I received a great question about the Electronic Commerce Protection Act (Bill C-27) currently working it’s way through the Canadian Parliament.

Q:
What does this mean for US companies which have Canadians on their list? It looks like the ECPA (pronounced Eck-Pa) has a slightly more rigid permission rule than CAN SPAM (implied consent is not exactly opt out). So if I have Canadians on my file, and don’t have ZIP or Country, will I have to re-permission or collect more data (e.g.: Country) to be in compliance?

A:
Like most laws they are bound geography by the boarders of the country that created them. ECPA is filling a void in Canada that is currently allowing people to hide from prosecution in countries that do have existing spam laws, and enabling Canada to identify and target domestic spam operators. However this doesn’t mean you can have free reign over the data to do as you wish if your operating in or selling to Canadians.

High level notes on the ECPA

Messages must include the following information:

1 – Identify the person/company sending the message
2 – Provide contact information (I believe your postal address will suffice – also a CAN-SPAM requirement)
3 – Provide a functional unsubscribe method.

Two levels of consent for electronic messages:

1 – Implied Consent – Time limit of 24 Months, providing ample time to gain express consent. Covers; memberships, donations, volunteering, purchases, contracts, existing business relationships, etc…
2 – Express Consent – No expiration (unless opt-out is used) – covers all types of transactions.

NOTE: It is important to recognize that ECPA is not entirely opt-in: in circumstances where the law allows consent to be implied, this is effectively a form of ‘opt-out’ consent. As such, ECPA can be described as a mix between opt-in and opt-out.

Opt-out Methods:

1 – Should be allowed via the same method the original communication was sent (i.e. Email unsub for Email messages, SMS unsub for SMS messages etc…)
2 – and, A web site must be included as an alternative option.

NOTE: Opt-outs must function for a minimum 60 days after the message was sent, and be processed as fast as possible and no later then 10 business days.

ECPA does cover any electronic message sent to Canadians or routed through Canada, so it is my understanding that people initiating messages from the US and other international mailers will need to be aware of the permission issues and work towards compliance. Remember this is for Electronic messaging which includes; Social Networks, IM, SMS, and of course email… and likely other forms of electronic communication.

More to come as we see continued progression via parliament.