The purpose of the Protection of Personal Information Act 4 of 2013 (POPIA) is to protect the constitutional right to privacy of people by ensuring that personal information is processed in a manner that ensures its confidentiality and that a person’s privacy is respected.
Usually companies (typically the responsible party) will therefore need an individual’s (typically the data subject) consent before they can send marketing via SMS, emails or to pass the individual’s details on to another company. Consent is only necessary for direct marketing by electronic communications, it is not necessary if you direct market by physical communication, for example phone calls.
Section 69 of POPIA deals with consent for direct marketing if the direct marketing is by way of unsolicited electronic communications. It is important to note that it is not applicable to all marketing, including when you market to your existing customers or market using non-electronic means. As the responsible party, you have a once-off opportunity to send a request for consent to your potential customers (excluding potential customers who have previously withheld consent) to use their personal information for direct marketing purposes. Section 69(2)(b) requires that a responsible party obtain consent in the manner and form prescribed by the POPIA regulations.
Although the POPIA Regulations are not effective yet, Regulation 6 of the POPIA Regulations provides us with clarity around how consent should look – it states:
“A responsible party who wishes to process personal information of a data subject for the purpose of direct marketing by electronic communication must in terms of Section 69(2) of the Act submit a request for written consent to that data subject on Form 4.”
The consumer must therefore be asked for consent by submitting a written request and the consumer must then provide the written consent. The crux of Form 4 is that the company’s identity as well as the identity of the consumer must be clearly set out, the consent must be specific, and consent must be in writing. The consumer must sign the consent.
Form 4 sets out a step-by-step process for obtaining consent:
In part A, identify the data subject (name), identify the responsible party and their contact details & address. The designated person signing on behalf of the responsible party should provide their full names and designation.
In part B, the data subject gives consent to receive direct marketing of goods/services (that are specified) to be marketed by means of electronic communication (with the method also specified) and sign the consent.
“Submit” is defined as submission by:
- data message;
- electronic communication;
- registered post;
- electronic mail;
- facsimile; and
- personal delivery.
The consent is required to be a written consent. ”Written” is defined as any form of writing, including in the form of a data message that is accessible in a manner usable for subsequent reference. This means that there must be a record of the consent provided. Voice recordings (such as stating “I agree” over the phone) are also included.
“Form(s)” as referred to in the POPIA regulations, means a form referred to in the annexures to the POPIA regulations (such as Form 4) or any form which is substantially similar to that form. Therefore the form does not need to be a physical form, and can be an SMS, a pop-up notice on a website, etc.
Some frequently asked questions:
Do you need consent for telemarketing?
No – it is not deemed to be electronic marketing. You can contact a consumer via telephone without consent provided that the consumer has not opted out.
Do you need consent for email/SMS marketing?
Yes – it is electronic marketing.
Must Form 4 be used to get consent?
No – you can use another format, provided that it is substantially the same as Form 4 or it contains all the information as per Form 4.
Can a consumer give consent telephonically?
Yes – if it is saved and retrievable and the consent contains the information as set out in Form 4.