With the implementation of the majority of the provisions of the Protection of Personal Information (POPI) Act on Wednesday, 1 July 2020, many businesses and consumers are eager to understand how POPI will impact on, and potentially change, the parameters of direct marketing.

'Direct marketing' refers to the practice of approaching an individual — either in person, by post, or electronic communication — to promote or offer to supply any goods or services or to request an individual to make a donation of any kind.

To date, the Consumer Protection Act (CPA) and the Electronic Communications and Transactions Act (ECTA) have adopted an 'opt-out' approach when it comes to direct marketing.

This means that marketers do not require a recipient's prior consent to send her / him direct marketing communications but must put processes in place to allow the recipient to opt-out of the direct marketing or to unsubscribe from the relevant mailing list.

This option must be included in the marketing communication. If a recipient informs the sender that s / he does not wish to receive any direct marketing material, then the sender may not send any further communications to that person.

Direct marketing using robot calls, SMSs or email

POPI regulates electronic direct marketing including marketing by way of automatic calling machines, fax, SMS and email. The provisions of POPI that deal specifically with direct marketing do not deal with communications sent by post or telephone calls that are not automatic calls.

Moving away from the approach under ECTA, the Act has created an 'opt-in' requirement when it comes to direct marketing via electronic communication. This means that the prior consent of the recipient will be required to send her / him direct marketing communications.

Marketers may only approach a recipient once, on an unsolicited basis, in order to request this consent. If a recipient 'opts-in', marketers are still required to put in place processes to allow the recipient to opt-out of the direct marketing during, or within a reasonable time after receiving, the marketing communication.

As such, there should still be an 'unsubscribe' or 'STOP' option. The one exception to the opt-in requirement is for direct marketing communications sent to existing customers. This exception only applies where:
  1. the recipient's contact details were obtained in the context of the sale of a product or service
  2. the direct marketing will only be for purposes of selling similar products or services, and
  3. the recipient is given a reasonable opportunity to opt-out at the time when her / his details are first collected and on each subsequent occasion when the details are used for direct marketing purposes.
A request for consent from a recipient must be made in the prescribed form published in terms of the POPI regulations. The form can be provided and signed electronically. However, it is fairly impractical and not particularly user-friendly. It would be preferable if data subjects could simply tick a box to opt-in, which would be sufficient to indicate consent in the ordinary course.

Companies that use electronic direct marketing are probably going to need to obtain guidance from the data protection authority, the Information Regulator, and monitor how strict the Information Regulator is going to be about use of the prescribed form; they should also check if the Information Regulator will allow consent to be obtained in a more user-friendly way.

A transitional period has been given for businesses to comply with POPI. Currently, the opt-in requirements under the Act and the opt-out requirements under ECTA apply in parallel.

From Wednesday, 30 June 2021, the opt-out provisions in ECTA will be repealed and companies will only be allowed to follow the opt-in approach when using individuals' details for marketing by way of email, SMS, automatic calls, WhatsApp and similar electronic platforms.

Direct marketing using post and phone calls

The direct marketing provisions of POPI will only apply to unsolicited electronic communications. Accordingly, companies may still cold call an individual or send her / him a mail for direct marketing purposes without having to obtain their prior consent.

However, they must still comply with the general provisions of POPI given that, by using individuals' personal information and contact details to send them marketing communications, they are processing personal information.

As such, they will need to ensure that their use of personal information is justified on the basis of customer consent, where it is necessary to enter into or fulfil a contract, the legitimate interests of the individuals that they are marketing to, or their legitimate interests.

They will also need to ensure that the 'opt-out' principles provided for in the CPA as set out above are complied with.

General requirements for direct marketing

Companies must ensure that all direct marketing, whether in person, by post or electronic communication, is done by obtaining recipients contact details lawfully and in compliance with the provisions of POPI.

The CPA further stipulates certain time periods for direct marketing. In this regard, companies may not contact a recipient for purposes of direct marketing at home on Sundays and public holidays, on Saturday before 09:00 and after 13:00 and on all other days between the hours of 20:00 and 08:00 the following day, unless the recipient has expressly agreed, in writing, to receive direct marketing communications during these times.

Any direct marketing communication should contain the details of the identity of the sender and an address or other contact details to which the recipient may send a request that such communications cease.

Will robot calls and SMSs for direct marketing purposes become a thing of the past? Well, individuals are certainly expected to receive fewer electronic marketing communications having regard to the recently implemented provisions of POPI.

For more information, visit www.bowmanslaw.com. You can also follow Bowmans on Twitter.