CASL - Private Right of Action Suspended
July 1, 2017 was slated to be the date when a “private right of action” under Canada’s anti-spam legislation (CASL) was scheduled to come into force. This private right of action was suspended indefinitely by the Canadian government through an Order in Council published June 7, 2017. According to the government news release, the private right of action was suspended “in response to broad-based concerns raised by businesses, charities, and the non-profit sector”, and the government will ask a parliamentary committee to review the legislation.
The private right of action, had it come into force, would have allowed any person alleging they were affected by a contravention of CASL’s provisions for the sending of commercial electronic messages (CEMs), alteration of transmission data or installation of computer programs, to sue individuals and organizations alleged to have engaged in the contravention. There was significant concern regarding this private right of action due to the risk of class action proceedings and that violations found in private actions would have allowed for potential recovery of not only actual damages, but also statutory damages without proof of loss (for e.g., in the case of a contravention of the commercial electronic messaging provisions, up to $200 for each contravention, not exceeding $1,000,000 for each day on which a contravention occurred).
Although many organizations are no doubt breathing a sigh of relief that the private right of action has been suspended, enforcement of CASL by the government continues and can carry significant penalties. It is important that organizations continue to implement and maintain appropriate CASL compliance programs.
End of Transition Period for Implied Consent to Send CEMs
July 1, 2017 also marked the end of the “transition period” under CASL during which organizations were deemed in certain instances to have implied consent for sending CEMs.
Generally, if an organization had, as of July 1, 2014 (when CASL came into force), an “existing business relationship” or “existing non-business relationship” (as defined in CASL, but without regard to the 2-year or 6-month periods referred to those definitions) with a person, and that relationship included the sending of CEMs, then the organization was deemed to have implied consent to send CEMs to that person for 3 years (until July 1, 2017) or until the person opted out, whichever earlier.
That transition period ended on July 1, 2017. Organizations are no longer able to rely on the transitional provision for deemed implied consent to send CEMs and will have to have express consent or rely on another basis for implied consent under CASL. The circumstances in which implied consent may be relied upon are limited to specific circumstances under CASL (for e.g., where an “existing business relationship” or “existing non-business relationship” as defined under CASL exists and has not expired and the recipient has not opted out). Implied consent is also available (as long as the message recipient has not opted out) where the recipient has disclosed to the sender or conspicuously published their electronic address, has not indicated a wish not to receive unsolicited CEMs at such address, and the message is relevant to the recipient’s business, role, functions or duties in a business or official capacity. It is important to keep appropriate records to demonstrate consent as the onus of proving consent is on the sender.
The government’s suspension of the private right of action does not impact the termination of the transition period.