POPIA Explained – Part 10

By Lize de la Harpe, legal adviser

In the last edition we discussed the requirements for Consent in detail.

In this edition we will take a closer at what constitutes Direct Marketing in the context of POPIA and what the requirements are.

The applicable definitions

Before taking a closer look at the sections dealing with direct marketing, we first have to focus on the applicable definitions.

Section 1 defines “direct marketing” as approaching a data subject, either in person or by mail or electronic communication, for the direct or indirect purpose of:

1. promoting or offering to supply, in the ordinary course of business, any goods or services to the data subject; or
2. requesting the data subject to make a donation of any kind for any reason.

“Electronic communication”, in turn, is defined as any text, voice, sound or image message sent over an electronic communications network which is stored in the network or in the recipient’s terminal equipment until it is collected by the recipient.

Direct marketing by means of unsolicited electronic communication – section 69

Section 69(1) states that the processing of personal information for the purpose of direct marketing by means of any form of electronic communications, including automatic calling machines, fax, SMSs or e-mail, is prohibited unless certain conditions are met, i.e.:

• Where the data subject has given consent ("opted in" – as discussed in Part 9 when we discussed Consent); or

• Where the data subject is a customer of responsible party and certain conditions have been met. These conditions state that a responsible party may only approach a data subject who is a customer of the responsible party:

1. if the responsible party obtained the contact details of the data subject in the context of the sale (of a product or service); and

• for the purpose of direct marketing of the responsible party’s own similar products or services; and

• if the data subject has been given a reasonable opportunity to object (*opt-out), free of charge, and in a manner free of unnecessary formality, to such use of his, her or its electronic details:

1. at the time the information collected; and
   1. on each occasion of each communication with data subject for the purposes of marketing if the data subject did not initially refuse such use.

A responsible party may approach a data subject whose consent is required (and who has not previously withheld) ONLY ONCE (*PS: the data subject’s consent must be requested in the prescribed manner and form – discussed in more detail below).

Any communications for the purpose of direct marketing must contain:

1. details of the identity of sender (or person on whose behalf the communication has been sent); and
2. an address or other contact details to which the recipient may send an opt-out.

Prescribed manner and form of requesting consent

As mentioned above, the data subject’s consent for direct marketing must be requested in the prescribed manner and form.

The Information Regulator published the "Regulations relating to the Protection of Personal Information" in the Government Gazette No. 42110 in December 2018 (“the Regulations”) – see copy attached.

Paragraph 6 of the Regulations states that a responsible party who wishes to process personal information of a data subject for the purpose of direct marketing by electronic communication “must in terms of section 69(2) of the Act submit a request for written consent to that data subject on Form 4”. As you can see from the wording of Form 4 (and as I have explained), OPT-IN consent is required.

The conditions for lawful processing

It is important to remember that the requirements for direct marketing (as discussed above) are in addition to the eights Conditions for lawful processing as discussed in previous editions.

To put it differently: the question whether it is permitted to process personal information for direct marketing purposes must therefore be assessed using the Conditions for lawful processing.

You will remember we touched on direct marketing when discussing Condition 4, namely Further Processing Limitation (see Part 5, copy attached!). As you will recall, section 15 states that states that further processing of personal information must be in accordance with or compatible with the original purpose of collection.

The direct marketing of products to existing and potential customers amounts to further processing. This means that, amongst other things, the processing of personal information for direct marketing purposes may not be incompatible with the purpose for which the information was obtained (*PS: if the personal information was acquired for direct marketing purposes, the processing for that purpose is of course not incompatible).

Conclusion

It is clear from the above that, in the context of direct marketing, consent is key! Once POPIA is fully in force, direct marketing via any form of electronic communication will no longer be permitted unless the person has either given his/her consent to receive such electronic communication, or is an existing customer of the responsible party (and has been given a reasonable opportunity to object thereto at the time the personal information was collected and on every communication for  the purposes of  marketing).

Responsible parties will therefore need to make sure they align their direct marketing strategy with the requirements as discussed above. We have now discussed Direct Marketing in detail – in the next edition we will take a closer look at the requirements regulating the retention of records.

Glacier Financial Solutions (Pty) Ltd and Sanlam Life Insurance Ltd are licensed financial services providers