Referral marketing is a great tool, but don't forget about privacy issues.

Current customers are a valuable source of referrals. Search "invite a friend," "tell a friend" or "refer a friend" online and you will find that this form of marketing is ubiquitous. Typically, this web-based marketing tool involves the user inputting e-mail addresses or allowing a website or mobile application to harvest the user's address book information to generate a list of potential "friends" who will receive an electronic invitation (usually by e-mail) to visit a website or join the user in a social network or promotional site, game or activity.

It is important, however, to take steps to avoid tripping over the privacy and antispam compliance issues relating to the collection and use of the "friend's" personal information during these promotions.

Canadian privacy legislation requires that an organization obtain the express or implied consent of the friend if it is acting as more than an e-mail delivery system. Except in the most basic of "share a page" scenarios, an organization running an "invite a friend" promotion is likely using the friend's personal information for a commercial purpose even if the invitation is ostensibly "from" the user.

However, an organization may rely on the user to obtain consent from the friend to the use of non-sensitive personal information, such as an e-mail address.

Due Diligence

Although an organization may rely on the user to obtain consent, the organization must demonstrate that its reliance was based on reasonable due diligence. Reasonable due diligence varies in the circumstances. Leaving aside anti-spam requirements, the user should verify that the user knows the "friend" and that the friend would not object to receiving the invitation. Context will determine whether this verification must be express or may be implied by drawing the user's attention to these requirements.

The organization should also confirm whether the friend gave consent — express or implied — to the use of his or her e-mail address by the user. The friend should have the opportunity to report abuse or to easily opt out of further communications (essentially, to withdraw consent). The friend should be able to add himself or herself to a "do not contact" list. Where abuse is reported, the organization should take action to demonstrate that it was not wilfully blind to the abuse.

Anti-Spam Considerations

Once Canada's anti-spam legislation is in force, it will prohibit unsolicited commercial electronic messages, subject to certain exceptions. A commercial electronic message is a message that it "would be reasonable to conclude has as its purpose, or one of its purposes, to encourage participation in a commercial activity."

One of the exceptions involves commercial electronic messages between persons who have a personal or family relationship. Industry Canada draft regulations proposed narrow definitions for these categories. Family relationships were defined as connections by blood, marriage, common-law partnership, and adoption. A personal relationship was defined to require an "in-person meeting" and a two-way communication (such as phone call) within the previous two years.

Although the final regulations may provide greater latitude for "invite a friend" promotions, an organization should consider legal advice to determine whether it is necessary to ask users to confirm that the friend falls within the personal or family relationship categories. An organization must also be careful not to overcollect, since this type of specific personal information will be sensitive and may undermine the ability to rely on the user to establish the friend's consent. Organizations should be particularly careful not to mine this data without the consent of the user and the friend.

Furthermore, the personal or family relationship exception may not apply to further communications (for example, reminder emails) from the organization that are sent without the involvement of the user. To obtain implied consent of the friend, the friend should have clear and transparent notice of such additional communications (in the first contact) and be provided with an immediate opt-out mechanism.

Friend Profiles

Finally, an organization should avoid building a profile of the friend, such as by cross-referencing the user's e-mail address against other users' address books or searching out other available information on the internet. An organization must first bring this additional collection and uses to the friend's attention and the friend must have the opportunity to opt out.

Organizations also must be wary of hidden methods of collecting information about the friend. For example, organizations use technologies that permit them to track when the friend opened the e-mail and whether the e-mail was forwarded (among other things). An organization should collect tracking data only in a de-identified or anonymous form solely to generate click statistics. In addition, consideration should be given to whether this data goes beyond permissible "transmission data" for the purposes of Canada's anti-spam legislation.

Finally, don't let the privacy and antispam compliance issues dampen enthusiasm for referral marketing. "Invite a friend" promotions are possible provided organizations respect the recipient friend's legitimate privacy and anti-spam concerns. The trick to avoiding traps is to involve legal counsel or privacy professionals early enough that the promotion can be developed with privacy and anti-spam compliance embedded in the design and technology used in the promotion.

Previously published in the Canadian Corporate Counsel Association Magazine, Vol.6 No.3, Fall 2012

About Fraser Milner Casgrain LLP (FMC)

FMC is one of Canada's leading business and litigation law firms with more than 500 lawyers in six full-service offices located in the country's key business centres. We focus on providing outstanding service and value to our clients, and we strive to excel as a workplace of choice for our people. Regardless of where you choose to do business in Canada, our strong team of professionals possess knowledge and expertise on regional, national and cross-border matters. FMC's well-earned reputation for consistently delivering the highest quality legal services and counsel to our clients is complemented by an ongoing commitment to diversity and inclusion to broaden our insight and perspective on our clients' needs. Visit: www.fmc-law.com

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.