Who enforces CASL and what powers do they have?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Canada's Anti-Spam Legislation (CASL) is one of the world's strictest email laws, and it has three agencies behind it with real enforcement teeth.
CRTC (Canadian Radio-television and Telecommunications Commission) is the primary CASL enforcer. They handle spam, malware, and unauthorized program installation. They can issue administrative monetary penalties up to $1 million per violation for individuals and $10 million for businesses. They can also accept undertakings (negotiated compliance agreements) instead of fines.
Competition Bureau handles deceptive commercial messages under CASL, including false or misleading representations in commercial email. They work alongside the CRTC when spam overlaps with competition law.
Privacy Commissioner handles the personal information collection and data harvesting parts of CASL. If someone's data is being collected without consent through email mechanisms, the Privacy Commissioner can investigate.
CASL also has a private right of action: individuals and organizations can sue senders directly for violations. This provision was suspended before it came into force, but it's worth watching as it could be reinstated.
If you send to Canadian addresses, you need to understand that CASL requires express or implied consent before sending commercial messages. It's stricter than CAN-SPAM in most ways. See how CASL enforcement escalates and the specific CASL rules for unsolicited messages.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
