canadian anti-spam legislation (casl) · the canadian anti-spam legislation (casl)1 took effect on...
TRANSCRIPT
Kelly Ernst, Ph.D., Principal Consultant,
The Strategic Intelligence Alliance, Inc., July, 2014
Much has been written about the CASL, especially in reference to charitable organizations. How
CASL applies to nonprofit organizations that are not a registered charities is far less clear. This article
attempts to help describe CASL requirements with a context for nonprofit organizations without
charitable status.
This document should not be used as legal advice. It is recommended that readers seek this advice from their
legal counsel for greater specificity about any legal concept in this document. A NFP and privacy consultant
can assist you with designing processes to comply with CASL or related privacy legislation.
Canadian Anti-Spam Legislation (CASL)
What Canadian Nonprofit Organizations without Charitable Status Need to Know
Canadian Anti-Spam Legislation (CASL): What Canadian Nonprofit Organizations without Charitable Status Need to Know
Copyright © 2014 by Kelly P. Ernst
ISBN: 978-0-9938984-0-2
All rights reserved
For information and permission to reprint selections from this report, contact:
Kelly Ernst at
The Strategic Intelligence Alliance, Inc., Calgary, Alberta
Acknowledgements
Thank you to Darryl Aarbo and Gary Courtney of Courtney Aarbo Fuldauer, LLP and
Gael MacLeod of Macleod Consulting in the preparation of this report.
THE STRATEGIC INTELLIGENCE ALLIANCE, INC.
2018 27th Street S.W., Calgary, Alberta T3E 2E7
Phone: 403-389-8941 • [email protected]
www. strategicintelligencealliance.com
TABLE OF CONTENTS
A. The Source of Risk ......................................................................................................................... 2
1. The Legislation – CASL and CEMs ............................................................................................. 2
2. Fines and Litigation ..................................................................................................................... 3
B. Understanding CASL before sending a Message............................................................................ 4
1. Commercial Electronic Messages (CEM) .................................................................................... 4
2. Content of Messages .................................................................................................................. 5
3. Indirect or Secondary Purpose Messages ................................................................................... 6
C. Relationships and Messaging ......................................................................................................... 7
1. Business Relationships ............................................................................................................... 7
2. Non-Business Relationships ........................................................................................................ 8
3. Personal Relationships ................................................................................................................ 8
4. Family Relationships ................................................................................................................... 9
D. Important Exemptions ..................................................................................................................... 9
1. Membership Exemptions ............................................................................................................. 9
2. Charity Exceptions ...................................................................................................................... 9
E. Sending Messages ....................................................................................................................... 11
1. Obtaining Consent ....................................................................................................................... 11
2. Identifying the Sender ................................................................................................................. 12
3. Opt-Out or Unsubscribe Requirement ....................................................................................... 12
4. First and Subsequent Messages ............................................................................................... 12
F. Nonprofit Noncharitable Scenarios ............................................................................................... 12
1. Growing a Not-Profit Organization without Charitable Registration ............................................ 12
2. Obtaining Donations without Charitable Receipts ...................................................................... 12
3. Social Enterprises ..................................................................................................................... 12
5. Partnerships .............................................................................................................................. 13
6. Events ....................................................................................................................................... 13
7. Free Expression, Dissent, and Advocacy .................................................................................. 13
8. Messages using cc and bcc ...................................................................................................... 13
9. Old Existing Lists ....................................................................................................................... 13
10. Grey Areas ............................................................................................................................ 13
H. Addressing CASL in Your Organization ........................................................................................... 14
2
CANADIAN ANTI-
SPAM LEGISLATION
(CASL) WHAT CANADIAN NONPROFIT
ORGANIZATIONS WITHOUT
CHARITABLE STATUS NEED TO KNOW
The Canadian anti-spam legislation (CASL)1 took effect on July 1st,
2014. The new legislation creates new areas of risk for nonprofit
organizations. Many people may be surprised to learn that their past
methods of messaging may no longer be in compliance with Canadian
law and their practices must change. There is also a substantial
difference between nonprofit organizations registered as charities and
organizations without charitable registration. Exemptions within the act
that apply to charities do not apply to non-charitable organizations. As
a result nonprofit organizations must operate as businesses when
addressing CASL, and not as charitable organizations. The following
summary of the legislation, regulations and interpretations is relevant
primarily to nonprofit organizations that do not have charitable
registration.
