Preparing for Canadian Anti-Spam Legislation
•
7 gefällt mir•1,124 views
The presentation is about preparing for the upcoming Canadian Anti-Spam Legislation. Learn what CASL is, the timing of it’s implementation and how it will apply to commercial email. We will review specific case studies to better define consent requirements and exceptions to those requirements.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (10)
Ähnlich wie Preparing for Canadian Anti-Spam Legislation
Ähnlich wie Preparing for Canadian Anti-Spam Legislation (20)
Mehr von Marketo
Mehr von Marketo (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Preparing for Canadian Anti-Spam Legislation
- 1. Page 1 © 2014 Marketo, Inc.#MKTGNATION14 Preparing for CASL Kiersti Esparza, CIPP/US Manager, Privacy Team | Marketo
- 2. Page 2 © 2014 Marketo, Inc.#MKTGNATION14 Preparing for CASL Disclaimer: “The information provided in this presentation can not be considered legal advice, and is not legally binding.”
- 3. Page 3 © 2014 Marketo, Inc.#MKTGNATION14 Preparing for CASL Disclaimer: • Marketo would be pleased to answer questions you may have about CASL • To avoid potentially misleading participants, Marketo is not in a position to answer hypothetical or situational questions such as “what if I” as we cannot measure the varying circumstances or procedures you may have in place. These types of questions should be either reviewed by your legal counsel or sent in writing to the CRTC, for their review and interpretation.
- 4. Page 4 © 2014 Marketo, Inc.#MKTGNATION14 What is CASL? • Canada's Anti-Spam Legislation Anti-Spam Anti- Malware Anti-Hacking Rules for sending Commercial Email Messages (CEMs) Rules for installation of computer programs Prohibition against unauthorized alteration of transmission data
- 5. Page 5 © 2014 Marketo, Inc.#MKTGNATION14 What is CASL? • Canada's Anti-Spam Legislation • CEMs – Commercial Electronic Messages • “an electronic message that, … it would be reasonable to conclude has as its purpose, or one of its purposes, to encourage participation in a commercial activity” Transactional or Operational messages with ANY commercial or marketing purpose
- 6. Page 6 © 2014 Marketo, Inc.#MKTGNATION14 Who enforces CASL? • Canadian Radio-television and Telecommunications Commission (CRTC) • Enforcement Agency • The Competition Bureau of Canada • Office of the Privacy Commissioner of Canada
- 7. Page 7 © 2014 Marketo, Inc.#MKTGNATION14 Requirements under CASL • Consent • Express or Implied • Several exemptions • Clearly identify yourself • Provide a method where the recipient can readily contact you • Unsubscribe mechanism • Functional for 60 days • No cost • Must process without delay
- 8. Page 8 © 2014 Marketo, Inc.#MKTGNATION14 Types of Consent • Express Consent • Implied Consent • Inquiry Consent
- 9. Page 9 © 2014 Marketo, Inc.#MKTGNATION14 Types of Consent • Express Consent • Did the recipient say “yes” to receiving your CEM? • An individual must take action to “opt-in” to a stated purpose
- 10. Page 10 © 2014 Marketo, Inc.#MKTGNATION14 Types of Consent • Implied Consent • Can you show that you have an existing business or non- business relationship? • Did the recipient disclose their address to you? • Is the address published? Is there a statement saying they don’t wish to be contacted? • Expires within 2 years
- 11. Page 11 © 2014 Marketo, Inc.#MKTGNATION14 Types of Consent • Inquiry Consent • Expires within 6 months
- 12. Page 12 © 2014 Marketo, Inc.#MKTGNATION14 Types of Consent • Express Consent • Implied Consent • Inquiry Consent
- 13. Page 13 © 2014 Marketo, Inc.#MKTGNATION14 Types of Consent • Don’t be afraid to ask!
- 14. Page 14 © 2014 Marketo, Inc.#MKTGNATION14 Can you prove Consent? • You are required to maintain an auditable record of consent No Pre-Checked Boxes for Express Consent • Request for consent must be separate from general terms and conditions • Record the date, time, purpose, and manner of consent in a database • Filling out a consent form at a point of purchase
- 15. Page 15 © 2014 Marketo, Inc.#MKTGNATION14 Can you prove Consent? FAQs: What about verbal consent? • where oral consent can be verified by an independent third party; or • where a complete and unedited audio recording of the consent is retained by the person seeking consent or a client of the person seeking consent.
