Recent enforcement under Canada’s anti-spam legislation (CASL) by the Canadian Radio-Television and Telecommunications Commission (CRTC) is keeping the spotlight on this new legislation, which came into force just last year. While the CRTC is responsible for the bulk of enforcement under CASL, organizations should remember that CASL also brought in changes to Canada’s federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), which applies to the collection, use and disclosure of personal information (including individuals’ email addresses).
The federal Office of the Privacy Commissioner of Canada (OPC) is responsible for investigating violations related to the new provisions under PIPEDA that target the practice of address harvesting. Address harvesting generally involves collecting electronic addresses through the use of a computer program, such as through web scraping, spyware, or automatic generation.
The OPC recently issued a guide and tip sheet for organizations on pratical steps to take to avoid contravening the PIPEDA requirements, including:
1. Obtain consent: Organizations must ensure that individuals are informed clearly and accurately at the point of collection about how their email addresses will be used. Just because an email address is posted online, it cannot be assumed that the individuals at the addresses posted have provided consent to receive email marketing. It is also useful to remember that there is no exception for address harvesting of business email addresses; PIPEDA’s definition of personal information includes business addresses.
2. Due Diligence with Service Providers: If an organization buys a list of email addresses from a vendor or employs service providers to conduct email marketing on their behalf, they should take due diligence steps by asking key questions, such as:
- How was consent obtained? Appropriate consent at the time of collection must be obtained to use email addresses. Ensure that email marketing service providers utilize a clear consent process. If buying or using a list from a list vendor, were the email addresses collected through web scraping or automatic generation?
- How is the email address list kept up to date? Unless otherwise permitted under the law, individuals should be permitted to withdraw consent to the use of their personal information at any time, such as by unsubscribing from an email list, and this functionality should be made available. Organizations that use a purchased list of email addresses should ensure that any unsubscribe requests will be communicated to them so that the email can be removed from the list that they use.
3. Maintain written records: An organization should document all email marketing compliance measures, including due diligence steps taken when contracting with a list vendor or email marketing company. Ensure that the service agreements with these organizations expressly require compliance with CASL and applicable privacy laws.
Conclusion
Organizations are responsible for ensuring that all individuals that receive email marketing from them have provided appropriate consent for the collection and use of their address for marketing . The OPC will review reports to the Spam Reporting Centre to identify email harvesters and spyware collecting personal information without consent. Organizations should take steps to comply with PIPEDA to avoid being caught by an OPC investigation, which could lead to being named in the OPC’s reports of its findings and recommendations.
