‘Direct marketing’ refers to the practice of approaching an individual, either in person, by post, or electronic communication, to promote or offer to supply any goods or services, or to request an individual to make a donation of any kind.
To date, the Consumer Protection Act (CPA) and the Electronic Communications and Transactions Act (ECTA) have adopted an ‘opt-out’ approach when it comes to direct marketing. This means that marketers do not require a recipient’s prior consent to send her/him direct marketing communications, but must put processes in place to allow the recipient to opt-out of the direct marketing or to unsubscribe from the relevant mailing list.
This option must be included in the marketing communication. If a recipient informs the sender that s/he does not wish to receive any direct marketing material, then the sender may not send any further communications to that person.
POPIA regulates electronic direct marketing including marketing by way of automatic calling machines, fax, SMS and email. The provisions of PoPIA that deal specifically with direct marketing do not deal with communications sent by post or telephone calls that are not automatic calls.
Moving away from the approach under ECTA, PoPIA has created an ‘opt-in’ requirement when it comes to direct marketing via electronic communication. This means that the prior consent of the recipient will be required to send her/him direct marketing communications.
Marketers may only approach a recipient once, on an unsolicited basis, in order to request this consent. If a recipient ‘opts-in’, marketers are still required to put in place processes to allow the recipient to opt-out of the direct marketing during, or within a reasonable time after receiving, the marketing communication. As such, there should still be an ‘unsubscribe’ or ‘Stop’ option.
The one exception to the opt-in requirement is for direct marketing communications sent to existing customers. This exception only applies where (i) the recipient’s contact details were obtained in the context of the sale of a product or service; (ii) the direct marketing will only be for purposes of selling similar products or services; and (iii) the recipient is given a reasonable opportunity to opt-out at the time when her/his details are first collected, and on each subsequent occasion when the details are used for direct marketing purposes.
A request for consent from a recipient must be made in the prescribed form published in terms of the PoPIA Regulations. The form can be provided and signed electronically. However, it is fairly impractical and not particularly user-friendly.
It would be preferable if data subjects could simply tick a box to opt-in, which would be sufficient to indicate consent in the ordinary course. Companies that use electronic direct marketing are probably going to need to obtain guidance from the data protection authority, the Information Regulator, and monitor how strict the Information Regulator is going to be about use of the prescribed form, or whether the Information Regulator will allow consent to be obtained in a more user-friendly way.
A transitional period has been given for businesses to comply with PoPIA. Currently, the opt-in requirements under PoPIA and the opt-out requirements under ECTA apply in parallel. From 30 June 2021, the opt-out provisions in ECTA will be repealed and companies will only be allowed to follow the opt-in approach when using individuals’ details for marketing by way of email, SMS, automatic calls, WhatsApp and similar electronic platforms.
The direct marketing provisions of PoPIA will only apply to unsolicited electronic communications. Accordingly, companies may still cold call an individual or send her/him mail for direct marketing purposes without having to obtain their prior consent.
However, they must still comply with the general provisions of PoPIA given that, by using individuals’ personal information and contact details to send them marketing communications, they are processing personal information.
As such, they will need to ensure that their use of personal information is justified on the basis of customer consent, where it is necessary to enter into or fulfil a contract, the legitimate interests of the individuals that they are marketing to, or their legitimate interests. They will also need to ensure that the ‘opt-out’ principles provided for in the CPA as set out above are complied with.
Companies must ensure that all direct marketing, whether in person, by post or electronic communication, is done by obtaining recipients contact details lawfully and in compliance with the provisions of PoPIA. The CPA further stipulates certain time periods for direct marketing. In this regard, companies may not contact a recipient for purposes of direct marketing at home on Sundays and public holidays, on Saturday before 9am and after 1pm and on all other days between the hours of 8pm and 8am the following day, unless the recipient has expressly agreed, in writing, to receive direct marketing communications during these times.
Any direct marketing communication should contain the details of the identity of the sender and an address or other contact details to which the recipient may send a request that such communications cease.
Will robot calls and SMSs for direct marketing purposes become a thing of the past? Well, individuals are certainly expected to receive fewer electronic marketing communications having regard to the recently implemented provisions of PoPIA.
