Requirements for Anti-Spam Compliance for Insurers

Insurance Law

06/19/2017       By Laurie LaPalme, Bernice Karn

On June 7, 2017, the Minister of Innovation, Science and Economic Development announced that the private right of action under Canada’s Anti-Spam Legislation (CASL) that was due to come into effect on July 1st has been suspended. This was welcome news for many industries. The private right of action presented a new risk of significant statutory damages and potential class action lawsuits for minor and technical breaches of CASL.

While this move has provided some relief, it does not affect the end of the three-year transitional period for CASL set to expire on July 1, 2017. During the transitional period, commercial electronic messages (e.g., e-mails to brokers, insureds, etc.) could be sent if you had an existing business or non-business relationship that predated CASL’s enactment on July 1, 2014. In other words, if your company had established a business or non-business relationship at any time before July 1, 2014, with the recipient, your company could rely on this relationship in order to send commercial electronic messages until July 1, 2017.

After July 1st, this will no longer be the case. Generally, you will have to be able to demonstrate either:

  1. express, fully informed, opt-in consent from the recipient in order to send commercial electronic messages;
  2. that you had implied consent, by way of an existing business or non-business relationship in accordance with certain time periods specified in CASL (explained further below); or
  3. that another specific exemption applies.

Does CASL restrict electronic communications with brokerages?

Generally, ordinary course business-to-business communications are not meant to be captured by CASL. As such, commercial electronic messages with brokerages are not subject to the consent requirements under CASL, as long as all of the following three conditions are met:

  1. your company and the brokerage are both "organizations" (which they most likely are);
  2. your company and the brokerage have a "relationship" (meaning that this only applies where there has been some kind of pre-CASL interaction); and
  3. the message is relevant to the brokerage's business.

If all three conditions are satisfied, then the communication is not subject to CASL.

Does CASL restrict electronic communications with insureds?

If the insured is an “organization,” then the same exemption above would apply, as long as the other two conditions are also met. However, after July 1st, if the insured is an individual, then you would most likely have to rely on the "existing business relationship" form of implied consent. As mentioned above, this form of implied consent is time limited. The consent will last during the term of the contract of insurance and then for two years afterwards. Accordingly, you will no longer be able to rely on implied consent from existing business relationships from more than two years ago.

What other requirements does CASL impose on electronic communications?

Every commercial electronic message that is subject to CASL must contain certain disclosures and an unsubscribe mechanism. These are not required for exempt business-to-business messages described above.

The required disclosures are:

  1. the name of your company;
  2. the mailing/street address of your company; and
  3. either your company’s telephone number, e-mail address or web address.

The three disclosures listed above must also be provided for any third party on whose behalf the message is sent. For example, if a commercial electronic message is sent by your company on behalf of a third party administrator (TPA), you must provide the disclosures for both your company and the TPA.

Commercial electronic messages subject to CASL must also include an unsubscribe mechanism in the body of the message that allows the recipient to click on it and be “readily performed.” In other words, the recipient must be able to unsubscribe in two clicks or less. You cannot simply refer the recipient to a website. The unsubscribe link must also remain active for at least 60 days after the message is sent. If a recipient chooses to unsubscribe, you must remove them for your company’s e-mail list within 10 business days from the date the request is received.

What needs to be done before July 1, 2017?

After July 1, 2017, you will no longer be able to rely on implied consent from existing business relationships from before CASL was enacted on July 1, 2014. If your company has been relying on that exemption during the transition period, you will need to review your consents to send commercial electronic messages to each of your company’s existing contacts.

Except for communications with brokerages or other organizations as described above, you must ensure that you have either obtained express, fully informed, opt-in consent from the recipient, or that you have implied consent by way of an existing business relationship from no more than two years ago.

If you have any questions, or require more information regarding other potentially applicable exemptions, please do not hesitate to contact any member of the Cassels Brock Insurance - Corporate and Regulatory Group.