Previous legislation and regulations prior to the arrival of the Protection of Personal Information Act (POPIA) in 2013 required organisations undertaking electronic direct marketing in South Africa to provide the opportunity for recipients to unsubscribe from further communications (commonly referred to as opt-out). According to the Internet Service Provers Association (ISPA), an authoritative industry source, “this was true under section 45 of the Electronic Communications and Transactions Act (ECTA, #25 of 2002), but this will be repealed by section 69 of the POPIA once it is in force [expected to start with a transition period that comes into effect late in 2017 or early 2018].” Section 11 of the Consumer Protection Act (CPA, #68 of 2008) follows in the footsteps of the ECTA by providing that you may refuse to accept, request the discontinuation of (opt-out) or pre-emptively block direct marketing communications, and that any opt-out or pre-emptive block must be respected by marketers, have their receipt confirmed in writing and that the exercise of these right must be performed free of charge.
POPI Act definitions
POPIA defines direct marketing as approaching a data subject (which could be an individual or organisation) either in person or by mail or electronic communications, for the purpose of promoting or offering to supply goods or services to the data subject, or asking them to make a donation. Electronic communication covers a wide variety of methods, including text, voice, sound, image over an electronic network. So this covers use of all the popular methods used today and probably some we are not yet familiar with.
Records of consent and withdrawal of consent for electronic direct marketing
Section 11 of POPIA makes it clear that the Responsible Party (the body doing the direct marketing) must keep adequate records to prove informed consent has been voluntarily given. Records should also be maintained where consent has been denied or is later withdrawn. Consent may be obtained via verbal or written means. The interpretation of voluntary consent in other countries suggests poor practice is to pre-tick or pre-select opt-in choices. Rather the data subject should be presented with an open option to provide consent (e.g. an empty, not pre-ticked, box).
“Section 69 of the POPIA [Direct marketing by means of unsolicited electronic communications] places significant limitations on the circumstances in which a party may engage in direct marketing by means of unsolicited communications by requiring individuals to have either consented to the use of their personal information (opt-in) or for there to be an existing relationship between the parties. An existing relationship between the parties is itself subject to additional limitations and does not result in a freedom to make repeated advances” says ISPA (for more on ISPA visit www.ispa.org.za ).
A request for consent may only be submitted to the data subject once (section 69(2)(a)(ii). However it is not clear whether this “one time opportunity” applies where the data subject moves to a new or different organisation and therefore could be deemed to have a different set of marketing needs. If this is interpreted as one-time-ever then a unique identifier would be required to ensure compliance. It is not sufficient to ask for general consent for marketing. Section 13 requires that “personal information must be collected for a specific, explicitly defined and lawful purpose”.
Section 11(3)(b) of POPIA makes it clear that a data subject may object to any form of direct marketing, not necessarily electronic; section 11(4) clearly states once the data subject (which may be an organisation or juristic entity to use the legal term) has objected, the Responsible Party may no longer process the personal information, by implication for direct marketing, whilst by implication processing may continue for other specific purposes.
Records of consent and withdrawal of consent for non-electronic direct marketing
The rules for opt-out seem to be common and clearly stipulated, whether for electronic or traditional mail. When it comes to consent traditional mail does not merit a specific mention under opt-in. By default permission (consent) should be obtained at the first contact, which may be a first mailer. It is tricky to see how the refusal of consent can be achieved at no cost to the data subject. There also appears to be no limit to the number of mailers that can be sent before consent is denied as the “only once” clause only applies to electronic communication. In summary, some careful wording of your invitation to give consent or withdraw consent would appear to allow an unlimited number of postal mailers to be sent so long as no objection is received.
Role of the Direct Marketing Association South Africa (DMASA)
For any organisation that is engaged in direct marketing activities in South Africa it is recommended that consideration is given to adhering to the DMASA Code of Ethics and Standards of Practice. The DMASA is also known to be developing a Code of Conduct under the POPIA. The DMASA also manages the National Opt Out Database. Registering on this database will mean that individuals will not be contacted by members of the DMASA.
We are in the early days of understanding the full implications of the impact of the POPIA on direct marketing activities by whatever means. Organisations that take action now to review their policies and procedures will give themselves a competitive advantage by being better prepared to anticipate how to better address the rights of their key stakeholders, such as future and current customers, and demonstrate both legal compliance and good governance, all of which will lead to enhancement of their reputation in the marketplace.
* This article does not constitute legal advice but is based on a practical interpretation of the requirements of the POPI Act.