Canada's Anti-Spam Regulation is going into effect July 1, 2014

[Anonymous]

Does Marketo plan to  implement  any technical strategies to ensure compliance with Canada's FISA (anti-spam) regulation that goes into effect on July 1, 2014? What are they? 

We are concerned that companies based in the US may have offices in Canada and thus it may be difficult to screen out the Canadian emails comprehensively. 

http://www.ic.gc.ca/eic/site/030.nsf/eng/h_00211.html

Do people have good ideas to ensure compliance?  

[Anonymous]

What exactly is your concern with the law. From a quick scan nothing in there seems to conflict with what you should already be doing in the U.S. with regard to your opt-in lists. 

[Anonymous]

Article: http://www.responsys.com/blogs/nsm/email-marketing/canadian-anti-spam-legislation-casl-returns/

Some of the important provisions you should investigate for yourself:

• Permission – CASL has an explicit permission provision.  This means that implied consent is not acceptable for gathering permission. There are multiple exceptions to the rule, including existing business relationships. Purchases qualify for this exception and the 24 month clock resets with every purchase.
• Implied consent – There are multiple ways where a sender can obtain consent outside the required express consent. Personal or family relationships, inquiries, and several others.
• The law applies to email that is accessed on computers in Canada.
• Very different from CAN-SPAM in that this is not an opt-out, but an opt-in law. Allowing people the opportunity to opt-out does not satisfy the requirements. A pre-checked box is an implied consent method that won’t be allowed.  Auto opting-in abandoned shopping carts and e-receipts for promotional mail will also be outlawed.
• Private right of action – One of the most talked about pieces, this allowed individuals to bring suit. This will not take effect until July 1, 2017.
• 3 year transition period – Senders have a 3 year grace period to gain consent of individuals.  Implied consent is sufficient during this period, but express consent must be gained to go forward after that period.
• You should update your privacy policy, make sure you are recording consent for proof, and always have a working unsubscribe mechanism.

[Anonymous]

This is a previous post from a Marketo employee. We will be adopting a strict policy to adhere to the law and want to know what (if anything) Marketo is doing to facilitiate adherence to Canada's new low. 

EMPLOYEE

I work on the Privacy Team here at Marketo and recently wrote an internal article on the upcoming Canadian legislation.  I can share this article:

CASL, Canada's first foray into anti-spam legislation, is much broader than just email spam and regulates spamming, hacking, malware, online fraud, address harvesting, privacy invasions specifically.  These regulations are now expected to come into force late in 2013 or early 2014 and we’ll be working closely with Marketo’s Legal team to ensure we’re thinking ahead on their impact to our business.

There are three primary rules related to email within CASL: Consent, Sender Identification and Unsubscribe functionality.  Sender Identification rules and Unsubscribe functionality appear to be similar to the US's anti-spam legislation CAN SPAM requirements. One notable difference with CAN SPAM is that CASL will be a permission-based regime with senders required to have consent from all Canadian-based recipients before sending marketing email, the CAN SPAM laws do not have these permission requirements. It appears that this will also regulate against pre-checked opt-in boxes on forms and may require an opt-in subscription confirmation message to be sent.

There will be exemptions in the case of business to business messages (within and between firms) in the context of an ongoing business relationship, messages sent in response to a request, messages sent to enforce a legal right, messages sent by a foreign business to a foreign recipient accessed while roaming in Canada and messages sent to conspicuously published email addresses.

Marketo's Privacy Team will offer a webinar and will publish recommendations relating to the final regulations once they are fully defined. Definition is still being finalized by Industry Canada, one of the three regulatory agencies in charge of enforcement.   We expect the regulations to be defined early to mid 2013.

Posted By Kiersti Esparza on 11/27/2012 3:25 PM

[Caryl_Mostacho]

Hi Kiersti,

"Marketo's Privacy Team will offer a webinar and will publish recommendations relating to the final regulations once they are fully defined"

Do you have have an idea of when you'll be doing this webinar you mention in your post? 

[Anonymous]

We are a Canadian HQ company so we are working vigorously to comply with this new law before July 1st. Here's another blog post that's quite useful and very recent: http://info.bluebirdstrat.com/blog/bid/381906/canadas-new-antispam-law-is-your-business-ready

One of the biggest changes we are making in light of this new law is locking down email addresses, as you need to have proof of consent for each email address. So if an email address changes you will need to record new proof of consent and store that in your CRM. 

