Yesterday, the Canadian Radio-television and Telecommunications Commission (CRTC) published their official decision on CompuFinder’s appeal of CASL penalties levied against them. You may recall CompuFinder was subject to the first CASL enforcement action in March 2015 and hit with a hefty $1.1 million fine for their violations. In the appeal, CompuFinder argued that the emails in question were not in violation of CASL in addition to challenging the constitutionality of the law.

In the original notice of violation, the CRTC presented CompuFinder with 3 specific email campaigns that were deemed to be sent without the recipients’ consent, and in at least one instance the message did not contain a working unsubscribe link. CompuFinder argued unsuccessfully that because someone at the receiving domain had purchased a training or resource from them in the past, they had established a business relationship with any recipient at the same organizational domain. Not surprisingly, the CRTC shot down this argument, lending credibility to the assertion that consent follows the individual and not the organization. However, while CompuFinder’s violations were deemed valid, the penalties for those violations was lowered from $1.1 million to $200,000.

In a separate document, the CRTC also rebutted CompuFinder’s constitutionality challenges, finding the Commission does hold jurisdiction to enforce these regulations and that the regulations themselves were within the authority of the Canadian Parliament to enact.

Like CompuFinder, many senders are hanging a lot of their CASL compliance efforts (or lack thereof) on the “existing relationship” clause of the law. As evidenced in this case, there is a very high standard of proof for that relationship and the scope is narrow. CompuFinder produced many invoices for purchases and historical records of their email campaigns to these recipients, but they weren’t able to provide what CASL requires – proof of consent. And while the fine was ultimately lowered, this decision should provide you with at least 200,000 reasons to make sure your consent and documentation are in order.

– BG