stop send” date? |
|
|
|
Make certain your email marketing system has captured the date/time of the new signup, along with the subscriber’s IP address. |
|
|
|
6. Process Review |
Under CASL there will be requirements for your business to change certain business message processes.
|
Item |
Responsibility of |
√ |
|
Prescribed Information – make certain that all outgoing CEM’s comply with the prescribed information. The message: identifies the sender, includes the required contact information. |
|
|
|
Unsubscribe mechanism – making sure you have a working unsubscribe mechanisms and notices are in place and meet all existing CASL requirements. The mechanism is functional for at least 60 days. |
|
|
|
No pre-checked opt-in boxes on any web forms. |
|
|
|
Consider a double opt-in for email marketing subscribers. |
|
|
10 things every small business should know about CASL – Canada’s Anti-Spam Legislation
It’s almost here! Whaaaat, you’ve never heard of it?
Canada’s new anti-spam legislation or CASL will come into effect this year!
Why is this new law important to small businesses? Because it forces us to change the way we communicate in a business to business and business to consumer context. No longer can we come home from a trade show with a fish bowl full of business cards and start blasting away the emails.
We now need to ask permission first.
Here are 10 things every small business should know about CASL:
1. The Anti-Spam act imposes significant restrictions on the sending of unsolicited commercial electronic messages or CEM’s.
2. A commercial electronic message or CEM is any electronic message that encourages participation in a commercial activity, regardless of whether there is an expectation of profit. Email, SMS Texts, instant messages and social network messages (Twitter, Facebook) are all electronic messages.
3. Even if a message is a CEM, you will not need consent to send a quotation, complete a transaction or provide warranty, recall or safety information. Yes there are exemptions!
4. Everyone now has to have what they are calling “prescribed information” in their electronic messages. What this means is you have to completely identify yourself, your company information, and have some mechanism for them to unsubscribe if they choose not to want to receive any more of your electronic content.
5. So, what exactly is consent? You now have to get someone’s upfront permission or consent to send them an electronic message, call it opt-in to marketing. There are two forms of consent express and implied. If you have completed a business transaction with someone, you have 2 years or until the person withdraws their consent to send them electronic messages. Be prepared to track this.
6. Express consent; meaning someone gave you permission to send them a CEM. Examples: sign-up on a website, response to a contest or coupon offer or a sign up at a point of sale.
7. Implied Consent; meaning it would be reasonable to conclude you have someone’s permission to send them a message based on a prior relationship. Example: a personal or a business relationship, a friend or customer.
8. The law comes into effect on July 1st 2014. Mark your calendar! If you’re going to get consent from your clients or customers, do it now! Why? Once CASL comes into force, you can’t send an electronic message requesting consent because it will be considered a CEM.
9. The Spam Police…..The law will be enforced by three government agencies: the Canadian Radio-Television and Telecommunications Commission (CRTC), the office of the privacy commissioner, and the Competition Bureau. Yes there will be a Spam Reporting Centre.
10. The Rap……The penalties for each violation can be up to $1-million for an individual and up to $10-million for companies.Ye be warned!
Bonus:
11. What you should do next?
a. CEM Audit and Process Review. It does not hurt to review all of your existing methods of electronic message to make sure you have consent.
b. Use some form of tracking system with an audit trail. So a CRM, Excel spreadsheet or an email marketing solution. Maintain records for a minimum of 3 years.
c. Reconfirm Consent. Do it now!
d. Change the way you communicate by making sure you incorporate the prescribed information: identify yourself, indicate on whose behalf, up to date contact information, unsubscribe mechanism of some kind.
For additional information, here are some sources that we have reviewed to educate ourselves on the new law:
Government of Canada – Canada’s Anti-Spam Legislation
What Canada’s new anti-spam law means to you – Deloitte
CASL: What you need to know about Canada’s new Anti-Spam Legislation – Retail Council of Canada
Anti-Spam 101: Risks and Implications for Business – FMC Law
Bennett Jones Anti Spam Learning Centre
New anti-spam law ‘a big deal’ for small businesses
As President of Centricity360, Richard Bolton is an independent consultant specializing in small business growth. Working one on one with his clients in a coaching capacity, Richard first seeks to understand their business then develops strategies and tactics to produce results. Focusing on internet marketing strategies, online selling techniques, increasing customer value and implementing value added technologies. He works with business owners, professionals, and organizations as a trusted advisor producing dynamic business growth.
Disclaimer – I am not a lawyer. My interpretations. That is all.
