Revised: January 2020
Overview
This guide informs organizations about the Office of the Privacy Commissioner of Canada’s (OPC) mandate related to electronic address harvesting and e-marketing. In this context, e-marketing refers to sending marketing and promotional messages to recipients via email, instant messaging, social media or other similar accounts.
Our guide helps you to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) when it comes to address harvesting and e-marketing activities.
On this page
- Introduction
- Who is responsible for what in relation to e-marketing?
- Third party e-marketing
- Get consent when collecting addresses
- Spamming: cheap, yet costly
- Steps you can take to avoid contravening PIPEDA
- Scenarios
Introduction
Today’s economy is digital and connected. So much of our daily lives now take place on-line that an organization can promote itself to thousands of contacts with a simple click.
While it is technically possible to collect thousands and thousands of electronic addresses for marketing purposes or to buy a list from a third party, doing so blindly comes at a risk, both under the law and to an organization’s brand.
At the federal level, spam and other electronic threats are regulated by Canada’s anti-spam legislation (CASL) and related provisions in the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Competition Act. PIPEDA, the federal private-sector privacy law, applies to the collection, use and disclosure of personal information in the course of commercial activities and contains restrictions relating to electronic address harvesting and e-marketing.
Who is responsible for what in relation to e-marketing?
Our Office shares responsibility in this area with the Canadian Radio-television and Telecommunications Commission (CRTC) and the federal Competition Bureau.
The CRTC is responsible for investigating contraventions of CASL relating to the:
- sending of unsolicited commercial electronic messages
- alteration of transmission data
- installation of software without consent
The Competition Bureau addresses false or misleading representations and deceptive marketing practices in the electronic marketplace under the Competition Act.
For details about the full range of matters dealt with under federal legislation relating to spam and other electronic threats, including those by organizations other than the OPC, visit fightspam.gc.ca.
Re-thinking Digital Marketing – click on image to read more
Address harvesting
Address harvesting generally refers to collecting electronic addresses, such as those for email, instant messaging and social media by the use of computer programs. These programs may harvest addresses, either by collecting them from external sources — for instance, by scraping websites — or by generating a list of such addresses.
With very limited exceptions, PIPEDA prohibits address harvesting. This prohibition is highly relevant to organizations of all sizes in all sectors. lf an organization engages in address harvesting or obtains and uses a list that has been compiled through address harvesting, it runs a real risk of being in contravention of the obligation to obtain meaningful consent under PIPEDA.
Although there are certain exceptions under PIPEDA where personal information can be collected without consent, these exceptions by and large do not apply to address harvesting.
How PIPEDA’s provisions affect businesses doing e-marketing
In addition to the specific provisions on address harvesting, PIPEDA requires more generally that businesses (and other organizations) be accountable for how they collect, use and disclose personal information, including electronic addresses, in the course of their commercial activities. Businesses must ensure that they obtain informed consent to collect and use individuals’ electronic addresses, even if they obtained the addresses from a third-party supplier. This includes lists of electronic addresses.
Organizations have a responsibility to ensure that individuals receiving commercial electronic messages have consented to the collection and use of their address for marketing and other purposes.
For more information about the application of consent with regard to commercial activity under PIPEDA, please see the OPC’s Guidelines for obtaining meaningful consent.
Third party e-marketing
What if my business hired a supplier to do email marketing?…
