POPI Bill could render your database worthless

As mobile marketing strategists, we are often asked by clients if we have a database. We are equally approached by companies, who want to sell us databases. In accordance with current legislation this is border-line at best and any reputable company should not engage in marketing to a database which they have not built themselves.

Law enforcement been lagging

While current legislation is already quite clear about what marketers are allowed to do and not do with databases, the enforcement of the law against offenders has been lagging. The Wireless Service Providers Association (WASPA), a self-regulatory body funded inter alia by the mobile networks has taken the lead in that it offers the public a forum to lodge complaints. However it can only act if the offender is a WASPA member. A list of complaints, offenders and the fines imposed on them can be found at www.waspa.org.za/code/complaints.php

In order to bring South Africa's data protection frame in line with international developments, necessitated by the globalised market requiring the free flow of information whilst protecting individuals' right to be left alone, by both public and private entities, government is working at updating existing legislation. In August 2009, Cabinet passed the Protection of Personal Information Bill (POPI). POPI is not law yet as the bill must still pass through Parliament and the National Council of Provinces, thus it could still be amended. It is however unlikely that the approach followed will be substantially altered.

Protecting privacy and personal info

POPI was conceived to give effect to the right to privacy by introducing measures to ensure that the personal information of an individual is safeguarded when processed. It also balances the right to privacy against other rights, such as the right to information and other important international interests. This is particularly important for the free flow of information within and across the borders of South Africa.

Two core concepts of POPI relate to the definitions of "processing" and "personal information'' (PI). The legislation will apply only to PI that is processed. Processing includes collection, receipt, recording, organisation, collation, storage, updating, modification, retrieval, alteration, use, dissemination and merging. Another core definition is that of PI, as this would determine whether a person's right to information privacy has been infringed.

Regulator's powers of investigation

Unlike WASPA, which is a private initiative, POPI contains a complaints procedure whereby any person may lodge a complaint with the regulator against any company or organisation relating to unsolicited communications, directories and automated decision-making. The regulator will have extensive powers of investigation including:

1. the right to apply to court for a warrant to enter and search premises;
   
2. the right to bring a claim for damages;
   
3. the right to issue enforcement notices.
   

Failure to comply with an enforcement notice is a criminal offence, punishable with a fine and/or up to 12 months imprisonment, except if the offence relates to obstructing the regulator. In that case the person is liable to a fine and/or up to 10 years imprisonment. It is clear that this legislation will significantly impact how companies and public bodies manage the processing of any PI held by them.

Essentially POPI can render the database of a business useless. It will make e.g. sending emails or SMS's to, and even just owning, a database illegal if it does not comply with the bill. Enforcement of the bill will be done by the regulator, aided by a special commission. Marketers are therefore well advised to start converting their existing databases and to build new databases that comply with POPI so that they are ready and prepared when the bilI becomes law in 2011.

Building legal databases

The good news is that this process is neither complicated nor expensive and companies can use their existing databases and above the line advertising to build databases that are legal, even under the new POPI Bill. With 98% of SMS's being opened versus only 5% of emails, I recommend that companies focus on building legal databases by integrating a mobile component in their existing marketing strategy.

This will create the basis to legally continue to engage their customers one-on-one and communicate their offerings.