I wanted to caution everyone about the "3-year rule" mentioned above. The 3-year transition period is there for an "existing business relationship" or an "existing non-business relationship." I'd recommend working with your own legal team to identify where that applies and how that relationship may need to define communication of CEMs. 

Has anyone added an express consent field to their forms yet? Post a link if you're willing 🙂

[Caryl_Mostacho]

Hi Emily 

How does proof of consent work if the person is speaking with someone on the phone and they change their email address in the system.

There's a record of the change by the representative in the CRM on the same contact record. Does that mean that the person has to go back and re-opt in for the newsletters and promos?


Caryl

[Anonymous]

Hi Caryl,

We are working on validation rules where the sales rep wouldn't be able to edit the email address if the opt-in was already checked. The sales rep would need to submit a support ticket and show written proof of the new opt-in. We are also working on creating a "re-opt-in" page for this purpose so a sales person can direct the inidividual to this page to receive marketing emails. 

To get the opt-ins before July 1st we are going to send an email with a gated ebook (huge for our target audience) and in the form there will be the new express consent field. We reviewed this approach with our legal team to ensure we weren't bribing people to receive their consent. I'll update with the results of that send in a couple weeks. 

[Anonymous]

subscribing

[Anonymous]

From the Marketo webcast on the topic, and from reading the law below, it appears that implied consent is still acceptable. No explicit consent "checkbox" is required, at least in a B2B marketing context. Check my read of this below and let me know what you think.

From the Implied Consent section, "consent is implied if the person who sends the message...has an existing business relationship with the person to whom it is sent."

From the Existing Business Relationship section, an existing business relationship exists for "an inquiry...within the six-month period immediately before the day on which the message was sent...[about] the purchase or lease of a product, goods, a service.

So, if someone has made an "inquiry" in the last six months about a purchase (which we interpret to mean downloading a whitepaper or watching a webinar or demo), then they have established a business relationship and therefore have implied consent. No express consent is required.

I agree that the new requirement for Canada is that we need to track the last "inquiry" made, and if more than six months ago, then register that consent has expired.

CASL

Implied consent — section 6
(9) Consent is implied for the purpose of section 6 only if
(a) the person who sends the message, the person who causes it to be sent or the person who permits it to be sent has an existing business relationship or an existing non-business relationship with the person to whom it is sent;
(b) the person to whom the message is sent has conspicuously published, or has caused to be conspicuously published, the electronic address to which the message is sent, the publication is not accompanied by a statement that the person does not wish to receive unsolicited commercial electronic messages at the electronic address and the message is relevant to the person’s business, role, functions or duties in a business or official capacity;
(c) the person to whom the message is sent has disclosed, to the person who sends the message, the person who causes it to be sent or the person who permits it to be sent, the electronic address to which the message is sent without indicating a wish not to receive unsolicited commercial electronic messages at the electronic address, and the message is relevant to the person’s business, role, functions or duties in a business or official capacity; or
(d) the message is sent in the circumstances set out in the regulations.
 
Definition of “existing business relationship”
(10) In subsection (9), “existing business relationship” means a business relationship between the person to whom the message is sent and any of the other persons referred to in that subsection — that is, any person who sent or caused or permitted to be sent the message — arising from
(a) the purchase or lease of a product, goods, a service, land or an interest or right in land, within the two-year period immediately before the day on which the message was sent, by the person to whom the message is sent from any of those other persons;
(b) the acceptance by the person to whom the message is sent, within the period referred to in paragraph (a), of a business, investment or gaming opportunity offered by any of those other persons;
(c) the bartering of anything mentioned in paragraph (a) between the person to whom the message is sent and any of those other persons within the period referred to in that paragraph;
(d) a written contract entered into between the person to whom the message is sent and any of those other persons in respect of a matter not referred to in any of paragraphs (a) to (c), if the contract is currently in existence or expired within the period referred to in paragraph (a); or
(e) an inquiry or application, within the six-month period immediately before the day on which the message was sent, made by the person to whom the message is sent to any of those other persons, in respect of anything mentioned in any of paragraphs (a) to (c).