Practical POPI – Direct Marketing

We have all received some form of direct marketing by means of electronic communication – whether by email, SMSs or automatic calling machines.  Some of the marketing information we receive is useful, while some are not. 

From 1 July 2021, all businesses will have to comply with the Protection of Personal Information Act, 2013 (often referred to as “POPI” or the “POPI Act”).  Section 69 of the POPI Act prohibits direct marketing by means of unsolicited electronic communications. 

The purpose of this article is to explain the circumstances in which such direct marketing is permissible.  All businesses use direct marketing in one form or another, for example law firms send interesting articles by e-mail to their clients to keep them informed of legal developments but also to advertise their services. Yes, this e-mail will be subject to the POPI Act in the future!

___________________________________________________________________________

The prohibition

Section 69 of the POPI Act “prohibits” the processing (collection, recording and storage) of personal information (email address, physical address, telephone number etc) of a data subject (a customer or potential customer) for the purposes of direct marketing by means of any form of electronic communication including automatic calling machines, facsimile machines, SMSs or email.

Unlike some foreign jurisdictions, the POPI Act covers juristic persons as well as natural persons. 

The term “ direct marketing” is defined in the Act as to be for the purpose of promotion or offering to supply goods or services.

When is it permissible?

Section 69 has two exceptions to this general prohibition, being:-

1. the data subject can give its consent to the processing; or
2. if the data subject is a customer of the person responsible for the direct marketing. 

Both these exceptions have conditions:-

Firstly, we discuss the giving of consent but it is not that simple as the conditions are:

1. a data subject (potential customer) can be approached only once in order to request consent; 
2. the data subject must not have previously withheld such consent; and
3. that consent must be requested in the prescribed manner and form  (Form 4 of the regulations to the Act). This is a form of “opting in” by the data subject.

Secondly, what about existing customers? The conditions under the POPI Act for existing customers are:

1. the contact details of the customer must have been obtained in the context of the sale of a product or service. So, the recipient must be a customer;
2. the direct marketing must be of the company’s own similar products or services; and
3. the customer must be given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to use its electronic details:
   1. at the time when the information was collected, and
   2. on the occasion of each communication with the data subject for the purposes of marketing, if the customer has not initially refused such use. So the customer can ‘opt out’.

The direct marketing must identify the sender

The POPI Act provides that any communication for the purpose of direct marketing must contain (i) details of the identity of the sender or the person on whose behalf the communication has been sent, and (ii) an address or other contact details to which the recipient may send a request that such communications cease.

Who will enforce the provision of the Act?

The POPI Act creates the office of an Information Regulator. A failure to comply with section 69 constitutes “interference” with the protection of personal information, and a complaint can be submitted to the Regulator. The Regulator has powers to investigate and take further action.