I have purchased electronic products from a local store. They asked me for my contact details, supposedly for warranty purposes. Now they keep sending me SMSs and emails to market their products. Surely, they must first ask?
The Protection of Personal Information Act 4 of 2013 (“Popi”) aims to protect your constitutional right to privacy by ensuring that your personal information is processed in a manner that ensures its confidentiality, and that your privacy is respected.
Although the act has not yet come fully into operation, it is just a matter of time.
Under Popi, consent plays an important role. On the one hand, consent is required to ensure that your personal information is protected and that individuals or entities (“responsible parties”) do not process your personal information without your consent.
It also aims to ensure that a responsible party cannot market their products or services directly to you if you have not consented to it.
Section 69 of Popi deals with consent for direct marketing purposes by way of unsolicited electronic communications such as automatic calling machines, SMSs or electronic mails. It determines that if you are not the responsible party’s customer and you have not previously withheld consent, the responsible party has a once-off opportunity to send you a request for your express consent to allow them to use your information for direct marketing purposes.
This is usually a message informing you about products or services the responsible party would like to market, and which requests you to consent thereto. This once-off message should not be of a marketing nature, but merely of an informative nature.
Once you consent or opt in, the responsible party will be entitled to use your information for direct marketing purposes within the consent’s parameters. You should, however, be able to opt out at any time.
Section 69(2)(b) requires that a responsible party obtain your consent in the manner and form prescribed by the Popi regulations.
Such a consent document should, among other things, draw attention to the provisions of section 69 of Popi, indicate what the terms “processing” and “personal information” mean, stipulates that your consent is obtained in relation to the goods or services specified in the document, as well as stipulate that your consent is obtained in respect of each means of electronic communication the responsible party intends to use for direct marketing.
If you do not give express consent, it could be implied by you being a customer and therefore interested in learning more about the responsible party’s products or services.
The responsible party may only use your personal information for marketing purposes (1) where they obtained it in the context of a sale of a product or rendering of a service, (2) for the purpose of direct marketing of the responsible party’s own similar products or services and (3) where you have been given a reasonable opportunity to object (free of charge and without unnecessary formalities).
In your situation it could be argued that the store would be allowed to use direct marketing if you are a customer, but that they must afford you the opportunity to reject it if you do not wish to get direct marketing messages from them.
– Veruska van Wyk, candidate attorney, Phatshoane Henney Attorneys