- 16. Page 16 © 2014 Marketo, Inc.#MKTGNATION14 Timing • Coming Into Force July 1, 2014 • You will need consent from any new customer or lead and each CEM must include identification and unsubscribe mechanisms • Transitional Provisions • Previous express consent remains valid under CASL • Implied consent to continue sending for 3 years
- 17. Page 17 © 2014 Marketo, Inc.#MKTGNATION14 Special Cases • A person can get consent on behalf of yet to be determined third parties • All parties relying on consent obtained by others are accountable for managing that consent. • Identification and unsubscribe requirements still apply e.g. A Frequent Flyer program gets consent from members to send them messages on behalf of third parties that will be identified in the future (i.e. a car rental company). Must be a separate Opt-In from the main company’s Opt-In process.
- 18. Page 18 © 2014 Marketo, Inc.#MKTGNATION14 Special Cases • Third Party Referrals • You may refer a prospective customer to another person if you have an existing relationship with the prospective customer • If you receive a referral, you may send one CEM to the prospect CEM must include the full name of the individual who made the referral
- 19. Page 19 © 2014 Marketo, Inc.#MKTGNATION14 When is consent NOT required? • Personal emails between family and friends • Communications within an organization • In response to a request; quotes or estimates • Messages that facilitate or confirm transactions • Provides warranty, recall, safety or security information • Provides information about • ongoing use or ongoing purchases • ongoing subscription, membership, accounts, loans or similar • employment relationships or benefit plans • Registered charities and political candidates (Canadian only) • When the recipient is protected by equitable data protection laws in their own county NOTE: Identification and Unsubscribe mechanisms are still required for these types of messages
- 20. Page 20 © 2014 Marketo, Inc.#MKTGNATION14 Case Study #1
- 21. Page 21 © 2014 Marketo, Inc.#MKTGNATION14 Case Study #1 • Happy High School contracts Photo Corp to take graduation photos of its students. • Photo Corp sends these students’ parents a reminder that Photo Day is in one week. • The reminders contain a URL to Photo Corp’s website, where the parents can pre-order copies of their children’s graduation photos.
- 22. Page 22 © 2014 Marketo, Inc.#MKTGNATION14 Case Study #1 Are these Photo Day reminders CEMs? What if Happy High School is the one sending the Photo Day reminders? What if the Photo Day reminders state that there is a 10% early bird discount?
- 23. Page 23 © 2014 Marketo, Inc.#MKTGNATION14 Case Study #2
- 24. Page 24 © 2014 Marketo, Inc.#MKTGNATION14 Case Study #2 • Sally is an artist holding an exhibit at an art gallery. Sanjin is a sales representative of an art supplies store. • Sanjin picked up Sally’s business card at the exhibit but didn’t speak to her at the event. • Sanjin sends an email to Sally saying that, as an artist, she might be interested in a sale that his store is holding.
- 25. Page 25 © 2014 Marketo, Inc.#MKTGNATION14 Case Study #2 Is Sanjin’s email covered by any of the exemptions discussed? What if Sally is an employee of the art gallery, and a different employee of the art gallery has purchased art supplies from Sanjin’s store in the past?
- 26. Page 26 © 2014 Marketo, Inc.#MKTGNATION14 Case Study #3
- 27. Page 27 © 2014 Marketo, Inc.#MKTGNATION14 Case Study #3 • Tania is a lawyer in Toronto and a member of an international bowling association. • She obtains a list of the other members’ email addresses and notices that some of them end in .es, indicating the addresses are from Spain. • Since she is licensed to practice law in Spain, she emails the .es email addresses advertising her legal services.
- 28. Page 28 © 2014 Marketo, Inc.#MKTGNATION14 Case Study #3 Would CASL apply to Tania’s email? What if Sally, who works in Tania’s firm, emails the list of members notifying them that they may be eligible to join a class action she is organizing against a bowling ball manufacturer?
