Canada's Anti-Spam Legislation ("CASL") Commercial Electronic Message ("CEM") and Consent Procedure

1. Sending CASL-compliant CEMs:
Employees must confirm prior consent (implied or express) and that the electronic address has not been unsubscribed from the mailing list before sending a CEM, in addition to including an opt-out/unsubscribe mechanism. In doing so, Humber must follow four steps to ensure its outbound communications are CASL-compliant, as follows:

1. Identify whether the message is a CEM (i.e. does it have a commercial purpose);
2. Determine whether the CEM is exempt (i.e. can the message be sent without consent and an unsubscribe);
3. Check whether the electronic address has been unsubscribed; if not, then confirm whether Humber has implied or express consent. If there is no evidence of consent, the CEM cannot be sent unless Humber asks for and receives express consent. Requests for express consent must be in prescribed form and may not be sent via email; and
4. Confirm that an opt-out/unsubscribe mechanism is included in the CEM.

Appendix A contains a diagram illustrating a high level process flow for Humber to ensure sent messages are CASL-compliant.

2. CASL Requirements: 
CASL regulates CEMs, including emails and SMS/MMS messages which are sent by Humber, or by third parties (e.g. affinity partners) who send messages to individuals on Humber mailing lists.

Generally, a CEM must only be sent if:
•    Humber has prior implied or express consent to send the CEM; and
•    The CEM contains the proper form and content requirements (i.e. identifies the sender of the message, including relevant contact information, and provides an opt-out/unsubscribe to the recipient from receiving future messages.

See Appendix A to understand how to send a CASL-compliant CEM.

The following sample language may be used when sending out CEMs to identify the sender and include an unsubscribe mechanism:

The Humber College Institute of Technology and Advanced Learning 205 Humber College Blvd., Toronto, Ontario M9W 5L7 (416) 675-6622  firstname.lastname@humber.ca www.humber.ca You may withdraw your consent and unsubscribe from Humber College’s e-communications at any time by clicking here firstname.lastname@humber.ca. Please keep in mind that by unsubscribing you may not receive communications of interest and importance to you.

3. Definition of a CEM:
CEMs are electronic messages (e.g. text, sound, voice or image) sent to or from an electronic address within Canada that encourages participation in a “commercial activity”.

Commercial activity includes anything of a commercial nature (e.g. an activity that promotes a product(s), service(s), or a brand to a person(s) or encourages a person(s) to engage in the purchase of a product(s), or service(s)), whether or not there is an expectation of profit.

To illustrate, CEMs include emails, SMS/MMS messages, or instant messages that are sent from either a generic (e.g. info@humber.ca) or employee-specific electronic address e.g. joe.smith@humber.ca) that promote, advertise, market, sell a Humber product, service or promote the Humber brand, including:

• Offers relating to Humber products or services
• Newsletters that promote or market Humber products or services    
• Event notifications
• Course information

4. What electronic messages are exempt from CASL?:

Certain CEMs are either fully or partially exempted from CASL’s requirements:

• Fully exempted CEMs: can be sent without prior consent of the recipient and without the form and content requirements.
• Partially exempted CEMs: can be sent without the prior consent of the recipient, but must include the form and content requirements.

4.1. Full Exemptions

Electronic communications which are fully exempted under CASL include those that are:

• Exchanged between family or friends (e.g. engaged in direct, voluntary, virtual or in person two-way communications and relationship is personal based on shared interests, experiences);
• Sent to staff at other companies with whom Humber has an existing relationship, provided that the message is about the activities of that company (e.g. sending an email to set up an alumni event for the college, where the company is currently providing services to the college such as catering or marketing); 
• Exchanged between Humber employees using their Humber-employee email address (e.g. Program Director from one Department sends email to other staff to attend departmental event);
• Sent in response to a complaint, request or inquiry, provided that the reply does not include any promotional or marketing material the recipient would not expect an email (e.g. responding to a person’s inquiry about a particular program at the college);
• Sent to satisfy or enforce a legal obligation (e.g. legal notices of missed tuition, plagiarism notifications); and
• Sent over a closed network, such as Facebook, LinkedIn, or Twitter, where the required identification and unsubscribe mechanisms are clearly published on the user interface.
• Sent to students by faculty requesting a meeting to discuss an assignment or academic matter.

4.2. Partial Exemptions

The following list provides examples of CEMs that are partially exempted under CASL:

• Provide factual information (e.g. job fair on campus)
• Provide safety or security information (e.g. campus safety tips or events )
• Provided in response to or as part of a service requested/signed-up for/opted into by the CEM recipient (e.g. e-newsletters);
• Facilitate, complete or confirm an existing commercial transaction between the parties (e.g. confirmation of tuition payment);
• Provide notification of factual information about the ongoing use or purchase of a product(s), good(s), or service(s) offered under a subscription, membership, account or loan (e.g. emails sent to members of Humber’s alumni community regarding services provided to members); and
• Provide information directly related to an employment relationship or benefit plan.

4.3. Referral Marketing Exemption

Humber employees may send an initial message without prior consent of the recipient, following a third-party referral, and provided that the employee sending the message:

1. Discloses in the message the full name of the person who made the referral;
2. Has an existing business relationship with the person who made the referral;
3. States in the email that the message is sent as a result of a referral;
4. Identifies Humber and includes relevant contact information; and
5. Provides an opt-out/unsubscribe mechanism.

The employee must verify that the person who made the referral has an existing personal, business or family relationship with the person whom he/she referred.

5. Consent:

Humber or any third party sending emails or other electronic messages using Humber templates must have prior consent from recipients before sending CEMs, unless the message is exempt.