A. THE SOURCE OF RISK
1. The Legislation – CASL and CEMs
CASL is legislation intended to limit spam messages sent through
electronic communication. It is important to note that CASL refers to
more than what is publicly viewed as spam and includes an array of
commercial electronic messages (CEM)s sent through emails, texts,
tweets, electronic newsletters, and social messaging.2 The legislation
also refers to deceptive communication methods such as hacking,
malware, spyware, phishing, information mining through computer
software, and collecting email addresses without consent.
1 http://laws-lois.justice.gc.ca/eng/acts/E-1.6/FullText.html 2 http://www.crtc.gc.ca/eng/casl-lcap.htm
SPAM,
THE NEW
NFP RISK
Spam is typically
defined as “irrelevant
or inappropriate
messages sent on the
Internet to a large
number of recipients”
but spam is actually
not defined in CASL;
the legislation refers to
messaging in a far
broader way.
3
Putting limits on spam may seem like a simple concept, but it is actually quite complex. Compliance
with the legislation requires an understanding of the concepts within it and related privacy legislation. It
also requires an understanding of Canada Revenue Agency regulations especially concerning
definitions of business activities and regulation regarding charitable and noncharitable activity. Within
this broader context, the definition of what is and is not spam is quite unclear. To make matters even
more ambiguous, CASL does not provide a definition of spam and the word does not exist in the
legislation. Defining who can and cannot send or receive messages is not entirely intuitive. Even the
preamble of the act is confusing and hardly intuitive, it reads:
“An Act to promote the efficiency and adaptability of the Canadian economy by regulating
certain activities that discourage reliance on electronic means of carrying out commercial
activities, and to amend the Canadian Radio-television and Telecommunications Commission
Act, the Competition Act, the Personal Information Protection and Electronic Documents Act
and the Telecommunications Act (S.C. 2010, c. 23)”
Knowledge about how to implement the legislation in a noncharitable not-for-profit (NFP) organization is
limited. Proceeding with unbridled communication with the public about any nonprofit service is not
recommended and various key points of information should be noted prior to commencing any
communication program.
2. Fines and Litigation
Given fines are prohibitively large for noncompliance with the legislation and the possibility of litigation
issues exist, the risk to organizations and persons sending messages are high in some scenarios.
Fines can be levied against both persons and organizations. Fines for persons can be as high as
$1,000,000, and for an organization, as high as $10,000,000 (Section 20(4)). Personal fines for
violation of the legislation are applicable to volunteers, staff, and board members of organizations –
anyone sending emails on behalf of an organization. Fines can be administered when unauthorized
commercial electronic messages
are sent to individuals without the
consent of the recipient. Board
members are personally liable for
these fines and consequently
should take CASL seriously.
After July 2017, individuals and
organizations will also risk private
rights of action, or can be sued,
from complainants if violations
occur or are perceived to occur.
It is very important to note that complaints can be initiated by the recipient of a message simply based
on their perception that a spam or unwanted message has been received. Once a complaint is initiated
legal and other fees may be the responsibility of the person or organization sending the message.
To avoid fines, lawsuits, and the legal fees inherent in defending against complaints, it is important to
know pursuant to the legislation what a commercial electronic message (CEM) is, what acceptable
“Fines can be levied against both persons and
organizations. Fines for persons can go as high
as $1,000,000, and for an organization, as high as
$10,000,000”
4
consent is, and who can be in receipt of a message. There are
exemptions to prohibited messaging, but these are few and do not
apply in all cases.
B. UNDERSTANDING CASL BEFORE SENDING
A MESSAGE
Risk can be mitigated, but this requires knowledge about what is and is
not acceptable content in messages. This means knowing what
constitutes a commercial electronic message, acceptable message
content, and the context surrounding how to send a message.
1. Commercial Electronic Messages (CEM)
A CEM is defined in the legislation as,
“a commercial electronic message is an electronic message that,
having regard to the content of the message, the hyperlinks in the
message to content on a website or other database, or the contact
information contained in the message, it would be reasonable to
conclude has as its purpose, or one of its purposes, to encourage
participation in a commercial activity, including an electronic
message that,
a) offers to purchase, sell, barter or lease a product, goods, a
service, land or an interest or right in land;
b) offers to provide a business, investment or gaming
opportunity;
c) advertises or promotes anything referred to in paragraph (a)
or (b); or
d) promotes a person, including the public image of a person,
as being a person who does anything referred to in any of
paragraphs (a) to (c), or who intends to do so (Section 2).”
