The regulator has issued a guidance note on direct marketing as regulated by section 69 of POPIA. The regulator has noted on many occasions that it has received an increasing number of complaints about the processing of personal information in direct marketing by means of unsolicited electronic communications. In response, the regulator has said that to protect the public and stop SPAM telephone calls, if needs to develop a guidance note. The regulator’s interpretation of the law differs from the industry, so a fight is looming.
What the guidance note on direct marketing covers?
The guidance note gives guidance to responsible parties who direct market to both prospects and customers. And also to operators who process personal information for responsible parties who direct market. It will help them to interpret and practically apply section 69 of POPIA.
Different rules apply to electronic vs non-electronic direct marketing.
It distinguishes two types of direct marketing.
- Electronic. The guidance note refers to this as “direct marketing by means of unsolicited electronic communication”
- Non-electronic. This can also be referred to as physical or traditional. The guidance note refers to this as “direct marketing other than direct marketing by means of unsolicited electronic communications.”
The regulator gives guidance on several important topics.
- Physical direct marketing.
- How data subjects can object or opt out of direct marketing.
- Electronic marketing.
- How a consumer can register a pre-emptive block under the Consumer Protection Act. The DTIC has recently proposed CPA amendments to the regulations.
- How direct marketers can comply with the conditions for lawful processing.
- Sharing personal information.
- Automated decision making (section 71)
The guidance note on direct marketing give guidance on these questions.
- Is an outbound telesales call a physical or electronic communication?
- How many times can a direct marketer approach a data subject to ask for consent?
- Does a telephone call amount to an “approach” (section 69)?
- Who is a customer, and who is a prospect?
- Does consent for one channel apply to others?
- Can a direct marketer buy a lead or consumer profile for direct marketing?
- How specific must the consent be for specific goods or services?
- How does a direct marketer get consent for phone calls?
It covers many of the things the ICO covers in the ICO direct marketing code of practice, although it takes the specific South African context into account.
It gives data subjects guidance on when they should complain or not.
What this guidance note is not
It is not a code of conduct for an industry. It also does not prevent someone from developing a code of conduct on direct marketing for an industry or its members.
When was it be published? What is the timeline?
It was published on 3 December 2024. The regulator worked on this guidance note for some time—from about 2021—and there have been many steps in the process.
In June 2024, the regulator drafted a version and consulted with major industry players. The regulator considered their input. The regulator held an in-person briefing on the guidance note on direct marketing on 25 September 2024 in Johannesburg to provide feedback to those who commented on the guidance note. The regulator listened to input from attendees at that meeting but said that it had already received input and responded.
A telephone call is an electronic communication
Yes, in the regulator’s view it is. The regulator has also said that after extensive research and benchmarking, it has taken the firm position that an outbound telephone call is an electronic communication. The regulator has taken this position for many years. This means that direct marketers can only phone someone if they have the person’s consent. They can call the person once to obtain the consent.
The information regulator says they are confident that a telephone call is an electronic communication.
It appears that a fight is looming. The direct marketing industry will not accept the regulator’s interpretation and will probably sue the regulator. We expect this to be an ongoing issue for some time to come. It all revolves around the interpretation of one definition – “”electronic communication’’ means any text, voice, sound or image message sent over an electronic communications network which is stored in the network or in the recipient’s terminal equipment until it is collected by the recipient”.
What is the status of the guidance note on direct marketing?
The guidance note on direct marketing cannot contradict POPIA itself
According to the guidance note, it “assists in the interpretation of POPIA in relation to direct marketing as defined in POPIA”. It is advisory in nature and are not binding on the regulator or any other party. It does not amend or supplement the legal effect or interpretation of POPIA. If there is a conflict of meaning between POPIA (or the POPIA regulations) and the guidance note, POPIA prevails. The guidance note does not constitute legal advice.
Actions you can take
- Ensure that you direct market lawfully by joining the Michalsons data protection programme (which includes the POPIA lens) and working through the lawful direct marketing module.
- Obtain lawful consent from data subjects by asking us to help you do it correctly.
- Make sure your email marketing is lawful by getting the Michalsons Email Marketing Checklist.
- Empower yourself to properly manage and resolve with disputes with the Regulator by joining the Michalsons data protection programme and working through the resolving data protection disputes module, or by contacting us.
- Find out more by reading the guidance note itself.
