The Information Regulator has tabled the Protection of Personal Information (POPI) Regulations in Parliament on 03 December 2018 and the Regulations were published in the Government Gazette on 14 December 2018.
The new POPI regulations have an impact on processing personal information for purpose of direct marketing. Regulation 6 stipulates that a responsible party who wishes to process personal information of a data subject for the purpose of direct marketing by electronic communication, must in terms of Section 69(2) of the POPI Act, submit a request for written consent to that data subject on Form 4.
It should be noted that is only for direct marketing by electronic communication to new potential clients and not to current clients as per Section 69 of the POPI Act.
Form 4 sets out the details of the application for the consent from the data subject. It must:
- Identify the data subject (name of the data subject).
- Identify the responsible party and provide their contact details (name, address and contact details).
- Identify the person designated to sign for the responsible party and signature of such a person.
- Enable the data subject to consent by signature to receive direct marketing for specified goods or services by specified methods of electronic communication.
This means that consent must be in writing, all the parties must be identified and it must be signed by the responsible party and the data subject.
This is a concern for direct marketers that want to advertise to new prospectus clients by using electronic communication as a marketing method.
What are the practical implications of Regulation 6 and Form 4?
The wording of Regulation 6 and the definitions of the POPI Regulations assist with this:
Submit a request – The definition of submit means submit by data message, electronic communication, registered post, electronic mail, facsimile, and personal delivery.
Written consent – The definition of writing refers to Section 12 of the Electronic Communication and Transaction Act (ECTA) is in any form of writing, including in the form of a data message that is accessible in a manner usable for subsequent reference.
Form 4 – The definition of form includes forms in the regulations and any form which is substantially similar to the forms (“Form 4”) in the regulations.
Data Message – The definition of a data message refers to Section 1 of ECTA that is data generated, sent, received or stored by electronic means and includes voice, where the voice is used in an automated transaction and a stored record.
Signature – The definition of a signature includes an electronic signature and refers to Section 1 of ECTA that includes an electronic signature which means data attached to, incorporated in, or logically associated with other data and which is intended by the user to serve as a signature.
The written consent must, therefore, be made up of a data message for record purposes in any form with similar details of Form 4 and both parties must sign the consent but any type of signature can be used that will identify the parties. A signature could be a data recording that a data subject clicked on, ticked a box, agreed to terms and conditions or consented over a recorded voice call which is intended by the user to serve as a signature.
Therefore, the application to consent for direct marketing by electronic communication to potential new clients must be obtained in a form similar to Form 4 that must be recorded in a data message and signed by both parties that may include electronic signatures.
ABOUT THE AUTHOR
Werner Brückner is the Provincial Manager for SEESA Consumer Protection & POPI at the Cape Town office. He obtained his LLB degree cum laude from the University of Pretoria in 2002, after which the attended School for Practical Legal Training at the University of Pretoria. He is an admitted attorney, notary, and conveyancer of the High Court of South Africa. Prior to joining SEESA Consumer Protection & POPI in 2010, he worked as a SEESA Labour Legal Advisor in Cape Town since 2004.