Blog

Law 25 and CASL: what to know before automating your follow-ups

2026-08-21 · 9 min

An automated follow-up looks harmless. Legally, it triggers two separate regimes: Quebec’s Law 25, because it processes personal information, and Canada’s Anti-Spam Legislation, because it sends a commercial electronic message.

The two are easily confused. Yet they protect different things, answer to different regulators, and are not satisfied by the same actions.

Law 25 — the key elements

Quebec’s private-sector privacy act, as amended by Law 25, imposes a series of obligations. These are the ones that bear directly on automation.

• A designated officer. You must publish the title and contact details of the person responsible for personal information. The name is not required — the title and a way to reach them are.
• A collection notice. At the moment of collection you must inform the person of the purposes, the means, their rights of access and correction, their right to withdraw consent, and the possibility that the information may be communicated outside Quebec.
• An assessment before adopting a system. Section 3.3 requires one for any project to acquire, develop or overhaul an information system or electronic service delivery involving the life cycle of personal information. A transfer outside Quebec is not a condition.
• An assessment before any transfer outside Quebec. Section 17 covers communications outside Quebec — not outside Canada — taking into account the legal regime of the processing location.
• An incident register. Every confidentiality incident must be recorded; those presenting a risk of serious injury must be reported to the persons concerned and to the Commission d’accès à l’information.
• Portability. A person may ask to receive, in a structured and commonly used technological format, the information they provided to you.

The section 12.1 trap

You often read that Law 25 “governs automated decisions”. That is imprecise, and the imprecision is costly in both directions.

Section 12.1 covers decisions based exclusively on automated processing. The law does not specify what degree of human intervention makes a decision stop being “exclusively” automated, and the Commission d’accès à l’information itself flagged, in its brief on Bill 64, the risk that a minimal human step could circumvent the provision.

As a matter of prudence, a human review should be genuine, documented, and carried out by someone with the authority and information needed to change the decision. That is sound governance — not an established legal threshold.

CASL — the key elements

Canada’s Anti-Spam Legislation governs commercial electronic messages. A follow-up can be one where a purpose of the message is to encourage commercial activity. Exceptions and exemptions exist, however — notably under section 6(6) for certain purely transactional or factual messages, and under the regulations for those enforcing a legal right or obligation. The content and context of each scenario must be analysed before automating it. The Act is enforced by the CRTC.

Three things must be present for every send.

• Consent. Express — given explicitly, and it does not expire — or implied.
• Identification. The message must say who is sending it and on whose behalf, with contact details valid for at least 60 days after sending.
• Unsubscribe. A simple mechanism, present in every message, functional for at least 60 days, and the request must be honoured within 10 business days.

Implied consent, and its expiry date

This is where automation creates the risk, because implied consent lapses on its own while a system keeps sending.

• Two years after a purchase, a lease or an accepted business arrangement.
• For a written contract: throughout its existence, and two years after it ends — not two years after signature.
• Six months after an inquiry or application, but only where it concerns the goods, services, land, rights or opportunities covered by the legal definition.
• A business address published conspicuously, without a statement refusing messages, and relevant to the person’s functions — with no fixed period.
• Every one of these bases ends the moment an unsubscribe is expressed.

A system that follows up twenty-five months after the last purchase sends a message without valid consent. Nobody will notice — until somebody does.

Penalties, and a nuance people forget

Under CASL, the maximum administrative monetary penalty is one million dollars for an individual and ten million for any other person. On the Law 25 side, two regimes must be distinguished: administrative monetary penalties can reach 10 million dollars or 2% of worldwide turnover, while penal fines can reach 25 million or 4%, whichever is higher. Conflating the two is a common error.

The forgotten nuance: CASL’s private right of action, which would have let anyone sue directly, was suspended indefinitely by Order in Council in June 2017, before it ever came into force. It was not repealed. The rest of the Act applies in full.

What that demands of an automation tool

If you hand your follow-ups to a system, four capabilities stop being conveniences.

• A record per send — which message, to whom, when, on what consent. That is what lets you answer a complaint two years later.
• Honouring unsubscribes on time, including when the request arrives through a channel other than the link.
• A line between what goes out alone and what waits for a human decision, drawn in advance rather than improvised.
• A defined retention period, applied, and documented.

What we will not claim

Probaro makes you compliant with neither Law 25 nor CASL. No software can: compliance rests on your policies, your consents and your decisions.

What we provide is the record: which action, for which file, when, approved by whom. And a register of our providers and processing locations your advisor can file into their assessment instead of starting from nothing.

Probaro does not guarantee compliance with any law or standard. This article provides general information as of the date shown; it is not legal advice and does not replace analysis by a qualified advisor who knows your situation.

Frequently asked questions