The purpose of the Canadian Anti-Spam Legislation (CASL) is to more carefully control the use of spam (ie. unwanted Commercial Electronic Messages or CEMs) in electronic messaging. CASL came into effect on July 1, 2014. CASL applies to the majority of organizations in Canada, including McMaster University. All faculty and staff are expected to comply with CASL.

Guidance in complying with CASL is provided in the McMaster CASL Tool-kit and is also available from the contacts listed below.

The penalties for failing to comply with CASL are significant: up to $10 million for an organization and up to $1 million for an individual.

Commercial Electronic Messages “CEM”

Basic Rule

The principal CASL rule is that, subject to certain exemptions, a CEM cannot be sent to an electronic address unless:

1. the sender has obtained consent from the recipient of the message; and

2. the message contains the sender’s contact information and an unsubscribe mechanism.

What is a CEM?

To fit the definition of a CEM, and be subject to CASL, a message must:

• be in the form of an email, text message or instant message
• be sent from a computer system in Canada or accessed by a computer system in Canada
• relate to a transaction, act or conduct that has a commercial character such as:
  • purchasing, selling, bartering or leasing products, goods, services or land;
  • providing a business, investment or gaming opportunity; or
  • advertising or promoting any of these activities.
• not relate to any University charitable fundraising activities
• not relate to McMaster’s “core activities” which are, in general, the academic, research and related administrative activities which are central to McMaster’s operations as a University (a full definition of McMaster’s “core activities” can be found in the sections of The McMaster University Act, 1976 which outline the various powers of the Board of Governors and Senate).

Messages that mix a commercial purpose with a non-commercial purpose are also considered to be CEMs.

Exemptions

CASL does not apply to the following:

• messages between McMaster employees relating to core activities
• responses to a request, inquiry, complaint or application
• communications relating to a legal obligation or to enforce a legal right
• organization to organization communications related to their core activities

The following communications do not require consent but should include the name, contact and unsubscribe information noted under “Content Requirements”

• messages which facilitate, complete or confirm a commercial transaction
• warranty or product safety communications
• messages providing information about ongoing:
  • purchases
  • loans
  • subscriptions
  • memberships (e.g. McMaster Alumni Association)
  • accounts
  • employment relations
  • employee benefit plans
  • product updates

How to Comply with CASL

Content Requirements

CASL requires that all CEMs contain the following information:

1. The name of the McMaster unit sending the message;
2. The mailing address, telephone number, email or web address for the McMaster unit sending the message; and
3. Information about how to unsubscribe from future CEMs.

The unsubscribe mechanism should be present at the bottom of all CEMs using language such as:

“You may unsubscribe from the McMaster University [insert name of list] distribution list at any time by emailing [insert email address] or calling 905 525 9140 [insert extension].”

If a request to unsubscribe is received, the recipient must be removed from the distribution list within 10 business days of the request.

The following statement should be also be included in CEMs sent to internal recipients:

“You are receiving this message because you are a member of a subject specific internal email list generated by McMaster University and/or you are in a pre-existing business relationship with McMaster University. In either case, if you believe that you should not be a recipient, you may withdraw your consent to receive these messages at any time, in accordance with Canadian Anti-Spam Legislation (CASL) and subject to McMaster University policy, by contacting the sender of this message.

Please be aware that messages to McMaster University employees and students, sent for the purpose of conducting regular non-commercial University business, are not governed by CASL.”

Consent Requirements

Prior to sending a CEM, a sender must have received the consent of the recipient. Consent may be express or implied.

Express Consent

Express consent occurs where the recipient has provided oral or written consent to receive electronic messages and remains in effect until the recipient unsubscribes from future messages.

Implied Consent

Implied consent occurs where the recipient has:

• An existing business relationship with McMaster in the preceding two years;
• An existing non-business relationship (ie donors, alumni, volunteers) with McMaster in the preceding 2 years; or
• Conspicuously published their business contact information AND the recipient has not indicated a wish not to receive unsolicited CEMs; and your message is relevant to the recipient’s business, role, functions or duties in a business or official capacity.

Tracking Consent & Un-subscriptions

Compliance with CASL includes implementing systems to track recipient consents and giving effect to requests to unsubscribe. Tracking systems can be as simple as a spreadsheet or as complex as an integrated database. Regardless of the system, the sender must be able to document addresses which have provided express consent and those which have unsubscribed.

Where a sender is relying on implied consent to send CEMs, the tracking system must be able to track the “expiry” dates of the implied consent categories. Implied consent normally lasts for two years so, to take advantage, McMaster entities planning on relying on implied consent to send CEMs should seek express consent as soon as possible.

How to Obtain Express Consent

Electronic messages requesting express consent under CASL are also considered to be CEMs. Unless the proposed CEM fits into one of the exemptions discussed above, the CEM should not be sent or the information should be delivered in an alternate format (such as by direct mail or a telephone campaign). However, requests for express consent can be sent where the recipient has provided their implied consent (as outlined above). Through this process, implied consent is “converted” into express consent.

Requests for express consent must contain the following information:

1. The specific purpose for which express consent is requested;
2. The name of the McMaster unit seeking consent;
3. The mailing address and telephone number, email address or web address for the McMaster unit seeking consent (or a link to a website containing this information); and
4. A statement indicating that consent can be withdrawn at any time.

If you are collecting personal information (such as an individual’s name, address and telephone number), the request for consent must also include a privacy statement containing the following information:

1. The reason that the information is being collected;
2. The legal authority for collecting the information;
3. The contact number for a McMaster employee.

A sample privacy statement is provided below:

“Personal information is collected by McMaster under the authority of The McMaster University Act, 1976. Any personal information you provide to McMaster University (“McMaster”) is collected, used, maintained and disclosed pursuant to Ontario’s Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c.F.31 (“FIPPA”).  McMaster uses the information to deliver information materials and for statistical purposes. The information will remain confidential and used or disclosed only in accordance with FIPPA. Any questions should be directed to [department contact] at 905 525 9140 ext [#####] or [name]@mcmaster.ca.”

CASL Tool-Kit

• Guide to CASL 
• Application of CASL to McMaster University Activities 
• CASL Flowchart 

Who to Contact

If you have any questions regarding the application of CASL to your activities at McMaster please get in touch with one of the contacts below:

Brent Davis Corporate Counsel Email: Brent Davis Gilmour Hall, Room 304 Phone: 905.525.9140 ext 24977

Andrea Thyret-Kidd University Secretary & FIPPA Officer Email: Privacy Gilmour Hall, Rm 210 Phone: 905.525.9140 ext 23080