Can I keep emailing a customer list I bought with a business?

Canada’s anti-spam law, known as CASL, is described by Innovation, Science and Economic Development Canada (ISED) as protecting consumers and businesses from the misuse of digital technology, including spam. Subject to the exceptions set out later in s.6, section 6(1) prohibits sending a commercial electronic message to an electronic address unless its conditions are met, which include that the recipient has consented, whether the consent is express or implied. A bought list does not change that. Consent is the starting point, and the Act puts the burden on you: under s.13, a person who says they have consent has the onus of proving it. That is why consent records belong in your diligence request list.

What carries over when the business is sold

Section 10(12) says that if a person has an existing business relationship with another person in accordance with s.10(10), and the business is sold, the person who purchases the business is considered to have, in respect of that business, an existing business relationship with that other person. The s.10(10) definition is the starting point. For a purchase from the seller, for example, s.10(10)(a) looks to the two-year period immediately before the day the message was sent, and s.10(14) says when that period begins for an ongoing subscription, account, loan or similar relationship. ISED describes implied consent as generally time-limited.

Questions to put to your lawyer

Section 10(12) speaks of existing business relationships. Ask your lawyer whether express consents (a recipient saying yes, verbally or in writing, as ISED puts it) given to the seller can be relied on after a sale, and whether a list bought without the business qualifies under s.10(12). Ask also how the purchase agreement should deal with consents, and whether you are buying a business or only a list.

What to check in diligence

• Records of consent: ISED says that, if asked, senders should be ready to provide proof of consent. Ask for the record behind each contact, with dates.
• How the list was built: purchases, enquiries, sign-up forms, or lists the seller acquired elsewhere. Ask what each source shows.
• Unsubscribe handling: s.11(3) requires effect to be given to an unsubscribe indication without delay, and in any event no later than 10 business days after it was sent. Ask to see the process and the suppression list.
• Privacy law: CASL is separate. Read can I share customer data with a buyer for personal information.