FCA confirms CASL is constitutional, but limits business communications exemption

In a recent decision, the Federal Court of Appeal dismissed CompuFinder’s appeals against two Canadian Radio-television and Telecommunications Commission decisions arising from one of the first enforcement actions under Canada’s Anti-Spam Legislation (CASL)¹. In addition to finding that CASL’s Commercial Electronic Message (CEM) provisions are constitutional, the FCA provided further clarity on the “business-to-business” exemption, conspicuous publication exemption, and unsubscribe mechanism requirements.

What you need to know

• “Business-to-business” exemption:
  • Sender organizations must be able to establish that they had a relationship with the recipient organization, not just some employees.
  • Evidence of transactions with employees who can bind the recipient organization, while not required per se, can assist in meeting the evidentiary threshold for establishing a relationship between the two organizations.
  • CEMs need not be linked to the recipients’ core business operations in order to meet the exemption’s “relevance” requirement. Relevance can be established by showing the two organizations had a prior commercial relationship, or were planning transaction activity in the future.
• An organization that relies on conspicuous publication of contact information as a basis for implied consent must be able to connect the business role or duties of recipients to the content of the message and explain the relevance of the message to those duties.
• Having more than one unsubscribe link creates confusion and frustration among recipients—frustrating CASL’s unsubscribe mechanism requirements.
• CASL’s CEM scheme was a valid exercise of the Federal government’s power over general trade and commerce.

Background

In 2015, the CRTC, following an investigation, issued a Notice of Violation (NOV) against CompuFinder for three email marketing campaigns it used to promote its educational and training services to various recipients. The NOV alleged that CompuFinder sent 317 CEMs to recipients without their prior consent², and 87 of them contained two unsubscribe mechanisms, one of which was non-functioning. The NOV imposed a $1.1M penalty on CompuFinder. CompuFinder challenged the constitutionality of CASL and the amount of the imposed penalty before the CRTC. In its two decisions³, the CRTC determined that CASL is constitutional and confirmed CompuFinder’s violations of CASL. However, the CRTC reduced the penalty to $200,000. CompuFinder appealed the CRTC’s decisions to the FCA.

Decision

CASL is constitutional

The Court concluded that CASL is intra vires Parliament’s general trade and commerce power. The Court rejected the possibility of a provincial CASL framework. The Court found that the failure of one or more provinces to enact similar legislation would jeopardize the anti-spam scheme, since spammers could easily arrange to disseminate their CEMs from servers located in the excluded provinces⁴.

Similarly, the Court rejected CompuFinder’s Charter challenges to CASL. While CASL violates section 2(b) of the Charter by restricting the dissemination of CEMs, the Court found that the legislation could be justified under section 1 because the prevention of harm to Canada’s e-economy outweighs the effects of CASL on freedom of commercial expression⁵. The Court rejected the challenge to the CEM scheme or the penalty in this case on the basis of sections 7, 8, and 11 of the Charter. Sections 7 and 11 of the Charter were not triggered because the proceedings and the fine were not truly “penal”. While section 8 of the Charter was applicable to CASL’s compelled production provisions, the Court found that the provisions do not facilitate unreasonable seizures because business documents produced in a regulatory context attract a diminished expectation of privacy⁶.

Business-to-business exemption

The Court found that the evidentiary burden of establishing a “relationship” under the business-to-business exemption is more demanding than the requirement to establish an “existing business relationship” for the purposes of establishing implied consent given the differing consequences of such findings. The existence of a prior contractual relationship with an employee from each recipient organization may be sufficient to establish an “existing business relationship”. This would permit the organization to send CEMs to individuals who had paid for the service or good within the preceding two years. However, using a limited number of transactions with a few employees as a basis to establish a “relationship” for the purposes of the “business-to-business” exemption would allow the sending organization to send CEMs to not just the few employees they transacted with but to every other employee of the organization. Since the latter finding would expose many more people to potentially harmful conduct, the Court found that the evidentiary requirements to establish a “relationship” should be more demanding than those for an “existing business relationship”⁷.

Conspicuous publication exemption

The Court also found that the CRTC did not err in determining that CompuFinder could not rely on the conspicuous publication exemption. The Court agreed with the CRTC’s findings that CompuFinder’s supporting table—which contained among other things an email address and a link to where the address can be found—failed to show how the recipients had conspicuously published their email addresses. For instance, some email addresses were taken from third-party directory websites that did not indicate whether the website content was user-submitted⁸. The Court also ruled that, in most situations, simply listing a recipient’s job title is not sufficient to establish that the CEM relates to the recipient’s function or duties.

Unsubscribe requirements

The Court agreed that having two links—one functional but one faulty—violated CASL’s requirements that unsubscribe mechanisms be set out clearly and prominently, and that the mechanisms be able to be readily performed. The Court added that even if one unsubscribe mechanism is still functioning, the fact that recipients are confronted with two alternatives can cause delay and compromise the ease with which the mechanism is accessible⁹. This underscores the need to ensure the unsubscribe mechanism is fully functional.

Business implication

The decision has important implications for organizations and their CASL compliance programs:

• The decision reinforces the view that regulators and the courts expect organizations to keep detailed records to demonstrate their compliance with CASL.
  • Organizations seeking to rely on a CASL exemption should be prepared to explicitly explain how they meet the exemption’s requirement. For instance, organizations seeking to rely on CASL’s conspicuous publication basis for implied consent must be able to show how the recipients themselves had published their email addresses—this may not be possible when using third-party directories or business listings.
• Organizations should include a single, fully functional unsubscribe link in CEMs and no more. Where an organization wants to also provide individuals with the option to control what emails they receive (and how frequently), it should consider a link to a landing page where recipients can choose to unsubscribe from all emails or to tailor the emails they want to receive.

_________________________

¹ 3510395 Canada Inc. v Attorney General of Canada et al., 2020 FCA 103.

² The CRTC determined that “business-to-business” exemptions did not apply to the CEMs and that none of the recipients had conspicuously published their electronic addresses within the meaning of paragraph 10(9)(b) of CASL.

³ In response to CompuFinder’s challenge, CRTC bifurcated its decision, addressing CASL’s constitutionality and CompuFinder’s CASL violations separately.

⁴ Decision, para.126.

⁵ Decision, paras. 200-202.

⁶ Decision, para. 232.

⁷ Decision, para. 238.

⁸ Other email addresses had been taken from websites containing disclaimers against sending unsolicited CEMs to the addresses found on those websites. This contravened the requirement under the conspicuous publication exemption that publications must not be accompanied by statements that recipients do not wish to receive CEMs; Decision, para. 245.

⁹ Decision, para. 259.

To discuss these issues, please contact the author(s).

This publication is a general discussion of certain legal and related developments and should not be relied upon as legal advice. If you require legal advice, we would be pleased to discuss the issues in this publication with you, in the context of your particular circumstances.

For permission to republish this or any other publication, contact Janelle Weed.

© 2024 by Torys LLP.

All rights reserved.