Does Canada’s Anti-Spam Law Really Discriminate Against Charities and Schools? No.

My earlier posts on Canada’s anti-spam law focused on claims about restrictions involving family and personal relationships as well as the exaggerated concerns about the impact on small and medium sized businesses. This post tackles one of the strangest criticisms of the Canadian anti-spam law to date: the claim that it discriminates against charities, schools, and other not-for-profit organizations. In fact, the opposite is true since the law features additional protections for these groups that are not otherwise available to conventional commercial businesses. 

For charities, schools, and other similar organizations, there are at least two broad exceptions that cover their business activity. The first is the existing business relationship exception that allows for implied consent for two years after the purchase of a good or service as well as six months for an inquiry (there is an additional three year delay in the implementation of this provision once the law takes effect). The exception also covers written contracts if dealing with something other than goods or services. This exception is open to any organization – both for-profit and non-profit – so long as the activity fits within the definition.  For hospitals, schools, and other non-profits, these means that  many of their services will invariably be captured by the exception (either by way of the goods sold, services provided, or an underlying contract). Barry Sookman argues that these groups will be excluded from the implied consent provision for some of their services:

For example, when a college or university provides educational services to students, when a hospital or physician provides medical services to patients, when a charity provides services to the community, or when organizations such as hospitals and universities collaborate on research, and in the course of those activities send CEMs, none of them will be able to rely on the implied consent EBR exception, unless serendipitously a business relationship happens to arise from these or other interactions.

Yet several of these examples would certainly fall within an existing business relationship (for example, the payment of tuition fees by students). In other instances, it is hard to envision how this creates a serious problem. In the case of medical services, some services qualify as business activities (e.g. examinations on behalf of an insurance company) and best practices already mandate explicit opt-in consent for health privacy, which is widely viewed as particularly sensitive information. As for collaborative research between a hospital and university, those two institutions will typically have a business agreement that governs intellectual property issues and other responsibilities. That would allow for business-to-business emails between the two parties. Moreover, individual researchers would be covered by the personal relationship exception and project funders will have a business relationship and an underlying contract.

In addition to the existing business exception, these organizations can also rely on the non-business relationship exception, which is reserved for charities, political parties, and membership organizations. This exception implies consent for a wide range of “non-business relationships” including donations to charities and political parties over the prior two years, volunteer work over the prior two years for a charity or political party, attendance at a meeting organized by a charity or political party, or membership in club, association, or voluntary organization.

Sookman also claims that these organizations cannot rely on the exception for openly available addresses without a do-not-contact request. As noted yesterday, almost anyone that publishes their email address without a clear statement that they do not wish to receive commercial messages is fair game. The exception is not limited to businesses, however. The exception says implied consent is available where:

the person to whom the message is sent has conspicuously published, or has caused to be conspicuously published, the electronic address to which the message is sent, the publication is not accompanied by a statement that the person does not wish to receive unsolicited commercial electronic messages at the electronic address and the message is relevant to the person’s business, role, functions or duties in a business or official capacity

This would cover charities or other organizations that publish emails addresses and the emails that follow are relevant to the person’s functions or duties in an official capacity with the organization.

In short, far from discriminating against charities, hospitals, and schools, the law actually provides them with more benefits and flexibility than is provided for conventional businesses. Both have long phase-in periods and broad exceptions that will permit implied consent for years after the law has taken effect.

Tags: /


  1. who is Barry Sookman?
    I’ve been reading all your articles in this series, and it seems to me Barry Sookman is some internet crank who got his 15 minutes of fame over this issue. Why don’t you just ignore him and give us your interpretation without the sideshow?

  2. Christine Silversides says:

    The charities and educational institutions disagree. Charities, such as schools and universities, are NOT businesses. Therefore, they do not have “existing business relationships”. Therefore, charities have less exemptions than businesses. Barry Sookman is right on the mark (as usual).

  3. Devil's Advocate says:

    “Unsolicited” means the same to EVERYONE
    Why do we even humour the idea that churches, charities, political offices, or anyone should be exempt in the first place??

    There’s really no legitimate reason for any group to be reaching out, uninvited, via e-mail, simply to supplement their “mission”. People are already completely saturated with all the “important messages” they’re getting through an endless variety of venues. To say that anyone actually “needs” to be able to “initiate relationships” of any kind with e-mail, or get peoples’ attention by flooding the comment sections of various blogs, is not only disingenuous, but completely selfish. Such thinking also tries to totally disregard the the wishes of a very pronounced majority, which marketers, charities, churches, et al, already know are out there, just to reach a few more who might further their cause.

  4. Exempt doesn’t mean immune
    Just because a hospital or educational organization has a business relationship does not mean they have license to ignore the requirements. In the case of implied consent via an established business relationship, they only have a 2 year window and they still need to provide and manage an opt-out list.