CASL Compliance – 10 Key Steps for School Boards

CASL Compliance – 10 Key Steps for School Boards

Canada’s Anti-Spam Law (CASL) certainly affects the manner in which school boards, schools, school councils and foundations communicate electronically with parents, students, volunteers, service providers and other stakeholders. Where one more of the purposes of a message is to encourage participation in commercial activity, whether or not there is any expectation of profit, the message must meet the consent, form and content requirements of CASL.

Consequences of Non-Compliance

Penalties for non-compliance are significant and the CRTC has been actively flexing its muscles by demanding that organizations pay attention to CASL’s onerous rules. CLICK HERE for the latest CASL fine. CASL certainly exposes directors, officers and agents to potential liability if they are found to have directed, authorized, assented to, acquiesced in or participated in the commission of a violation.

Come July 2017, individuals and corporations affected by a contravention of CASL will have a private right of action and be able to commence a lawsuit against anyone alleged to have contravened CASL is thus critical for school boards to take a good hard look at their electronic communications and take the steps necessary for CASL compliance.

Commercial Electronic Messages (CEMs) sent by School Boards

CEMs are essentially messages that promote participation in commercial activities. Keep in mind that the definition of “commercial activity” in CASL broadly refers to any transaction that is of a commercial character, regardless of whether or not there is an expectation of profit. Examples of commercial activities that might arise in a school setting and result in the sending of CEMs might include:

  • Online school newsletters and publications containing offers to purchase goods, products and services, such as apparel, yearbooks, school photos, pizza lunches, magazine subscriptions and advertisements for school activities, events and programs for which there is a fee;
  • Travel opportunities offered by third party providers;
  • Recruiting volunteers for school programs where there is a cost-recovery fee to participate;
  • Fundraising activities;
  • Offers to purchase or sell land; and
  • Invitations to respond to RFPs.

Implied Consent

There are numerous provisions under CASL and its regulations setting out the conditions that must be met in order for the sender of a message to rely on implied consent when sending CEMs. However, due to the uncertainty inherent in making a determination as to whether implied consent exists in a given situation and the difficulty in managing email contact lists and monitoring the limitation periods associated with implied consent, express consent should be the preferred option for school boards in order to ensure compliance with CASL.

Consent to send CEMs is implied where:

  • There is an existing business or non-business relationship that includes the use of CEMs ; or
  • The recipient has conspicuously published or disclosed to the sender an electronic address, the recipient has not indicated that they do not wish to receive unsolicited CEMs, and the CEM is relevant to the recipient’s role, functions or duties in an business or official capacity.

Relationships that school boards have with existing vendors, suppliers and other businesses may be captured as “existing business relationships” as defined in section 10 of CASL. However, it is less clear whether relationships that boards and schools have with parents of enrolled students would fall under the definition of existing business or non-business relationships. While most parents are likely to have paid some kind of school fees or purchased school-related items, in relation to things such as field trips, yearbooks, lunch supervision, etc., it is unclear whether this would provide the basis for an existing business relationship between that parent and the board.

Boards will need to make a determination on a case-by-case basis as to whether they believe they have an existing business or non-business relationship with parents, before relying on the implied consent provisions of CASL. Therefore, the safest course of action would be to obtain express consent from parents (and students, if applicable) to whom CEMs are sent.

It is also important to note that even where implied consent exists, it can be revoked at any time.

Implied Consent during the 3 Year Transition Period

CASL includes a transition period provision indicating that for 36 months after CASL came into force on July 1, 2014, consent to send CEMs is implied where there is an existing business or non-business relationship, regardless of how far back that relationship went.

Therefore, an existing business or non-business relationship in existence before July 1, 2014 can only be relied upon to demonstrate consent until July 1, 2017. Prior to expiry of the transition period, school boards will be required to obtain express consent to send CEMs in order to continue sending CEMs after that date (unless the implied consent is still valid under the 2-year rule in section 10).

Express Consent

When seeking express consent, it is best to seek consent in writing. The onus for proving that consent has been given is on the person or organization sending the message, therefore written consent is the clearest evidence that consent has been given. Further, sending confirmation of receipt of express consent after it has been provided may provide additional evidence of express consent.

Unlike implied consent, there are no time limits that apply to the validity of express consent. Express consent does not expire unless and until the recipient withdraws their consent.

The request for express consent to send a CEM must “clearly and simply” set out the following information:

  • the purpose(s) for which the consent is being sought;
  • prescribed information identifying who is requesting the consent, along with their contact information; and
  • a statement indicating the person whose consent is sought can withdraw their consent.

It is important to note that, under the legislation, an electronic message that contains a request for consent to send a CEM is also a CEM. This means that after July 1, 2014, an email could not be sent out in order to obtain express consent from parents and others to send further CEMs (unless there is already implied consent to send CEMs). Note that the request must not however use a pre-checked box that assumes consent and that would require the recipient to opt-out.

What is an “Unsubscribe Mechanism”?

In order to send a CEM in compliance with the legislation, the CEM must also include a mechanism for revoking consent or unsubscribing as prescribed by CASL. Examples include a hyperlink that can be clicked on it to unsubscribe to future CEMs.

School boards should have by now reviewed their technology systems and capabilities to determine how to incorporate an easy to use unsubscribe mechanism into their practices and how they can quickly respond to requests to unsubscribe to CEMs. A request to unsubscribe must be honoured within 10 days.

10 Key CASL Compliance Steps for School Boards

There are a number of steps that school boards can take in order to develop and implement strategies and processes for CASL compliance if they haven’t already, such as:

  1. Identify areas where electronic communication is being used.
  2. Determine whether those electronic communications involve any commercial activity.
  3. Identify CEMs.
  4. Check existing consent mechanisms in relation to current CEMs to determine if requirements for express or implied consent have been satisfied.
  5. Determine if any CASL exception provisions apply to identified CEMs.
  6. Implement systems for managing timelines – ensure that implied consents are upgraded to express consents within the applicable time limits.
  7. If you identify recipients to whom you wish to send CEMs and do not have implied consent to do so (or are unsure) obtain express consent in accordance with CASL requirements.
  8. When sending CEM’s: i. Ensure you have consent;  ii. Provide identification information; iii. Provide a CASL compliant unsubscribe mechanism.
  9. Develop, implement and monitor a CASL compliance program that includes training for employees, contractors and representatives on CASL’s requirements and how to prevent sending unauthorized CEMs. This will be an important factor in demonstrating due diligence and minimizing potential penalties should a school board ever be faced with an allegation that it has acted in violation of CASL. There is a due diligence defence in CASL and practically speaking, the CRTC has certainly taken into account the seriousness with which an organization responds to a breach when determining a monetary penalty.
  10. Policies and procedures regarding CASL compliance that address matters such as the following will need to be implemented:
    a.  Appointing a senior staff member to be in charge of CASL compliance issues.
    b.  Managing contact lists to track consent of the recipients (including expiry dates applicable to implied consents) and to give effect to unsubscribe requests.
    c.  Requesting express consent to receive CEM’s should become standard practice.
    d.  Reviewing and updating current electronic communication practices and technology, network and software capabilities to ensure that all forms of electronic communications satisfy CASL’s requirements.
    e.  If any third party providers are used in connection with the sending of CEMs, updating and revising agreements to ensure compliance with CASL and include corresponding notification and indemnification provisions.
    f.  Monitoring mechanisms to safeguard against inadvertent non-compliance with CASL.

For assistance with CASL compliance, contact PrivaTech, learn more about our CASL e-learning course, or take a look at our CASL Compliance Toolkit.