CASL might appear as a straightforward matter after a quick read of
the Government of Canada anti-spam website. The legislation forces
Canadians to pay close attention to the content of a message, to pay
attention to the hyperlinks within a message, to ensure that the sender
is always including his or her contact information, and to provide a
mechanism to unsubscribe from the messaging. However, CASL is
actually quite complex and without legal precedent explaining the
legislation, messengers must consider other sources to fully
understand what a CEM actually might entail.
THE CEM
Information about, or
invitation to, a service,
product, or event are
examples of NFP
business that can be
viewed as a
commercial electronic
message – CASL then
applies to this
message.
5
2. Content of Messages
A CEM relates to messages that include commercial activity in its content. Commercial activity is
broadly defined. The legislation notes,
“commercial activity” means any particular transaction, act or conduct or any regular course of
conduct that is of a commercial character, whether or not the person who carries it out does so
in the expectation of profit, other than any transaction, act or conduct that is carried out for the
purposes of law enforcement, public safety, the protection of Canada, the conduct of
international affairs or the defence of Canada (Section 1(1)).
No expectation of profit. It is very important to note that the commercial activity includes business
activity “whether or not the person
who carries it out does so in the
expectation of profit.” This
definition is consistent with
Canada Revenue Agency (CRA)’s
definitions of commercial activity
and business throughout its
interpretations of commercial
activity.
CRA also identifies some important words when defining business, these include “commercial
activity;… purchase, sell, barter or lease a product, goods, a service; and … business opportunity.”
Within this context, the message content that could be relevant to the legislation is extremely broad. In
CRA’s explanation of business and commercial activity it explains that,
“In establishing that an activity is sufficiently "business-like" to qualify as an "undertaking", a
number of factors should be considered, including:
1. whether the activity is serious and earnestly pursued;
2. whether the activity is actively pursued with reasonable and recognizable continuity;
3. whether the activity is conducted in a sound manner using recognized business
principles and records are maintained to that effect;
4. whether the supplies, if any, are of a kind which, subject to differences of detail, are
commonly made by those who seek to profit from them;
5. whether the activity facilitates or promotes the making of supplies (whether by the
person itself or by other persons); and
6. whether the activity supports other activities which are directed towards earning
revenue.3”
Some of the above factors may be weighted more than others, so the above should not be used as a
checklist, but rather a guide to determine if activity is business related. If an activity seems similar to
many of the elements or heavily weighted even in a few areas, the likelihood is the activity is business
or commercial activity. For a nonprofit organization, the above applies to a wide array of activities
centred on an organization’s services or products.
3 http://www.cra-arc.gc.ca/E/pub/gl/p-167r/p-167r-e.html
“…commercial activity includes business activity
“whether or not the person who carries it out does
so in the expectation of profit.”
6
Service oriented. The word “service” in particular is an important word for nonprofit organizations to
consider in relation to the CEM definition. Most nonprofit organizations are in the business of providing
some sort of service rather than a product. So, activity that “offers to purchase, sell, barter, or lease” the
services of a nonprofit are likely included in the CRA definitions of commercial activity.
Mission oriented. The words “business opportunities” are also broadly defined by CRA. It is not
restricted to the purchase or sale of an entire business, but includes transactions related to the product
or service of a business. For a nonprofit organization this includes all of the opportunities to advance its
mission and vision related to the organization. This includes the general provision of services, events,
projects, advice, and so on that promote broadly entire sets of organization services.
Barter and volunteer oriented services. An additional consideration is the use of the word “barter.”
Barter means a transaction of services without monetary exchange. However it is important to note that
this exchange, in other circumstances, would occur with a monetary value – thus barter or not, there
could be a monetary value put toward the exchange. Volunteer services could be considered a similar
type of transaction. Any nonprofit organization volunteer services could place a monetary value on its
volunteer work. In fact, many nonprofit organizations monitor volunteer hours then place a value on
those hours in response, for example, to funders’ requests or when giving proposals and reports back
to funders. To complete a business exchange with respect to volunteer services, an organization may
(in return for volunteer services) be providing volunteer training, support services, advice, coordination
services, and so on.