- 29. Page 29 © 2014 Marketo, Inc.#MKTGNATION14 • To catch blatant offenders • Responsible senders who are making efforts to comply are not the target of the law. What is the goal of CASL?
- 30. Page 30 © 2014 Marketo, Inc.#MKTGNATION14 Pop Quiz!
- 31. Page 31 © 2014 Marketo, Inc.#MKTGNATION14 Pop Quiz! • As long as your email is not commercial, CASL will not apply. a) True b) False
- 32. Page 32 © 2014 Marketo, Inc.#MKTGNATION14 Pop Quiz! • Which of these could violate CASL? a) An investment advisor gets a list of fellow attendees at a financial seminar and emails them all a sales pitch b) A business consultant emails someone she has never met in response to an inquiry about her professional services c) A computer salesperson emails someone about a laptop sale a year after selling her a computer d) A registered charity emails you asking for a donation
- 33. Page 33 © 2014 Marketo, Inc.#MKTGNATION14 Pop Quiz! • Which of the following is not an exemption category? a) Personal relationship b) Family relationship c) Existing business relationship d) Existing privacy consent e) Existing non-business relationship
- 34. Page 34 © 2014 Marketo, Inc.#MKTGNATION14 Pop Quiz! • Once CASL is fully in force, violations may result in: a) Penalties of up to $1 million for individuals b) Penalties of up to $10 million for organizations c) Civil liability for compensatory damages d) Civil statutory liability of up to $1 million per day e) All of the above
- 35. Page 35 © 2014 Marketo, Inc.#MKTGNATION14 Enforcement Process
- 36. Page 36 © 2014 Marketo, Inc.#MKTGNATION14 Checklist - Top 10 Steps Determine which of your messages are CEMs Identify any exemptions that may apply to your CEMs Record all consents, inquiries, applications, complaints and requests and when they were received Establish a process to help you refresh your consents Ensure that parties that have unsubscribed or otherwise not to receive CEMs will not be sent any requested Use an opt-in mechanism to gather consent Ensure there is a compliant unsubscribe function Ensure there is a compliant identification included Approach external service providers to ensure they can support marketing activities taken on your behalf in compliance of CASL Review legal developments relating to CASL to clarify some of the ambiguities surrounding the legislation
- 37. Page 37 © 2014 Marketo, Inc.#MKTGNATION14 Key Resources • Marketo’s webinar on CASL http://www.marketo.com/webinars/getting-ready-for-the-canadian-anti-spam-legislation/ • Information Session on Canada's Anti-Spam Legislation http://www.crtc.gc.ca/eng/com500/info.htm • Shaun Brown, Legal Counsel – http://www.nnovation.com • CASL Statute: http://laws-lois.justice.gc.ca/eng/acts/E-1.6/index.html • CRTC Regulations: http://laws-lois.justice.gc.ca/eng/regulations/SOR-2012-36/index.html • IC Regulations: http://fightspam.gc.ca/eic/site/030.nsf/eng/00273.html • Industry Canada’s Regulatory Impact Analysis Statement: http://fightspam.gc.ca/eic/site/030.nsf/eng/00271.html • CRTC’s Information Bulletin (2012-548) on formality requirements: http://www.crtc.gc.ca/eng/archive/2012/2012-548.htm • CRTC’s Information Bulletin (2012-549) on express consent: http://www.ic.gc.ca/eic/site/064.nsf/eng/07401.html
Hinweis der Redaktion
- Electronic Messages include An email account A telephone message or text An instant messaging account Any similar account
- Has to be commercial – broader than CAN SPAM, no primary purpose Electronic Messages include An email account A telephone account; text messages (voice messages are excluded) An instant messaging account Any similar account Non-exhaustive list Sent to or from a computer system located in Canada. Exclusion for messages sent from Canada to another country with belief it will comply with another countries anti-spam legislation. Ex. The US.
- Enforcement is done by Industry Canada and the CRTC. Broad investigative powers Administrative monetary penalties. Up to $10 Million per violation Competition Bureau (CB) Amends the Competition Act to include violations respecting: • Misleading and deceptive practices/ representations, including false headers, subject lines, etc...
- Consent must be auditable. You must be able to prove where your leads gave consent when called upon.
