The implementation is of the Protection of Personal Information Act, No. 4 of 2013 (POPI) is proceeding apace.
A five-member information regulator (IR) has been established, with ten candidates being nominated and the former IEC chairman Advocate Pansy Tlakula recommended as its chairperson. Once the National Assembly approves this appointment, the IR will start work – and this is likely to happen very soon.
So, what are the implications of POPI for business, marketing and research in particular? Here are five ways in which marketing and marketing research are likely to be affected:
ONE: Probability sampling will be more difficult – and expensive
Probability sampling is defined as sampling where there is a known probability that a particular item out of a population of items will be selected. In layman’s terms, you have to sample from a list. Of course it could be a list of lists, and other complex designs are possible, but ultimately the sampling design will be under greater scrutiny than ever before under POPI. The sampling design of the once influential but now departed AMPS survey may have been the last true local random probability sampling. Its replacement will be consumer research panels which, by definition, are lists of people who have agreed to participate in market research.
These would have to be well managed within the Act’s constructs. Most importantly, consent of the individual is paramount.
I believe the question of representativeness and sampling is going to be the source of much hand wringing, while the importance of probability sampling itself will diminish and the importance of longitudinal measurement which produces facts, not estimates, will gain ascendancy.
TWO: Questionnaire design will have to be simpler and more focused – no ‘race’ questions
Consent has to be informed, and by law, refusal to a survey or a question within a survey will be the prerogative of the respondent. So, conducting surveys will become much more difficult, because interviewers would have to tell respondents in advance that they have a legal right to withhold any information they choose to. Moreover, the Act specifically addresses the issue of content and purpose of the information that is being collected. The information must be collected for valid reasons, and the right of judging validity lies with the respondent.
This means that ‘waffly’ questionnaires, interminable grids and even compulsory questions will harden the intellectual arteries of respondents and affect their response rate – and data quality will consequently drop.
In particular, a few words here about the race question that appears in almost every survey, and which requires respondents to put themselves into one of four race categories: coloured, white, Asian, or black. If I had my way, this question would be banned on scientific grounds, because there is no clear definition of how these categories are defined. So, on what basis does a respondent answer this question? Making it a compulsory question is even worse.
The presumptuous right assumed by researchers to ask such bad questions are likely to result in bad data, in addition to creating legal conundrums.
THREE: Processing – especially ascription and fusion – will have to be more transparent
It is possible to infer data about a person that would require the consent of the owner of the information under the Act, even if that person does not know that it is being done. For example, using sophisticated ascription modelling on a list with email addresses and a telephone number, it is possible to infer province, gender and even race for a portion of the population in the list. These processes may become illegal, if the IR chooses to interpret the Act in such a way. In fact, segmentation itself may come under scrutiny in that a person may be able to say that they do not want to be classified by LSM. It’s not just about using a variable that identifies an individual, and that has been the loin cloth of market research for so long. It’s now about the right of the individual to know what data you have gathered about them, and telling you to delete it.
FOUR: Data management is going to cost money
Since POPI treats a person’s data as their private property, it specifically specifies that the data must be accessible to the owner of the data – the individual. The implications of this are huge for corporations, researchers and indeed every entity with clients. Doctors will be obliged to share their information about a patient with that person; for every customer complaint record that a company keeps, it will need to make information about a customer who made the complaint accessible to that person.
But wait, there’s more… The implications are indeed huge, because the Act determines that it is the responsibility of the holder of the data to maintain it, to protect it and to ensure that it cannot be misused. Essentially, this means that data sticks, flash drives and other portable storage, including cell phones, will have to be kept clean of any individual’s data. All this may have to be put in safe storage while a person has access to private data. Imagine a day at the office without your cell phone! If the law were to be applied to the letter, that day may be nigh.
FIVE: Penalties will be severe
The penalties for infringement are severe, running into tens of millions of rands. The smaller the company, the more expensive the precautions and the greater the relative penalties will have to be borne. Google, Facebook, and other social media will also be targeted with enormous ramifications. These battles are already ongoing in the US, and they are about to begin in South Africa.
This new future is motivated by the intent to safeguard people’s privacy and their right to protect their information – but for marketing researchers, POPI indeed creates a minefield of issues to navigate, and it is sure comprehensively to affect the whole industry in ways that will require a rethink on the way that it conducts its business.
Panel Services Africa (PSA) has implemented many changes to their systems, which have required intensive system development. In particular, PSA hosts the panel management and survey software and data in the UK which ensures that the highest international security standards are observed. All of PSA’s TellUsAboutIt consumer panellists have sensitive private information stored on the PSA system as part of the explicit contract between PSA and each panellist. This trust is evidence of the mutual respect that is essential to ensure quality data from an online panel.*Note that Bizcommunity staff and management do not necessarily share the views of its contributors - the opinions and statements expressed herein are solely those of the author.*