Taken together, the above concepts suggest that nonprofit organizations should consider all of their
activity as business or commercial activity. There is little that is excluded. Communication about
services should be considered business transactions and thus fall under the definition of CEM.
3. Indirect or Secondary Purpose Messages
It is also important to note that the CASL legislation does not make a distinction between what appears
as the main purpose of a message and the secondary messages contained within the message. These
include hyperlinks in messages. For example, if a message is of a personal nature, but also includes a
secondary request for exchange of a
service, a hyperlink to a service, or a
request for a donation, then the
message may be perceived as a CEM.
This has implications for nonprofit
organizations that might encourage
volunteers, employees, or partners to
include in their messaging information
about basic services, requests for
event attendance, requests for funds,
and so on. Even a personal message
in this context can be considered a
CEM. This also applies to messages that have an initial purpose that then turn to new types of services
and products. If a person is in communication with a nonprofit organization regarding a service and this
is ongoing, then the initial purpose of this communication is a communication about commercial activity,
“CASL legislation does not make a distinction
between what appears as the main purpose of
a message and the secondary messages
contained within the message. These include
hyperlinks in messages.”
7
but is not subject to CASL restrictions. As soon as a person within an organization then requests
attention turns to a new or different service, then a new CEM transaction may begin. Subsequent
messaging about the new service may be perceived as spam and may be subject to all of the rules
concerning a CEM and CASL.
C. RELATIONSHIPS AND MESSAGING
Another important consideration in understanding the messaging that can and cannot occur is the type
of relationships the sender of the message has with the recipient of a CEM. In the colloquial definition
of spam, a message is sent to a group of people that is unwanted by the group. In CASL, spam is not
defined and instead it is simply a matter of whether or not the person receiving a message perceives
the message to be unwanted. If it is unwanted, the recipient may decline consent, unsubscribe from
future messages, or in the case consent was not obtained, he or she can lodge a complaint. The nature
of messaging under CASL moves from group messaging, in the case of the colloquial definition of
spam, to messaging with consent between one person and another. It becomes important to know the
nature of the relationship between the messenger and receiver to help determine the type of consent
that exists or is required in each individual case.
Any person can send a message to any other person and still have the message perceived as spam.
However, if a prior relationship exists where there is consent for information about a product or service,
then the message in this context is not considered spam. There are other exceptions as well.
1. Business Relationships
If a business relationship exists between one person and another, especially within the context of
provision of a particular service, then under CASL there is assumed to be implied consent for
communication (Section 9(a)). In this scenario, information can freely flow about services or products
delivered to the client. This consent remains in place for 2 years after the service is complete or when
the person withdraws his or her
consent to receive information.
Employees and contractors
within an organization
(colleagues) can freely flow
information about the
organization and its services. If
the nature of the information
turns to a new organization or
unrelated service, then a consent may be required between colleagues for the information to continue
to flow.
Charitable exemptions regarding communications with volunteers may not apply for nonprofit
noncharitable organizations (see page 8). A nonprofit organization should assume volunteers to be
within a business relationship. This allows an information flow between and among volunteers or
employees and volunteers. It is important to note that volunteers are normally used for specific
purposes and for specific services. When volunteer services are being used for one service and then
the volunteer is requested to contribute to new services, then the context may change and it is possible
When the context changes, “… it is possible that
the new service is has a sufficiently different
purpose so that the anti-spam legislation now
comes into effect.”
8
that the new service is has a sufficiently different purpose so that the anti-spam legislation now comes
into effect. The messages concerning the new service may constitute a CEM. For example, if an
employee is supervising a volunteer to provide food hampers to elderly, and then the employee
requests that the volunteer spend time with a completely special service in a different organization, for
example a new event for a new environmental organization, then the CEM about the special event
might be considered spam.
2. Non-Business Relationships
Non-business relationships are defined as a relationships arising from “a donation or gift made by the
person to whom the message is sent to any of those other persons within the two-year period
immediately before the day on which the message was sent, where that other person is a registered
charity as defined in subsection 248(1) of the Income Tax Act,4 a political party or organization, or a
person who is a candidate (Section 13(a)).” This also includes relationships arising from volunteer work
with charities, but again does not apply to nonprofit organizations. The definition includes relationships
with nonprofit organizations related to memberships (Section 13 (c)). Because non-business
relationships apply mostly to charities, for nonprofit organizations without charitable registration, it may
be more prudent to consider if nonprofit noncharitable working relationships are in fact a business or
personal relationships, rather than considering whether a non-business relationships exists.
