New act aims to protect against spam marketing

Danie Strachan, partner in the corporate and commercial section of law firm Adams & Adams, says that the primary purpose of the Popi Bill is to ensure that individuals' personal information cannot be used indiscriminately. Such personal information has to be used within the framework of guidelines laid down in the act.

There is also a potential impact on international businesses, says Strachan, in that the transfer of information out of SA could be subject to various data protection measures in the future. This is in line with international best practice, he says - and though relatively new in the African context, seeks to bring SA on par with the rest of the developed world in regulating the use of personal information.

The Popi Bill is still before Parliament and some of its provisions are still being debated and finalised. One of these is the "opt in/opt out" issue relating to the transmission of marketing material and the rights of individuals to either consent to or reject the transmission of such material to them.

In a sense, Strachan says, Popi represents a further legislative attempt to regulate direct marketing and spam, by determining the circumstances in which such promotional material can be communicated to individuals.

Bureaucratic burden

He says one of the concerns about the bill in its present form is the wide definition of what constitutes personal information. This may range from individuals' names and occupations through to their blood types and even personal preferences.

This could well add to the bureaucratic burden consumers already face, Strachan says, in that it could involve a measure of form-filling and similar verification processes in regulating individuals' position with regard to Popi.

Strachan says a potential concern is the issue of how the new provisions could be enforced - and the extent to which the random use of personal information such as ID documents, for example, could still be open to abuse or even fraud.

Much of the act deals with standards and principles relating to how personal information should be processed and is subject to possible fines or penalties from the regulator in the event of contravention.

Strachan says that companies would be advised to keep records of what personal information on employees or customers they possess and may well need to undertake an initial audit to determine what kind of information they normally request and how they process and store it.

"There is also provision for liability in that the regulator may institute civil damages through the courts in instances where the protection of personal information is interfered with."

Source: Business Day via I-Net Bridge