- Requires an action by the recipient. No check boxes. Never expires but can be revoked through an unsubscribe action. Clearly and conspicuously state purpose for obtaining consent. Clearly identify who is being given consent. If you are getting consent for a business partner you must state that business partner’s name . Provide contact information on behalf of who is getting consent. Inform individual that they can unsubscribe Image posted on CRTC website. Don’t NEED a check box. Check boxes are relevant where you may already have their email address.
- Existing Business Relationship ‒ Recipient purchased, leased or engaged in bartering of virtually anything from the sender within the past 2 years ‒ Recipient accepted a business, investment or gaming opportunity offered by the sender within the past 2 years ‒ Recipient and the sender entered into a written contract in respect of any of the above and the contract is either currently in existence or expired within the past 2 years Existing Non-Business Relationship ‒ The sender is a club, association or voluntary organization and the recipient is or was a member in the past two years Less relevant for business senders A conspicuously published address. Website Directory Provided to the sender Has to be relevant to the person in their professional business capacity – relevant in a B2B May be looser than Terms of Service of some service providers. May not want to continue sending to inactives – even if it is still OK under the law
- A business has six months where there is permission to send commercial email after an inquiry, which is converted to a two-year period of implied consent if the sender closes business with that recipient.
- • Data management will be key to compliance. Review existing data and groups consents: • Explicit * • Implied Inquiry • Third party • Unknown • None • Identify gaps in your database fields or the information you are tracking: • Consent date • Consent level • Consent source o Website o IP address • Last implied date • Last contact date
- Use this as a Marketing Opportunity! Show that you respect your recipients.
- a pre-checked box would be considered "opt-out" Maintain image of the form that was filled out. Online or offline.
- a pre-checked box would be considered "opt-out" Onerous requirements. CRTC backed off and these are “suggestions” Date, time, method, agent on the phone – whatever records you can maintain.
- Where an existing business relationship or non-business relationship exists as of July 1, 2014, regardless of when the relationship began, implied consent is automatically refreshed until July 1, 2017 To rely on the provision, there must have been prior communication of CEMs between sender and recipient
- List Rental situations Must be relevant to original business where consent was given.
- CASL only applies to Commercial Electronic Messages CASL does not apply to messages that are sent: 1. Within or between business, where there’s an ongoing relationship; 2. In response to a request; 3. To enforce a legal right or obligation; 4. Via closed messaging systems; a) Proprietary system b) Messaging systems where ID and unsubscribe included on platform 5. To a foreign jurisdiction in compliance with their spam law; (see Schedule 1 in the ECPR) 6. By registered charities raising funds 7. By political candidates or organizations, soliciting political contributions Personal email – ma protect the Forward to a Friend functions.
- CEMs – Because the email contains some commercial purpose. Internal Communications within an Organization ‒ One member of an organization sends a CEM to another member of the organization ‒ The CEM concerns the activities of the organization ‒ Member includes: Employee Representative Consultant franchisee ‒ Key issue: how directly must the CEM “concern the activities” of the organization? Organization-to-Organization Communications ‒ A member of an organization sends a CEM to a member of another organization ‒ The two organizations have “a relationship” ‒ CEM concerns the activities of the receiving organization ‒ The term “relationship” is undefined – but clearly must be something other than the other types of “relationships” already defined in CASL ‒ Key issues: what kind of relationship must exist between the organizations? how directly must the CEM “concern the activities” of the other organization? Inquiry, Application, Solicited Communications CEM sent to a person engaged in a commercial activity and consists solely of an inquiry or application related to that activity
- CEMs – Because the email contains some commercial purpose. Internal Communications within an Organization ‒ One member of an organization sends a CEM to another member of the organization ‒ The CEM concerns the activities of the organization ‒ Member includes: Employee Representative Consultant franchisee ‒ Key issue: how directly must the CEM “concern the activities” of the organization? Organization-to-Organization Communications ‒ A member of an organization sends a CEM to a member of another organization ‒ The two organizations have “a relationship” ‒ CEM concerns the activities of the receiving organization ‒ The term “relationship” is undefined – but clearly must be something other than the other types of “relationships” already defined in CASL ‒ Key issues: what kind of relationship must exist between the organizations? how directly must the CEM “concern the activities” of the other organization? Inquiry, Application, Solicited Communications CEM sent to a person engaged in a commercial activity and consists solely of an inquiry or application related to that activity
- Yes, they are CEMs – Because the email contains some commercial purpose. Inquiry, Application, Solicited Communications CEM sent to a person engaged in a commercial activity and consists solely of an inquiry or application related to that activity Internal Communications within an Organization ‒ One member of an organization sends a CEM to another member of the organization ‒ The CEM concerns the activities of the organization ‒ Member includes: Employee Representative Consultant franchisee ‒ Key issue: how directly must the CEM “concern the activities” of the organization? Organization-to-Organization Communications ‒ A member of an organization sends a CEM to a member of another organization ‒ The two organizations have “a relationship” ‒ CEM concerns the activities of the receiving organization ‒ The term “relationship” is undefined – but clearly must be something other than the other types of “relationships” already defined in CASL ‒ Key issues: what kind of relationship must exist between the organizations? how directly must the CEM “concern the activities” of the other organization?