3. Personal Relationships
For messaging between people in personal relationships there is an exception to anti-spam legislation.
It should be noted that CRTC defines a personal relationship as “two way communications where the
sender is an individual and does not send commercial electronic messages (CEMs) on behalf of a
company and the recipient is an individual. The sender and recipient have had direct, voluntary, two-
way communications in the past.
These communications reveal a
personal relationship. 5 ” A personal
relationship is taken into a specific
context where the individuals have met
and they know the real identity of one
another, rather than knowledge of an
alias or electronic identity. It is also
important to know the frequency of
past personal communication, the
nature of the communication (interests,
experiences, opinions, information).
As soon as a message occurs on behalf of an organization then the personal relationship may move to
be a non-business or business relationship. Care should occur as the context changes around
messages within relationships; messages may be perceived as CEMs as communication changes.
Social media messaging may also be within the scope of CASL. Social voting or page-link liking without
knowledge of a real identity and the context of the relationship is insufficient to be exempt from CASL.
4 http://laws-lois.justice.gc.ca/eng/acts/I-3.3/ 5 http://www.crtc.gc.ca/eng/com500/infograph6.htm
Social media messaging may also be within
the scope of CASL. Social voting or page-link
liking without knowledge of a real identity and
the context of the relationship is insufficient to
be exempt from CASL.
9
4. Family Relationships
Family relationships are defined as, “the relationship between an
individual who sends a message and the individual to whom the
message is sent if those individuals are related to one another through
a marriage, common-law partnership or any legal parent-child
relationship and those individuals have had direct, voluntary, two-way
communication.6” Extended family relationships such as grandparents,
cousins, aunt/uncles, and other extended family are not included in this
definition and are more appropriately defined as a personal
relationship.
It is common for nonprofit organizations to use family and extended
family for volunteer, donor, and other opportunities. It is important in the
case of extended family to consider whether people are within a
personal relationship.
Scenarios could arise where extended family relationships fall under
the scope of CASL, as they are not “family relationships,” and may not
be “personal relationships,” especially if little contact has occurred in
the past with extended family, except concerning a commercial activity.
D. IMPORTANT EXEMPTIONS
1. Membership Exemptions
One exception does apply to nonprofit organizations that are not
charities. This is communication concerning membership of the
organization. Organizations have a two year period in which they may
contact people from the membership expiry, or when the person
requests removal from communication processes, whichever is first.
2. Charity Exceptions
One area of exemption concerns some activity associated with
charities. It is important to note that CASL’s charitable exemptions do
not apply to nonprofit organizations without charitable registration.
According to Industry Canada, the charitable exemptions include
“raising funds” defined as “fundraising” under the Income Tax Act or
defined by CRA.
6 http://fightspam.gc.ca/eic/site/030.nsf/eng/00273.html
ONE NFP
EXCEMPTION
Communications with
members of a non-profit
organization are exempt
from CASL. However, it is
very important to note that
all exemptions for charities
do not apply to non-profit
organizations without
charitable status.
“CASL’s charitable exemptions do not apply to
nonprofit organizations without charitable registration”
10
CRA describes fundraising as “…any activity that includes a solicitation of present or future donations
of cash or gifts in kind, or the sale of goods or services to raise funds, whether explicit or implied.7”
CRA goes further in describing fundraising as:
“Fundraising activities can be carried out by the registered charity (board members, directors,
members, staff, or volunteers), or by anyone acting on its behalf (under a contractual agreement),
and include:
direct activities, such as:
o face to face canvassing, telemarketing, major gift work with individuals, and direct
mail;
o internet or media campaigns (for example, electronic mail, online publications,
websites, television, or radio);
o printed information, advertisements or publications (for example, newspapers, flyers,
brochures, and magazines);
o events (for example, sports tournaments, runs, walks, auctions, dinners, galas,
concerts, and travel or trekking adventures);
o sales of goods or services; or
o donor stewardship, and membership or corporate sponsorship programs; and
indirect or related activities, such as:
o researching and developing fundraising strategies and plans or prospective donors;
o recruiting and training development officers;
o hiring fundraisers; or
o donor recognition programs.”
