Page 28 - Fall 2017 english

would allow you to imply consent to send CEMs to current members, as well as people whose memberships have lapsed not more than two years ago. In addition, you can also obtain implied consent from people who have purchased any product or service from your golf course, within the two years’ period leading up to when the CEM is sent. This allows you to contact casual golfers and others who may have visited a pro shop or restaurant, for example.
Communication with prospects
If a person is merely a prospective member, then it’s unlikely you’ll have their express consent to receive CEMs. Nor is it likely that implied consent will be applicable, since you’ll not yet have entered into a business or non-business relationship with them (though CASL does give you six months’ implied consent to respond to enquiries about your business). Unfortunately, you cannot obtain express consent from these people via email, since CASL deems a request for consent to be a CEM, in and of itself. Therefore, in the absence of an exception to CASL applying, your best bet to reach out to prospects is through alternative methods of communication (e.g., telephone calls or mail outs).
CASL ENFORCEmENT ANd CONSEqUENCES OF NON- COmpLIANCE
CASL uses a complaint reporting framework - people submit complaints to the Canadian Radio- television and Telecommunications Commission (CRTC), which can then investigate complaints. The CRTC’s powers are broad and include the ability to obtain warrants authorizing access to private property and technology infrastructure.
“CASL provides for vicarious liability, which means your organization can be held liable for the actions of its employees and agents (including volunteers) that breach CASL, if the employee or agent was acting within the scope of their employment or authority. “
The CRTC can issue fines for non-compliance with CASL, to a maximum of $1 million, in the case of individuals, and $10 million, in the case of organizations, for each day CASL is breached. CASL provides for vicarious liability, which means your organization can be held liable for the actions of its employees and agents (including volunteers) that breach CASL, if the employee or agent was acting within the scope of their employment or authority. CASL also provides that directors and officers can be personally liable if they “authorize, direct or acquiesce” to the commission of an offence under CASL.
TAKE-HOmE pOINTS:
WHAT YOUR ORGANIZATION SHOULd BE dOING
Create policies and operationalize compliance
Showing your organization “exer- cised due diligence to prevent the commission of the violation” can be a complete defence to a com- plaint under CASL.
In this context, due diligence is about more than simply having a CASL policy - rather, the key is op- erationalization. You must take steps to ensure your employees and representatives are trained to understand CASL, and correctly and consistently put the organiza- tion’s policies and procedures into place.
Create a structured framework for tracking consent
CASL compliance is premised on understanding which email ad- dresses are off-limits. This requires strong recordkeeping, so that with every email address, you can an- swer: “How did we get this email address?”; “Do we have a basis for emailing this person (express, im- plied or an exemption to con- sent)?”; “When did we get consent and what does that consent look like?”; and “Has the person unsub- scribed?” Guidance released by the CRTC suggests that CASL-re- lated records should also include your organization’s policies and procedures.
July 1, 2017 - what’s changed?
Before July 1, 2017, organizations could take advantage of a special transition period, for implied con- sent under the EBR and ENBR. The transition period provided that, if you had an EBR or ENBR any time before July 1, 2014, and that rela- tionship involved the sending of email, then you would have three years during which consent would be implied, expiring July 1, 2017. Now that this transition period has ended, any relationship which forms the basis of implied consent arising from an EBR or ENBR must be either current, or have ended not more than two years before the CEM is sent.
28 Golf Business Canada