Big changes for spam messages in South Africa

South Africa’s new rules on direct marketing have expanded the scope of electronic communications, which includes telephone calls, push notifications and cookies.

The Information Regulator released a guidance note on direct marketing under the Protection of Personal Information Act 4 of 2013 (POPIA) in December.

The Informationation Regulator said that the Guidance Note is non-binding, which guides responsible parties conducting direct marketing.

Data subjects expect companies to comply and challenge them if their personal information is handled in a way that does not comply with the Information Regulator’s recommendations.

Organisations have also been cautioned to consider their direct marketing approaches and ensure that they comply with POPIA and the Guidance Note’s requirements.

Tayyibah Suliman and Sadia Rizvi from Cliffe Dekker Hofmyer said that the Guidance Note intends to assist responsible parties in the interpretation of POPIA regarding direct marketing.

However, it also expands the ambit of POPIA expands the ambit of POPIA.

Section 69 of POPUA regulates direct marketing restrictively for any direct marketing in the form of electronic communication, such as e.g. emails and SMSes.

Data subjects will have to “opt-in” to the processing of personal information.

The responsible party will also need the consent of the subject before sending direct marketing communication to any data subject.

Moreover, the responsible party can only approach the data subject once to obtain consent.

If the data subject is an existing customer of the responsible party, it must allow the customer to object to the processing of their personal information.

The responsible party will only send direct marketing communication to the customer if the responsible party obtained the information during a sale.

The customer also requires a reasonable opportunity to object to the processing.

The Guidance Note mentions two types of direct marketing: direct marketing via non-electronic communications and direct marketing by means of electronic communications.

These two types of direct marketing entail different regulations.

The experts said that “electronic communication” is any message sent over an electronic communications network, stored in the network or recipient’s terminal equipment.

Notably telephone calling, such as Voice over Internet Protocol (VoIP), is considered an electronic communication.

Other methods of electronic communication include push notifications, direct messaging on social media platforms and the use of cookies,

“The Guidance Note also clarifies how direct marketing can be conducted without the data subject being a customer,” said the experts.

“Consent must be obtained before sending the communication, using Form 4 – Application for consent of a data subject.”

If a customer was not asked about consent about marketing specifically, it cannot be deemed that the customer gave consent.

All further communications sent must also contain the prescribed information under section 69(4) of POPIA.

A database of consumers who have withheld their consent must also be kept by the responsible party.

“Reference to VoIP technology under the Guidance Note has expanded the scope of electronic communications, including telephone calls, push notifications, direct messaging and cookies,” said the experts.

“This broadens compliance, as marketers must embed consent and opt-out mechanisms in other direct marketing activities.”