Templates:

• Obtaining express consent in writing – see section 5.3.1
• Obtaining express consent electronically – see section 5.3.2

Two types of consent are permitted under CASL: 1) implied consent and 2) express consent. Humber may rely on implied consent in prescribed circumstances and, in some cases, on a time-limited basis. Express consent is valid until it is revoked by the recipient.

5.1. Relying on Implied Consent

Humber may rely on implied consent to send CEMs in the following situations:

1. Humber has an existing business relationship  with the recipient (e.g. students who graduated within the 2-year period immediately preceding the day the message is sent).
2. Humber has an existing non-business relationship with its members who are the recipients of the CEM given that the recipient is a member of the organization (e.g. current members of the college’s Alumni community and people who have donated to the college in the 2-year period immediately preceding the day the message is sent.)
3. The prospect has conspicuously published (e.g. online, in a directory, email signature) his/her electronic address without a “do not solicit” request, and provided the message relates to the prospect’s business/function/role.
4. The prospect has given Humber their business card (or equivalent contact information in person, orally or electronically) without any “do not solicit request”, provided the email relates to that person’s business/role/function.

Otherwise, if Humber cannot rely on implied consent, Humber must obtain express consent when sending CEMs

5.2. Transitional Provisions

Humber may continue to rely on implied consent for a period of three years after CASL comes into force (i.e. until July 1, 2017) with individuals where a relationship exists, provided there was at least one electronic communication with the recipient (referred to as the Transition Period). This means that implied consent may apply to all current and former students of the college, all current and former students who are members of the alumni community, and all current and former donors and volunteers of a registered charity associated with Humber.  Humber may continue sending CEMs to these recipients during the Transition Period, provided that:

1. The form and content requirements are complied with;
2. As of July 1, 2014, Humber has already been communicating with the recipient via CEMs; and
3. The recipient has not unsubscribed from receiving CEMs (i.e. if the recipient unsubscribes during the Transition Period, Humber can no longer rely on the Transition Period exemption to send further CEMs).

Humber may use the Transition Period as an opportunity to convert implied consents to express consents, until July 1, 2017.

5.3. Obtaining Express Consent

Express consents obtained by Humber specifically for email communications prior to July 1st, 2014, may be “grandfathered” (i.e. continue to be relied upon) once CASL comes into effect.

Otherwise, when seeking express consent, Humber may do so in real-time (e.g. during school fairs, in person, application form) or by using other ad hoc, documented processes used to collect electronic contact information.

In obtaining express consent, Humber must:

1. Outline the purpose for which the consent is being sought (i.e. to send CEMs);
2. Specify the name which the person seeking the consent carries on business (i.e. identify the person who is requesting consent);
3. Specify the name of the person seeking the express consent if the person seeking the express consent is doing so on behalf of another person (i.e. where a third party is seeking consent on behalf of Humber);
4. Provide the contact information of the person who is requesting express consent; and
5. Provide a statement indicating that the person whose express consent is sought can withdraw their consent at any time.

Requests for express consent must be made separately from any request for consent to any terms and conditions associated with Humber service(s). Furthermore, the contact information provided as part of a request for express consent must remain valid (i.e. active and useable by the person whose consent is being sought) for no less than 60 days from the date that the contact information is provided.

Humber must not send an email to request the express consent of an intended recipient of CEMs as the request email is itself a CEM, unless Humber already has the recipient’s implied consent, and the time limit (in applicable instances) for reliance on implied consent has not already expired.

5.3.1 How to Obtain Express Consent in Writing

Express consent should be obtained in writing, where possible (e.g. at school events).

The following provides a sample template language for obtaining express consent when a prospect or non-student wants to sign up to receive CEMs:

5.3.2 Obtaining Express Consent Electronically

Humber employees may obtain express consent electronically on its website and through electronic application and registration forms. The following provides sample language for obtaining electronic express consent which requires a prospect or non-student to sign up through “opt-in” means:

 

5.3.3 Documenting Express Consent

Humber must be able to demonstrate that consent was obtained prior to sending a CEM, and as such, must capture, document and store consent in order to retrieve it and produce it when required (e.g. in the context of a CASL investigation, private right of action, or complaint).

Each School/Department must document, store, and update all related CASL unsubscribe and consent preferences in an accessible format for a minimum of three (3) years. Each School/Department is responsible for managing their mailing lists and ensuring all consent and unsubscribe requests are documented and actioned within ten (10) business days, and to retain all documentation and produce it upon request.

Employees must ensure that third party vendors who send CEMs that include Humber content send CEMs that meet the requirements set out in CASL and this procedure.

5.4. Consent – Summary

1. Humber can rely on implied consent for CEMs sent to existing students and alumni from the last two years;
2. If Humber cannot rely on implied consent (e.g. existing business relationship with students), Humber must ensure it has express consent to send CEMs to prospects/non-students;
3. Humber must obtain express consent from prospects and non-students in written form  either in writing, or by using electronic opt-in means on their subscribe page.

5.5. Opt-Out/Unsubscribe Mechanism

Employees must include an opt-out/unsubscribe mechanism which allows the CEM recipient to indicate, at no cost to them, that they no longer wish to receive future messages from Humber on all non- or partially exempt CEMs.

The opt-out/unsubscribe mechanism must be set out clearly and prominently and must:

1. Be consumer friendly and simple, quick and easy for consumer to use (e.g. a link in an email that takes the student to a web page where he/she can unsubscribe from receiving  optional messages);
2. Enable the recipient to opt out of communications using the same electronic means by which the message was sent; and
3. Provide the choice to opt out of all or certain types of communications.

Humber must honour opt-out/unsubscribe requests within ten (10) business days.

Humber must ensure that third party vendors include an opt-out/unsubscribe mechanism in their electronic communications (see Vendor Management Guideline).