During the ITWeb Governance, Risk and Compliance Summit which was held on 20 February 2024, the Information Regulator gave updates on important strides it has made over the last few months with regards to matters falling within its mandate. The Regulator touched on matters ranging from data breaches, elections, PAIA assessments, AI and its impact on data privacy. Importantly, the Information Regulator spoke about direct marketing and the frustrating phone calls we all get from telemarketers daily!
These calls have been an issue for most South Africans and notwithstanding POPIA, we have seen no decline in them. So, what does the Protection of Personal Information Act (“POPIA”) say about direct marketing and why have there been issues around the definition of what constitutes “electronic communication”?
In terms of Section 69 of POPIA (direct marketing by means of unsolicited electronic communications), direct marketing[1] is prohibited unless the prior consent[2] of the data subject[3] is obtained. This includes communications via emails, automatic calling machines, facsimile machines, SMSs and other types of electronic communications. If the data subject is already a customer of the responsible party, and the customer’s details has been obtained in the context of a sale of a product or a service, the customer must have been given the right to opt out at the time, at the time the information was collected and on the occasion of each further communication with the data subject for the purpose of marketing.
The issue has been that a telephone call does not fall part of the definition of electronic communication, as strictly defined in terms of POPIA, and therefore does not constitute direct marketing as provided for under POPIA. This is in my view because the telephone calls are not “stored in any network or equipment” but are rather real time communications between parties.
Now, the Information Regulator has confirmed that “a decision to classify a telephone as part of the definition of electronic communications has been taken”. As such, telemarketing would fall within the ambit of what is covered in terms of section 69 of POPIA, and telemarketers would have to follow the consent process as stipulated therein. How this argument will play out will be very interesting. We are certainly looking forward to it, and of course the pushback that will ensue from telemarketing companies.
Contact us for more good, clear, precise advice.
[1] This refers to a scenario where one approaches a data subject, either in person or by mail or electronic communication, for the direct or indirect purpose of –
(a) promoting or offering to supply, in the ordinary course of business, any goods or services to the data subject; or
(b) requesting the data subject to make a donation of any kind for any reason;.
[2] This means any text, voice, sound or image message sent over an electronic communications network which is stored in the network or in the recipient’s terminal equipment until it is collected by the recipient.
[3] This refers to the person to whom Personal Information relates.