Because these exceptions do not apply to not-profit organizations without charitable status, messages
concerning the above could be CEMs and noncompliance with CASL risks fines and civil action.
It may be good practice for nonprofit organizations to assume that messaging and communications
about all of the above activities require express or implied consent from the recipient.
7 http://www.cra-arc.gc.ca/chrts-gvng/chrts/plcy/cgd/fndrsng-eng.html?utm_source=charities&utm_medium=eml#N10313
The absence of charitable exceptions for nonprofit organizations without
charitable registration means that board members, employees,
volunteers, and contractors of nonprofit organizations are best to consider
their organization as a business. All business requirements with respect
to CASL apply to nonprofit organizations without charitable registration.
11
E. SENDING MESSAGES
When sending a CEM there
are three critical parts of each
message to address:
1) consent,
2) identification of yourself as
the sender, and
3) an opt-out mechanism.
1. Obtaining Consent
The legislation prohibits organizations from sending messages to people without express or implied
consent. A messenger must have consent before flow of information may proceed.
Express consent. Express consent is written or verbal confirmation that a person agrees to receive
commercial electronic messages. Express consent must be clear and it must be documented with the
onus on the messenger to provide proof of the consent. Express consent is not time limited, so it
remains effective until the recipient withdraws his or her consent.
Electronic forms of consent are acceptable. However, electronic forms must clearly allow the recipient
to opt-into receiving messages. Automated consent is not acceptable (i.e. an affirmatively pre-checked
box stating “yes, I consent” would not be acceptable, but an unchecked box whereby the recipient must
give his or her affirmation is acceptable).
Implied consent. Implied consent occurs in scenarios where there is no express consent, but rather is
assumed through a transaction of business or nonbusiness relationships. Implied consent applies to
five broad areas related to:
1. business relationships whereby the recipient has made, or contacted to enquire about, “…a
purchase or lease of goods, services, land or interest in land, a written contract or the
acceptance of a business, investment or gaming opportunity from you.”
2. nonbusiness relationships concerning donations, gifts, or volunteer work, provided the
organization is a charity, political party or a candidate.
3. charities or noncharitable organizations that are clubs, associations or voluntary organizations
and the recipient a member of this organization.
4. referrals made to an organization through a third person.
5. people who have made their contact information public, such that it is “conspicuously published,
or has caused to be conspicuously published, the electronic address to which the message is
sent (Section 9 (b)).” This is provided that there is no indication that messaging should not be
sent to the person, the message content fits the role/function of the person who will receive the
message, and the collection of the contact information was made manually.
For implied consent there is a period of 2 years after the relationship ends (for example when a service
ends) for which messaging may occur. In the case of subscriptions or memberships, the 2 year period
“There are three critical parts of each message to
address: 1) consent, 2) identification of yourself as the
sender, and 3) an opt-out mechanism”
12
is valid from the date the relationship ends. Of course, if a person withdraws, then consent ends
immediately.
2. Identifying the Sender
The messenger must also provide his or her personal identification and organizational affiliation. This
applies to CEMs sent from anyone in an organization including employees, board members, volunteers,
or other people associated to the organization. A message can be made on behalf of another person,
but both persons collaborating to send the message must be identified.
3. Opt-Out or Unsubscribe Requirement
In every message, an unsubscribe method, opt-out, or withdraw of consent from receiving messaging
must be included. It must be at no cost to the recipient and be in the same method as the opt-in
consent method or be an email address that can receive indications for withdraw of consent.
4. First and Subsequent Messages
It is also important to note that there is provision for one initial message to be sent to seek consent. If
consent is not obtained, then subsequent messages cannot be sent without violating the legislation.
This notion is particularly relevant in cases of referrals. It would not be prudent not be assumed
referrals have given consent. Instead, it might be good practice for initial contacts with referrals to
address consent by requesting express consent.
F. NONPROFIT NONCHARITABLE SCENARIOS
There are a number of scenarios relevant for nonprofit organizations without charitable status whereby
CASL will need to be considered.
