Section 69 of the Act outlaws direct marketing by means of any form of electronic communication unless the data subject has given their consent.

Such an electronic communication obviously includes emails, SMSs and automatic calling machines.  A subject can only be approached once to obtain such a consent. Once such consent is refused, it is refused forever.

Slightly different rules apply if the subject is a customer.  Here the customer’s contact details must have been obtained in the context of the sale of a product or a service, the direct marketing by electronic communication can only relate to the suppliers own similar products or services, and the customer must have been given the right to opt out at the time that the information was collected and each time such a communication is sent.

The Act covers Direct Marketing restrictions in great  detail and should be consulted before any direct marketing campaign is considered.

The Act is set to have the most impact on direct marketing — especially through SMS and email channels. Up until now, most of this marketing has been ‘opt-out’, where consumers receive promotional messaging and can choose to no longer receive these messages.

However, now that POPI is in place, direct marketing will have to become ‘opt-in’, where consumers will have to actively agree to receive promotional messaging.

Essentially, this means that unsolicited direct marketing via electronic channels will become opt-in only.

The only exceptions to this, according to the Act, is if the existing consumer has already given their personal information to the supplier in the context of a sale for the purpose of direct marketing. Also, if the consumer “has been given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality”.

Organisations should verify that their method of obtaining “opt-in” complies with the POPI Act. In many instances, the “opt-in” or “opt-out” options provided for gaining consent from data subjects could be viewed as an issue. “Consent” means that data subjects gave a voluntary, specific and informed expression that their data may be processed, and thus companies should not gain consent by default (opt-in). In all instances, data subjects must be given the choice and it is widely considered best practice for organisations to offer “opt-out” versus automatically “opt-in”.

The following criteria can be used for sending marketing collateral to existing customers:

• Organisations must ensure that they have obtained the contact details of the customer in the context of the sale and their product or service;
• For the purpose of direct marketing of their own similar products or services; and
• They must ensure that they have given their customers a reasonable opportunity to object (opt-out) at the time when their information was collected and on the occasion of each communication with the customer for the purpose of marketing.

How is this good news for direct marketing?

As a direct marketer; at first glance; it may appear that there is a finite timeline to your marketing efforts; but in reality the POPI Act does not prohibit direct marketing. POPI is rather regulating the way in which direct marketing is done in an effort to ensure that the consumer is protected.

This just means that your efforts as a direct marketer are going to have to be far more focussed and deliberate – this focus will translate into your efforts being far more successful as the pool that you are marketing to will have been reduced by taking away the irrelevant contacts. In short – POPI can help you in building a far more customer-focussed business.

Direct marketers can use the following POPI Act implementation guide to initially check your compliance:

• Conduct an audit of the processes used to collect, record, store, disseminate and destroy personal information.
• Check what interventions are in place to prevent personal information from being lost or damaged, or unlawfully accessed.
• Ensure that the purpose of the information collected in defined in the gathering and processing phases.
• Ensure that within your process; steps are taken to notify the individual whose information is being processed and also for what purpose.

As a general rule; direct marketers should be able to accommodate data subjects’ requests to know which third parties have access to their information.