My earlier posts on Canada’s anti-spam law focused on claims about restrictions involving family and personal relationships as well as the exaggerated concerns about the impact on small and medium sized businesses. This post tackles one of the strangest criticisms of the Canadian anti-spam law to date: the claim that it discriminates against charities, schools, and other not-for-profit organizations. In fact, the opposite is true since the law features additional protections for these groups that are not otherwise available to conventional commercial businesses.
For charities, schools, and other similar organizations, there are at least two broad exceptions that cover their business activity. The first is the existing business relationship exception that allows for implied consent for two years after the purchase of a good or service as well as six months for an inquiry (there is an additional three year delay in the implementation of this provision once the law takes effect). The exception also covers written contracts if dealing with something other than goods or services. This exception is open to any organization – both for-profit and non-profit – so long as the activity fits within the definition. For hospitals, schools, and other non-profits, these means that many of their services will invariably be captured by the exception (either by way of the goods sold, services provided, or an underlying contract). Barry Sookman argues that these groups will be excluded from the implied consent provision for some of their services:
For example, when a college or university provides educational services to students, when a hospital or physician provides medical services to patients, when a charity provides services to the community, or when organizations such as hospitals and universities collaborate on research, and in the course of those activities send CEMs, none of them will be able to rely on the implied consent EBR exception, unless serendipitously a business relationship happens to arise from these or other interactions.
Yet several of these examples would certainly fall within an existing business relationship (for example, the payment of tuition fees by students). In other instances, it is hard to envision how this creates a serious problem. In the case of medical services, some services qualify as business activities (e.g. examinations on behalf of an insurance company) and best practices already mandate explicit opt-in consent for health privacy, which is widely viewed as particularly sensitive information. As for collaborative research between a hospital and university, those two institutions will typically have a business agreement that governs intellectual property issues and other responsibilities. That would allow for business-to-business emails between the two parties. Moreover, individual researchers would be covered by the personal relationship exception and project funders will have a business relationship and an underlying contract.
In addition to the existing business exception, these organizations can also rely on the non-business relationship exception, which is reserved for charities, political parties, and membership organizations. This exception implies consent for a wide range of “non-business relationships” including donations to charities and political parties over the prior two years, volunteer work over the prior two years for a charity or political party, attendance at a meeting organized by a charity or political party, or membership in club, association, or voluntary organization.
Sookman also claims that these organizations cannot rely on the exception for openly available addresses without a do-not-contact request. As noted yesterday, almost anyone that publishes their email address without a clear statement that they do not wish to receive commercial messages is fair game. The exception is not limited to businesses, however. The exception says implied consent is available where:
the person to whom the message is sent has conspicuously published, or has caused to be conspicuously published, the electronic address to which the message is sent, the publication is not accompanied by a statement that the person does not wish to receive unsolicited commercial electronic messages at the electronic address and the message is relevant to the person’s business, role, functions or duties in a business or official capacity
This would cover charities or other organizations that publish emails addresses and the emails that follow are relevant to the person’s functions or duties in an official capacity with the organization.
In short, far from discriminating against charities, hospitals, and schools, the law actually provides them with more benefits and flexibility than is provided for conventional businesses. Both have long phase-in periods and broad exceptions that will permit implied consent for years after the law has taken effect.