New Canadian Anti-Spam Law Could Affect Pharma Marketing
Recently, Canadian law regarding commercial electronic messages (CEM) changed significantly, impacting worldwide business communication with the new Canadian Anti-Spam Legislation (CASL), called “the toughest anti-spam law in the world.”
Canada had been one of the few countries without anti-spam legislation, so CASL was designed to shore up this gap and combat unwanted messages. Companies that send messages to or from Canadian addresses that do not comply with CASL can incur fines up to $10 MM CAN.
This document explains the premise of CASL and its impact on email marketing and other communications and activities, and it provides recommendations for pharmaceutical marketers on determining how the new law affects them and how to be compliant with it.
“Companies that send any messages to or from Canadian email or physical locations must comply with CASL.”
WHO IS AFFECTED?
CASL applies to any “commercial electronic message” (CEM) in which the individual himself or the computer system used to either send or access the message is located in Canada. This includes cases in which:
- Your business is based in Canada
- Your ISP, CRM partner or agency that sends your emails is based in Canada
- Your recipients live in Canada
WHAT TYPES OF MESSAGES ARE AFFECTED?
There is a three-year transition period for compliance, ending June 30, 2017. Until then, businesses may continue to contact Canadian addresses, assuming they can prove that there had been contact prior to July 1, 2014. After the transition period, contact must cease with anyone whose express or implied consent has not been obtained.
CEMs include not only emails, but also texts, instant messages and apps. CEMs are commercial in nature, meaning they promote products, services, people, companies or organizations.
CASL requires that “affirmative consent” must be given by the individual to the company in order to send them communication. This means the subscriber must take an action to confirm a wish to be contacted. Affirmative consent may be either express or implied.
Implied consent means the subscriber has an existing business or non-business relationship with the organization. If the individual has reached out in the last six months or purchased a good or service in the last two years, consent is implied. Under CASL, implied consent expires after two years, during which the company may seek express consent.
Express consent is gained when the subscriber has stated, by means of a CASL-compliant form, that they wish to receive marketing messages from the organization. This consent never expires unless the individual revokes it. An example may be that a consumer filled out a form on your website asking about your payment-assistance program. The form contained all required information to gain consent to contact; therefore, you have acquired express consent. You may send CEMs to this consumer until they unsubscribe.
Do not rely on implied consent. Implied consent expires, and the expiration depends on the type of action the consumer took at the time consent was implied. Express consent is easier to record and only expires when consent is revoked.
Express consent must be obtained via a CASL-compliant opt-in form, which must include:
- A clear explanation of the purpose in obtaining consent
- A description of the communications that will be sent
- The requestor’s name and contact information (e.g., mailing address, telephone number, email address or website URL)
- An unsubscribe statement, indicating the recipient may unsubscribe at any time
Consent must be obtained through an opt-in mechanism (an unchecked box), not opt-out (a pre-checked box).
The onus to prove consent is always on the sender. CASL suggests keeping a record of:
- When consent was obtained
- Why it was obtained
- The manner in which it was obtained
- Whether it was obtained in writing or orally
MESSAGE (CEM) CONTENT REQUIREMENTS
CASL also requires that certain elements must be included in the body of any CEM, including:
All involved parties must be identified, including if the CEM is sent on behalf of a third party, unless any party had no part in determining the target list.
“Many of the CASL requirements are similar to what is required by the U.S. CAN-SPAM act.”
CEMs must provide an easy, free way to unsubscribe using a link to a website. The link must be valid for at least 60 days. All unsubscribe requests must be honored within 10 days.
CEMs must provide contact information. An unmonitored “do not reply” email address is insufficient, although a physical mailing address can be used. The preferable solution is to use a functional, monitored email address.
HOW DOES THIS AFFECT MY BRAND?
Though many email services providers (ESPs) offer the tools needed to run a CASL-compliant marketing program, it is the responsibility of the sender to ensure compliance with CASL. Because many CASL requirements are similar to regulations of the U.S. government and industry best practices, many programs may already comply.
Social Media Implications
While the main intent of the CASL legislation is to address and reduce unwanted emails, it is currently unclear whether implications for social media exist. Social media implications of CASL are not the main focus of the legislation, so we consider its effects lower risk for those programs.
The pharmaceutical industry’s conservative bent in this arena already serves it well, and as long as marketers follow best practices, Intouch does not recommend social media program changes at this time.
Below are overall recommendations to help ensure that CASL compliance is easy to achieve and maintain. We recommend that each client works closely with its legal team to review all CEM programs to confirm CASL compliance. We have provided a decision tree on the last page of this report to assist in this effort.
Are you marketing to Canadian residents? Are you planning to? Are you based in Canada? Is your email service provider, CRM partner or agency that sends your emails based in Canada? If not, then no further action is required. If yes, then:
1. First, scan your database for subscribers who may fall under the legislation — i.e., those with a Canadian email address (.ca; ab.ca) or mailing or billing address. If you can’t confidently prove a record of consent, including the type of consent and when and how it was obtained, we recommend removing these subscribers from your database. Without at least implied consent, these subscribers may not be contacted, even during the three-year grace period.
2. Next, check that all subscription forms are compliant. To collect the consent of Canadian consumers or professionals, be sure all subscription forms include required information (i.e., explanation of purpose, description of communications, name and contact information of the requestor, and an unsubscribe statement), and that no consent boxes are pre-checked. In addition, consider adding a disclaimer where appropriate stating that certain forms are intended to be completed by United States residents only.
3. Finally, make sure your CEMs are compliant. If you’re mostly marketing to U.S. residents, you may already be in compliance because CASL regulations for CEMs are similar to the U.S. CAN-SPAM laws. CEMs must include identification information, a free unsubscribe mechanism and your contact information.
Whether you are significantly affected or largely in compliance already, it’s important to be abreast of emerging email regulations. Use these recommendations to help ensure compliance with CASL and for email best practices in general.
1. Document your compliance effort. Keeping accurate records of consent will help ensure your database is in compliance. For Canadian residents, if you are relying on implied consent, audit every six months for implied consent by inquiry and every two years for implied consent due to business relationship. If you haven’t converted those subscribers to express consent, you’ll need to re-obtain implied consent, gain express consent or cease contact when that time expires.
2. Make sure CEMs and subscription forms are built in a compliant format. If the same CEM must reach U.S. residents, as well as be sent from, or received by, a mail server in Canada, it must follow both CAN-SPAM and CASL.
3. Where appropriate, consider adding a disclaimer to sign-up pages. This will indicate when the content and consent to contact is intended for U.S. residents only.
Intouch Solutions works diligently with clients to ensure compliance and implement recom-mendations and best practices. To better understand the situation-specific implications of CASL for your programs, or if you have a concern that you may not be in compliance, contact your Intouch representative where additional audit and recommendation services are available.
CASL Compliance Check Decision Tree
- Canada’s Law on Spam and Other Electronic Threats (website for consumers and businesses)
- The Canadian Radio-Television and Communications Commission
- Full Text of the Canadian Anti-Spam Legislation