1. Growing a Not-Profit Organization without Charitable Registration
For organizations to survive, they must develop and grow their networks to renew their membership,
boards, donors, and supporters. A good and growing contact list helps grow membership, a volunteer
base, donors, and other supporters. Expanding these lists can be difficult under CASL and consent
must be asked for each new contact to be added to a NFP list. Relying on referrals from existing
business and non-business relationship is one way to obtain new contacts. It is good practice to obtain
consent first before placing referrals on any list or send them any CEM.
2. Obtaining Donations without Charitable Receipts
Soliciting donations is exempt from CASL for charitable organizations, but not for organizations without
charitable registration. One way to view donations in this context is to perceive donations,
subscriptions, and other exchanges as purchases. The first contact to make a request should be to
obtain consent. Once consent is received, then solicitation for donations or other exchanges can occur.
After a donation is received, then this establishes a business relationship with the donor. Of course
each subsequent contact must comply with requirements for sending messages.
3. Social Enterprises
In most cases a social enterprise should be viewed as a business. The only exception to this would be
if the social enterprise is itself registered as a charitable organization. As a business, or even a
13
nonprofit organization, the social enterprise should pay close attention to CASL as the exemptions that
charities experience likely do not apply to the social enterprise.
5. Partnerships
Partnerships are very common in the nonprofit community. Some partnerships involve one
organization sending information on behalf of another. Under CASL this type of 3rd party messaging
must be made very clear to recipients. The sender, originating messenger, and organizations involved
must be made clear in the message.
Another issue is accepting referrals from partners. It cannot be assumed that referrals have given
prior consent for a CEM. It would be important in this scenario for the first contact with referrals to be
seeking consent for subsequent contact.
A third partnership issue concerns bartering; electronic transactions about bartering services are a
commercial activity and messaging surrounding new bartering could be perceived as a CEM.
6. Events
Events offered by nonprofit organizations without charitable registration are a business or commercial
activity. Event advertising and requesting people’s attendance would be subject to the legislation.
7. Free Expression, Dissent, and Advocacy
Advocacy from nonprofit organizations without charitable registration may be considered a CEM and
subject to CASL legislation. Sending messages freely to the public could be perceived as SPAM.
8. Messages using cc and bcc
In the past it might have been efficient to inform people about a service by simply including them in a
cc or bcc line of an email. CASL changes how this should be perceived. Including people unrelated or
only tangentially related to a service message may be perceived as sending a CEM without the
consent of the recipient. These types of messages may be subject to CASL legislation.
9. Old Existing Lists
One issue Nonprofit organizations face is to determine whether or not existing people on organizational
lists require new express consent under CASL. If each person on the list has past express or implied
consent (even before the legislation took effect) to be on lists, then no new consent is required.
Unfortunately, it still must be documented how each person on every list gave express or implies
consent. After examination, if consent confirmations cannot be produced, then it must be rectified.
There is a 3 year period after July 1, 2014 to ensure all persons on lists have given their consent lists.
10. Grey Areas
Organizations cannot always predict how CASL may apply to when new services, activities, and
scenarios. When grey areas arise, the Government of Canada anti-spam site clearly suggests that it is
best to comply with CASL than potentially risk the consequences.8
8 http://fightspam.gc.ca/eic/site/030.nsf/eng/home
14
THE STRATEGIC INTELLIGENCE ALLIANCE, INC.
2018 27th Street S.W., Calgary, Alberta T3E 2E7
Phone: 403-389-8941 • [email protected]
www. strategicintelligencealliance.com
H. ADDRESSING CASL IN YOUR ORGANIZATION
Many NFP organizations have employee and volunteer privacy training programs. The risk involved
with relying on existing privacy training programs is that they may not adequately address CASL
legislation. Targeted training regarding CASL and messaging is sound practice and is a start. More
should ideally be done to address CASL. Having employees and volunteers send messages freely to
the public without training or policies and protocols in place is potentially risky.
CASL should minimally be addressed by reviewing a number of key organizational policies and
procedures. Although not an exhaustive list, a review of the concepts below can help to mitigate much
of the risk associated with CASL.
Anti-spam and privacy policy development,
Electronic messaging inventory,
Information technology assessment,
Express and implied consent documentation,
Electronic messaging protocols, including email protocols,
Fund development protocols,
Service announcement and marketing protocols,
Consent methodologies,
Unsubscribe methodologies,
Risk management and mitigation protocols,
Existing board, employee and volunteer training, and
New board, employee and volunteer training.
For information about addressing CASL for any of the above issues or for training, contact: