Part 5

What does POPIA say about Direct Marketing?

Firstly we need to be clear on what is meant by Direct Marketing in POPIA as it’s a little different to the definition in the CPA. Remember, POPIA specifically deals with Direct Marketing by means of unsolicited electronic communication. POPIA defines "electronic communication" as “any text, voice, sound or image message sent over an electronic communications network which is stored in the network or in the recipient's terminal equipment until it is collected by the recipient.” Direct Marketing is also defined in POPIA as approaching a data subject, either in person or by mail or electronic communication, for the direct or indirect purpose of:

1. promoting or offering to supply, in the ordinary course of business, any goods or services to the data subject or
2. requesting the data subject to make a donation of any kind for any reason.

What is ‘electronic communication’, as far as POPIA is concerned?

POPIA is a little vague about this, saying only ‘any form of electronic communication, including automatic calling machines, facsimile machines, SMSes or e-mail’. POPIA does not mention things like sending messages on WhatsApp, Telegram or similar messaging Apps, or Direct Messages within social media. A conservative approach would be to include all contact by electronic means for purposes of Direct Marketing as "unsolicited electronic communication".

Can MBR’S and dealerships still phone people after POPIA is in place, or not?

Engaging in Direct Marketing is prohibited, unless the data subject has given their consent, or the data subject is an existing customer of yours. Those seem like two separate things, so let us deal with them separately.

If someone is an existing customer of a Dealership or MBR, then they can market directly to them (using unsolicited electronic communications')– under certain conditions. Firstly, you must have gotten their details in the context of a previous sale. Secondly, the marketing must be related to your own (not another company’s) similar products or services to the one you got their details for originally. And thirdly, you must have given the data subject a reasonable opportunity to object to the use of their details for marketing, when you collected the details and every time you market to them thereafter. So that means if you have an existing client because you helped them buy or sell a vehicle, you may contact them to see if they are interested in buying or selling a vehicle through you again. And each time you contact them you must give them fair opportunity to tell you they do not want to be contacted.

Each company will have to evaluate all of its 'databases' that it has collected over the years and determine how, as an organisation, it will decide on who falls within the category of ‘existing customers’.

The second category – in other words, when someone has NOT been a customer previously– what does POPIA require in those cases, for Direct Marketing to not be prohibited?

You need to get consent from that Data Subject. After POPIA comes into effect, you are allowed to approach each Data Subject once only, if they have not previously withheld their consent, to obtain their consent for Direct Marketing. It would be most wise to use that once-only approach to gain their consent in the right way for Direct Marketing, because if you do not get their consent during that one approach, you are not allowed to Direct Market to them again.

POPIA outlines that consent must be obtained ‘in the prescribed manner and form’. There is an example of the type of form to be used, in the regulations to POPIA, called Form 4. It is not yet clear whether you must use that form in its exact format, or whether you are allowed to design your own form, if the substantive requirements of Form 4 are present. It is important to make sure that the customer understands what they are consenting to, by using a clear and unambiguous form. The requirements are quite long so we will go through them step by step and important parts are the following:

1. The consent obtained from the customer must be voluntary, specific, and informed. This has led to a debate around whether POPIA requires 'opt in' or 'opt out' consent from the customer. 'Opt in' consent is usually where the customer has to take a positive step to indicate their consent (such as ticking a box or entering a website). 'Opt out' is generally where the customer will receive the marketing material, until they choose not to. The conservative approach from a POPIA perspective, is that the consent for Direct Marketing must be 'opt in' to make it clear that the customer has made the positive choice to receive the marketing material.
2. The Direct Marketing subjects must be specified. You do not have to name the precise service that you are aiming to market, but it should not be too broad to interpret.
3. The details of the marketer should be recorded so it is clear who the Data Subject is giving their permission to for purposes of the Direct Marketing.
4. The Data Subject should have the right to choose which methods of communication they are happy with and which they don’t want.

Do you have to get this consent in a written format?

A form 4 consent should be in place and the onus is on the person doing the Direct Marketing to evidence that they have this opt-in consent. So it is highly recommended to have something that you can evidence.

Is there anything else I need to know about Direct Marketing under POPIA?

The CPA requirements still stand. So, even if you have consent to market to someone, it still needs to be within the prescribed hours, you still need to check whether they have opted out before, and you still need to give an option to ‘unsubscribe’ to the contact.