Exploring The Application Of Mail Laws To Emails

There are many laws that govern the use of mail and email for marketing purposes. While some laws apply to both, such as the Health Insurance Portability and Accountability Act (HIPAA), others are specific to either mail or email. For example, the Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM) applies only to email marketing, whereas the Deceptive Mail Prevention and Enforcement Act (DMPEA) applies only to direct mail marketing.

The Controlling the Assault of Non-Solicited Pornography and Marketing Act (US)

The CAN-SPAM Act has several key provisions that companies must adhere to when sending promotional emails:

• Emails must be clearly identified as advertisements.
• All information in the email header fields must be truthful and non-deceptive.
• Subject lines must accurately reflect the content of the email.
• A clear and easily accessible method for opting out of receiving future emails must be provided.
• Opt-out requests must be honoured within 10 business days.
• A valid postal address must be included in all emails.
• Third-party emails sent on behalf of the company must also comply with the Act.

The Act is regulated by the Federal Trade Commission (FTC) and violations can result in significant financial penalties of up to $50,000 per violation.

The Deceptive Mail Prevention and Enforcement Act (US)

The Deceptive Mail Prevention and Enforcement Act is a US bill that was introduced in 1999 by Senator Susan Collins. It was designed to establish strong consumer protections against deceptive mailings, imposing various requirements on sweepstakes mailings, skill contests, facsimile checks, and mailings that resemble government documents. The Act also aimed to strengthen the authority of the US Postal Service (USPS) to investigate and stop deceptive mailings.

Summary of the Deceptive Mail Prevention and Enforcement Act

• The Act prohibits mail solicitations by nongovernmental entities that contain references to the Postmaster General, federal statutes, or the name of a federal agency, department, commission, or program, implying a connection to the federal government.
• It declares as nonmailable any matter that constitutes a solicitation for the purchase of a product or service provided by the federal government without a clear statement that it can be obtained without cost.
• The Act establishes mailability restrictions and disclosure requirements for sweepstakes, skill contests, and facsimile checks. Exemptions are provided for magazines, newspapers, and other periodicals that contain such promotions but are not directed at named individuals or do not offer opportunities to make payments or orders.
• It requires persons using the mail for sweepstakes, skill contests, or facsimile checks to adopt reasonable practices to prevent the mailing of such matter to individuals who have submitted written requests to the mailer or the appropriate state attorney general.
• The USPS is authorised to impose orders prohibiting the delivery and receipt of deceptive mailings under the Act, in addition to existing postal law sanctions involving false representations and lotteries.
• The USPS is granted the authority to apply for temporary restraining orders and preliminary injunctions during proceedings concerning deceptive mailings.
• The Act increases civil penalties for violations of postal law sanctions and establishes civil penalties for violations of the Act itself.
• It authorises the Postmaster General to issue administrative subpoenas in investigations involving nonmailable matter.
• The Act requires promoters of sweepstakes and skill contests to provide clear and conspicuous statements in their mailings, including contact information and details of a notification system that individuals can use to exclude themselves from mailing lists.
• It establishes a private right of action in state courts for individuals who continue to receive mailings after requesting removal from a promoter's mailing list.
• The Act prohibits the commercial use of lists compiled from individuals who have elected to be excluded from mailing lists, with significant civil penalties for violations.
• It establishes civil penalties for promoters who recklessly mail nonmailable matter or fail to comply with the notification system requirements.

The Health Insurance Portability and Accountability Act (US)

The Health Insurance Portability and Accountability Act (HIPAA) is a US federal law enacted in 1996 to protect patient medical information. The law regulates how healthcare providers and related entities use, store, and share patients' personal health information.

HIPAA has five titles, each covering different aspects of health insurance and patient privacy:

This title protects health insurance coverage for workers and their families who change or lose their jobs. It limits new health plans' ability to deny coverage due to pre-existing conditions and addresses the issue of "job lock", where employees are unable to leave their job as they would lose their health coverage.

This title establishes policies and procedures for maintaining the privacy and security of individually identifiable health information. It also creates programs to control fraud and abuse within the healthcare system and requires the establishment of national standards for electronic healthcare transactions and national identifiers for providers, employers, and health insurance plans.

To comply with HIPAA, healthcare providers and related entities must ensure that they have the necessary safeguards in place to protect patient information. This includes administrative, physical, and technical safeguards to protect electronic protected health information (ePHI). Covered entities must also notify individuals of their rights regarding their health information and obtain patient consent for the use and disclosure of their protected health information (PHI).

Violations of HIPAA can result in civil or criminal penalties, with fines ranging from $100 to $50,000 per violation, depending on the severity and nature of the breach.

The Federal Trade Commission Act (US)

• Prevent unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce
• Seek monetary redress and other relief for conduct injurious to consumers
• Prescribe rules defining with specificity acts or practices that are unfair or deceptive, and establishing requirements designed to prevent such acts or practices
• Gather and compile information and conduct investigations relating to the organization, business, practices, and management of entities engaged in commerce
• Make reports and legislative recommendations to Congress and the public

The FTC enforces the CAN-SPAM Act, which regulates how businesses can act when sending promotional and commercial emails. The CAN-SPAM Act introduces requirements that promote honesty, transparency, choice, and responsibility. This means that email recipients have greater control over their inboxes, can trust the messages being sent, and have the option to leave a mailing list at any time.

The General Data Protection Regulation (EU)

The General Data Protection Regulation (GDPR) is a privacy and security law that outlines how the personal data of individuals in the EU may be processed and transferred. It is considered the toughest privacy and security law in the world.

The regulation was drafted and passed by the European Union (EU) and came into effect on May 25, 2018. It applies to any organisation that targets or collects data related to people in the EU, even if the organisation itself is not based in the EU.

The GDPR grants individuals more control over their personal data. It gives them the right to:

• Know how their data is being used
• Access their personal data
• Have their data corrected or deleted
• Object to the use of their data for 'profiling'
• Transfer their data from one service provider to another

The regulation also outlines obligations for businesses and organisations, including the need to implement appropriate security measures and, in some cases, appoint a data protection officer.

The GDPR has two tiers of penalties for non-compliance, which can reach up to €20 million or 4% of global revenue, whichever is higher. Additionally, data subjects have the right to seek compensation for damages.

Frequently asked questions