- Conspicuous Publication of Electronic Address ‒ Recipient has conspicuously published the electronic address to which the CEM is sent ‒ Publication not accompanied by a statement that the recipient does not wish to receive unsolicited CEMs at the electronic address ‒ CEM is relevant to the recipient’s business, role, functions or duties in a business or official capacity ‒ The term “conspicuously published” is not defined ‒ Similar exemption in Australian and New Zealand anti-spam laws ‒ Key issue: determining when a CEM is “relevant to” the recipient’s role in a business or official capacity Disclosure of Electronic Address ‒ Recipient has disclosed to the sender the electronic address to which the CEM is sent ‒ Recipient has not indicated his or her wish not to receive unsolicited CEMs ‒ CEM is relevant to the recipient’s business, role, functions or duties in a business or official capacity ‒ One of the widest (and least talked about) exemptions ‒ Potentially broader than existing relationship exemptions ‒ Key issue: determining when a CEM is “relevant to” the recipient’s role in a business or official capacity Consent Received by Another ‒ A person can seek consent to send CEMs on behalf of one or more other parties ‒ CEM sent on basis of such consent must: Comply with ordinary formality requirements Identify the person who obtained the consent Include an unsubscribe mechanism that allows the recipient to withdraw consent from the following parties: the person who obtained the express consent any other person who is authorized to use the express consent ‒ Withdrawal of consent must be communicated to affected parties Existing Business Relationship ‒ Recipient purchased, leased or engaged in bartering of virtually anything from the sender within the past 2 years ‒ Recipient accepted a business, investment or gaming opportunity offered by the sender within the past 2 years ‒ Recipient inquired or applied for anything mentioned above from the sender within the past 6 months ‒ Recipient and the sender entered into a written contract in respect of any of the above and the contract is either currently in existence or expired within the past 2 years Information about Ongoing Use or Relationship CEM solely provides “notification of factual information” about: the ongoing use or purchase by the recipient of a product, goods or a service offered under a subscription, membership, account, loan or similar relationship by the sender; or the ongoing subscription, membership, account, loan or similar relationship of the recipient Commercial Transaction in Progress ‒ CEM solely facilitates, completes or confirms a commercial transaction that recipient agreed to enter into with the sender ‒ Necessary if you have no existing business or non-business relationship within the relevant time period requirements to allow consent to be implied
- Conspicuous Publication of Electronic Address ‒ Recipient has conspicuously published the electronic address to which the CEM is sent ‒ Publication not accompanied by a statement that the recipient does not wish to receive unsolicited CEMs at the electronic address ‒ CEM is relevant to the recipient’s business, role, functions or duties in a business or official capacity ‒ The term “conspicuously published” is not defined ‒ Similar exemption in Australian and New Zealand anti-spam laws ‒ Key issue: determining when a CEM is “relevant to” the recipient’s role in a business or official capacity Disclosure of Electronic Address ‒ Recipient has disclosed to the sender the electronic address to which the CEM is sent ‒ Recipient has not indicated his or her wish not to receive unsolicited CEMs ‒ CEM is relevant to the recipient’s business, role, functions or duties in a business or official capacity ‒ One of the widest (and least talked about) exemptions ‒ Potentially broader than existing relationship exemptions ‒ Key issue: determining when a CEM is “relevant to” the recipient’s role in a business or official capacity Consent Received by Another ‒ A person can seek consent to send CEMs on behalf of one or more other parties ‒ CEM sent on basis of such consent must: Comply with ordinary formality requirements Identify the person who obtained the consent Include an unsubscribe mechanism that allows the recipient to withdraw consent from the following parties: the person who obtained the express consent any other person who is authorized to use the express consent ‒ Withdrawal of consent must be communicated to affected parties Existing Business Relationship ‒ Recipient purchased, leased or engaged in bartering of virtually anything from the sender within the past 2 years ‒ Recipient accepted a business, investment or gaming opportunity offered by the sender within the past 2 years ‒ Recipient inquired or applied for anything mentioned above from the sender within the past 6 months ‒ Recipient and the sender entered into a written contract in respect of any of the above and the contract is either currently in existence or expired within the past 2 years Information about Ongoing Use or Relationship CEM solely provides “notification of factual information” about: the ongoing use or purchase by the recipient of a product, goods or a service offered under a subscription, membership, account, loan or similar relationship by the sender; or the ongoing subscription, membership, account, loan or similar relationship of the recipient Commercial Transaction in Progress ‒ CEM solely facilitates, completes or confirms a commercial transaction that recipient agreed to enter into with the sender ‒ Necessary if you have no existing business or non-business relationship within the relevant time period requirements to allow consent to be implied
- Conspicuous Publication of Electronic Address ‒ Recipient has conspicuously published the electronic address to which the CEM is sent ‒ Publication not accompanied by a statement that the recipient does not wish to receive unsolicited CEMs at the electronic address ‒ CEM is relevant to the recipient’s business, role, functions or duties in a business or official capacity ‒ The term “conspicuously published” is not defined ‒ Similar exemption in Australian and New Zealand anti-spam laws ‒ Key issue: determining when a CEM is “relevant to” the recipient’s role in a business or official capacity Disclosure of Electronic Address ‒ Recipient has disclosed to the sender the electronic address to which the CEM is sent ‒ Recipient has not indicated his or her wish not to receive unsolicited CEMs ‒ CEM is relevant to the recipient’s business, role, functions or duties in a business or official capacity ‒ One of the widest (and least talked about) exemptions ‒ Potentially broader than existing relationship exemptions ‒ Key issue: determining when a CEM is “relevant to” the recipient’s role in a business or official capacity Existing Business Relationship ‒ Recipient purchased, leased or engaged in bartering of virtually anything from the sender within the past 2 years ‒ Recipient accepted a business, investment or gaming opportunity offered by the sender within the past 2 years ‒ Recipient inquired or applied for anything mentioned above from the sender within the past 6 months ‒ Recipient and the sender entered into a written contract in respect of any of the above and the contract is either currently in existence or expired within the past 2 years Information about Ongoing Use or Relationship CEM solely provides “notification of factual information” about: the ongoing use or purchase by the recipient of a product, goods or a service offered under a subscription, membership, account, loan or similar relationship by the sender; or the ongoing subscription, membership, account, loan or similar relationship of the recipient Commercial Transaction in Progress ‒ CEM solely facilitates, completes or confirms a commercial transaction that recipient agreed to enter into with the sender ‒ Necessary if you have no existing business or non-business relationship within the relevant time period requirements to allow consent to be implied
- Conspicuous Publication of Electronic Address ‒ Recipient has conspicuously published the electronic address to which the CEM is sent ‒ Publication not accompanied by a statement that the recipient does not wish to receive unsolicited CEMs at the electronic address ‒ CEM is relevant to the recipient’s business, role, functions or duties in a business or official capacity ‒ The term “conspicuously published” is not defined ‒ Similar exemption in Australian and New Zealand anti-spam laws ‒ Key issue: determining when a CEM is “relevant to” the recipient’s role in a business or official capacity Recipients are covered by Spain’s DPA Additional related exemptions: ‒ Third-party referral CEM must include the full name of the individual who made the referral
- “CASL puts a legal framework around engagement, and defines what have been best practices for years.” Common sense approach Knowingly, Intentionally, Repeatedly violate rules
- Shaun is from an Ottawa based law firm