Canadian Lawyer InHouse

17 CANADIANLAWYERMAG.COM/INHOUSE NOVEMBER 2017 urgency with businesses to make sure they were compliant with CASL. It was anticipat- ed that the PRA could provide fertile ground for class action lawsuits, especially given the statutory damages allowed for under the law — it allowed for the combination of individ - ual actions into class actions with high penal- ties up to $1 million a day. "It is entirely possible now that they have delayed the coming into force of the private right of action they will conveniently ignore it for a couple more years; I think that's possible," says Molly Reynolds, se - nior associate at Torys LLP who focuses on pri- vacy litigation and anti-spam. "But I don't think we're going to see extensive legislative reform — I don't see the political wins the govern - ment would get from entirely eliminating the provision for the private right of action." While many companies get external advice on CASL, much of the day-to-day compliance is handled in-house and inter - preting it has been perplexing for many. But just because the PRA has been put on hold doesn't mean it's gone away or that the gov- ernment is backing off on CASL enforce- ment, say lawyers who advise on the issue. CASL first came on the scene in July 2014, with a three-year transitional period planned for commercial electronic mes- sages. In January 2015, consent and notice rules for installation of computer programs came into force with its own three-year transitional period specific to computer programs. The third and final step was scheduled for July 1, with the PRA coming into force, the first three-year period for CEMs coming to an end and a mandatory review of CASL triggered. "Even though the private right of action has gone away for the moment, companies are aware of the regular enforcement by the CRTC and they are working on making sure their marketing departments comply," says Steve Szentesi of Szentesi Law Cor - poration. "However, I'm not seeing a lot of awareness among U.S. companies." Reynolds says there are a few lessons learned from the first three years of CASL where in-house counsel could be re-focus - ing their efforts in the regulatory enforce- ment area. For example, record keeping has been a huge focus and can be the easiest problem to solve, but it is the least appealing because it takes internal resources and time to create a proper record-keeping system. "Instead of just saying, 'Well, we only used implied consent and only contact by email or electronic message our existing customers, so we don't have to worry,' or - ganizations really should be keeping a data- base on when they received the consent and what the basis for the consent is for every person on their email list," says Reynolds. Based on the regulatory investigations to date, Reynolds says, it's one of the factors pushing companies to settle for adminis - trative penalties that they may not actually deserve. "The conduct may not be nearly as offside as some of the published decisions suggest, but because they didn't have the ability to re-create the records for the pro - duction requests, they chose a settlement that was a quicker and easier way of resolv- ing the situation. But it does come with some reputational risk and a fine," Reynolds says. With every enforcement action that comes out, and there have been nine so far, Tricia Kuhl of Blake Cassels & Graydon LLP in Montreal says there is "a bit more clarity" as to how the CRTC is enforcing the law. "We're able to provide more specific guidance on what is considered compliance. We also advise our clients on what might be considered a best practice and what might be considered acceptable practice. There are ways of communicating with people by properly understanding the exemptions and exceptions and also being creative in direct - ing people to your website to sign up for promotions and newsletters." Another area that is easy to fix but doesn't get as much attention is responding to cus - tomer complaints. Under the CASL regime, it's easy for a recipient to send a complaint to the spam reporting centre, but for many organizations, that won't be the first step — the individual will hit the unsubscribe but - ton first, so it had better work. "All the regulatory investigations we've seen so far have focused on whether the unsubscribe mechanism actually works and whether it's being fulfilled in the 10-day time period," says Reynolds. To date, ex - perts say the regulatory investigations have been largely fuelled by the volume of com- plaints the CRTC receives about an entity. "If organizations spent a bit more time arm- ing their customer-facing employees with how to respond and internally how to fix issues for those who don't want to receive messages, they could actually be lowering the complaints significantly and lower risk of getting an investigation," says Reynolds. Another area where CASL is rearing its ugly head is mergers and acquisitions and the amount of focus on CASL compliance during diligence questionnaires and man - agement calls in the M&A process. "We didn't see it in 2014 — it's taken a lit- tle while for this regulatory piece to trickle over to the M&A side. In 2016-2017, [we've] seen a lot more focus on it," Reynolds says. To mitigate that risk, the solution comes back to the same steps organizations should be taking for compliance and to protect themselves against regulatory investigations. For buyers asking for all the documenta - tion that companies have internally, is there an internal CASL policy? What is the ba- sis for consent and how many complaints have been received? Have you been subject to a regulatory investigation? Concerns do All the regulatory investigations we've seen so far have focused on whether the unsubscribe mechanism actually works and whether it's being fulfilled in the 10-day time period. MOLLY REYNOLDS, Torys LLP

• Cover