The underlying key to CASL is consent. You just cannot do anything without consent. If you walk away with one key theme from this guide, let it be consent, consent, consent!

CASL essentially outlines two primary types of consent: Express Consent & Implied Consent.

Express Consent

Express consent, sometimes referred to as explicit consent, is basically the most obvious type of consent where the recipient has given you direct permission to email them. This type of consent is far less ambiguous than implied consent because the permission is clearly captured without much concern for legal interpretation.

There are still some requirements to ensure that express consent is valid including:

• Clearly describe the purposes for requesting consent.
• Provide the name of the organization/person seeking consent, and identify on whose behalf consent is sought, if different.
• Provide contact information such as a mailing address (PO boxes are valid), telephone number, email address or website address.
• Indicate that the recipient can unsubscribe or withdraw consent at any time.

One important thing to note is that express consent must be an affirmative action. This means you cannot have a pre-checked box on a registration form to secure consent.

The two most common ways that express consent is acquired are:

1. A mailing list sign up form on your website.
2. A confirmation link in an email.

Whenever you obtain express consent, it is important that you document everything. As the sender it is your responsibility to prove that you received proper express consent. This means tracking items like the date, time, IP address, form used, link clicked in email, etc.

It is also worth knowing that express consent does not expire until the recipient revokes it.

Implied Consent

Implied consent is the more ambiguous side of the consent game because it can be a bit more subjective on whether or not it exists in a specific scenario.

This type of consent is essentially the one where you can email someone because you have an existing relationship with them, even though they never explicitly requested that you email them.

According to CASL, consent will be implied in the following scenarios:

• The recipient and sender have an "existing business relationship" or an "existing non-business relationship." This is elaborated further below.
• If the recipient has "conspicuously published" their email address, the publication is not accompanied by a statement that the recipient does not wish to receive unsolicited messages, and the message is relevant to the person's business, role, functions or duties.
• If the recipient has disclosed their email address to the sender without indicating that they do not want to receive unsolicited messages and the message is relevant to the person's business, role, functions or duties. This can be thought of as the “business card” consent.

The topic of an existing business or non-business relationship needs to be elaborated further as this will often be a key area of discussion when trying to figure out if implied consent exists.

An “existing business relationship” exists where the sender and recipient have engaged in business together within the previous two years from the date the message is sent.

This could mean that the recipient purchased a product/service from you or entered into a written contract.

One important thing to note is that during the two year window, if they make another purchase from you, the clock resets to another two years. That being said, it is often a good idea to secure express consent at some point during the two years (usually right away) so that you never have to worry about the implied consent expiring.

Another form of “existing business relationship” exists when the recipient has made an inquiry to the sender in the previous six months. This is the method of consent that lets you respond to new customer emails without having to worry about violating CASL. Once again, it is good practice to try to secure express consent from these people so you can email them past the six month window.

An “existing non-business relationship” is defined as a relationship that exists from the recipient’s activities as a donor or volunteer for a registered charity, political party or political candidate, a member of a club, association or voluntary organization. It is important to note that this is very narrow in scope and not necessarily what you would assume.

If educational institutions, medical providers, hospitals, charities, clubs, and other non-business organizations provide services to the public they cannot automatically claim that an existing non-business relationship exists. There was thought that the final regulation would adjust this, but it did not happen. So, unless the non-business relationship fits into the really tightly defined definition (i.e. donor to a charity), then you would need a business relationship or express consent.

REMINDER:
CASL has a special transitional period so that the two year and six month windows discussed above are extended to 36 months from the date CASL takes effect, provided that you have emailed the contact previously.