On 04 December 2024, the Information Regulator (“Regulator”) published the long-awaited Guidance Note on Direct Marketing (“Guidance Note”) in terms of the Protection of Personal Information Act 4 of 2013 (“POPIA”).

The stated purpose of the Guidance Note is to guide companies, i.e. responsible parties, particularly direct marketers, on how to comply with POPIA when processing personal information of data subjects for direct marketing purposes.

The Guidance Note comes about at a time when the direct marketing landscape in South Africa has undergone significant developments and increased activity in recent months gone by in that –

• the Regulator issued its first enforcement notice against an entity called FT Rams Consulting (“FT Rams“) for non-compliance with the direct marketing provisions of POPIA in that FT Rams refused to honour opt-out requests from a data subject;
• the Chairperson of the Regulator remarked that a telephone call constitutes an electronic communication and thereby falls within the ambit of section 69 of POPIA; and
• the Department of Trade, Industry and Competition published draft amendments to the regulations under the Consumer Protection Act 68 of 2008 (“CPA“) which proposed amendments aim to improve the operational aspects of the CPA regulations by outlining the procedures regarding when, who, how, and where individuals can register a pre-emptive block and the establishment of an opt-out registry for direct marketing purposes.

The Guidance Note details the legislative framework applicable to the processing of personal information for direct marketing purposes in terms of POPIA and, from this premise, provides that POPIA “draws a distinction between two types of direct marketing” namely –

• direct marketing other than by means of unsolicited electronic communication. This is explained in the Guidance Note as direct marketing by means of unsolicited “non-electronic” communications. Examples include direct marketing by means of post or hand-delivered mail, in person and/or letterbox drops distributed to an identified address in a specific area; and
• direct marketing by means of unsolicited electronic communication. Examples include direct marketing by means of telephone, automatic calling machines, facsimile machines, SMSs and/or email.

Direct marketing other than direct marketing by means of unsolicited electronic communication

In relation to direct marketing by non-electronic means, the Guidance Note provides that such direct marketing can be justified on the basis of legitimate interests as set out in section 11(1)(d) and/or (e) of POPIA. To the extent that a responsible party wishes to rely on legitimate interests as a means of processing, the Guidance Note provides that –

• the legitimate interest of the data subject, responsible party and/or third party must be established;
• the reliance on legitimate interest is not automatic. The onus is on the responsible party to justify the use of legitimate interests as the relevant basis for the processing of personal information;
• to rely on legitimate interest as a lawful basis, the responsible party must undertake the following three (3) stage assessment –
  • the first assessment relates to the purpose test that helps to objectively identify a legitimate interest and entails a consideration of, amongst others, the purpose and benefit of the processing;
  • the second assessment relates to employing the necessity test to consider the connection between the processing and the interests pursued as well as the stated purpose;
  • the third assessment relates to the balancing test in terms of which the responsible party should balance the legitimate interest of that responsible party against the interests and rights of the data subject.
• the legitimate interest assessment must be conducted before the processing activity commences;
• a responsible party must give effect to a data subject’s right to object; and
• a responsible party who fails to establish a legitimate interest for the processing of personal information cannot rely on the legitimate interest means of processing as set out in section 11(1)(d) and/or (e) of POPIA.

Direct marketing by means of unsolicited electronic communication in terms of section 69 of POPIA

In relation to direct marketing by means of unsolicited electronic communication in terms of section 69 of POPIA, the Guidance Note provides that methods of direct marketing by means of unsolicited electronic communication include telephone, email, short message service (SMS), automatic calling machines, facsimile machines (fax), direct messaging in Instagram or LinkedIn, push notification and/or use of cookies.

Of note is that the Regulator views that live telephone calls constitute a form of electronic communication and justifies this conclusion as follows –

“7.1.1 It is the view of the Regulator that telephone calling is electronic communication by virtue of telephone communications technology having become digital over time. Telephone calls predominantly use VoIP (Voice over Internet Protocol) which is packet-switched telephony rather than the public-switched telephony previously used for analogue communication.

7.1.2 The analogue voice is encoded into a digital stream that is divided into small data packets which are labelled according to their order. These voice data packets are transmitted using real-time protocols during a telephone call are stored on the network. The voice data packets are re-assembled to match the original order of transmission, error correction is applied to digital data stream to compensate for the delay caused by packet re-assembly and finally relayed to the recipient’s terminal equipment to be decoded into analogue voice for consumption upon the recipient’s acceptance of the call.”

The Guidance Note provides information about engaging in direct marketing by means of unsolicited electronic communication where a data subject –

• is not a customer which is regulated by section 69(1)-(2) of POPIA which provides that consent must be obtained in the prescribed manner and form before engaging in direct marketing by – the so-called opt-in regime. Of note is that the Guidance Note provides that such consent must be obtained by making using of the prescribed Form 4 or any form which is substantially similar to Form 4. Further, this form requires –
  • a data subject to consent to receive direct marketing messages through unsolicited electronic communication;
  • the responsible party to specify the goods or services he, she or it intends to market to the data subject through unsolicited electronic communication. This will enable the data subject to give voluntary, specific, and informed consent; and
  • data subject to specify the method of communication which the responsible party can use to send the communication to him or her. The responsible party must adhere to the method chosen by the data subject to send him or her direct marketing messages.
• is a customer which is regulated by section 69(3) of POPIA which provides the circumstances under which a responsible party can engage in direct marketing activities for existing customers. To this end, the Guidance Note provides that per the requirements of section 69(3) of POPIA –
  • the responsible party must have obtained the contact details of a data subject in the context of a sale of a product or service, for example, a data subject opens an account at a retail store which sells clothing, and the responsible party records her contact details for the purpose of opening the account;
  • the purpose of the direct marketing must be to market a responsible party’s similar products or services. For example, in a clothing retail store, similar products include shoes, belts etc. A funeral insurance cover will not constitute a similar product; and
  • a data subject must be given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formalities at the time the information was collected and on the occasion of each electronic communication with a data subject for the purpose of marketing if a data subject has not initially refused such use.

The Guidance Note further provides that a direct marketer must disclose its identity and contact details to which the recipient may send a request that such communications cease in respect of “any communication” sent for purposes of direct marketing as provided for in section 69(4) of POPIA.

The pre-emptive block in terms of section 11 of the CPA

The Guidance Note provides that even if a data subject has not registered a pre-emptive block, a responsible party must still comply with the requirements in section 69(1) and (2) of POPIA and obtain consent before sending a data subject direct marketing messages through unsolicited electronic communication.

Compliance with the eight conditions for the lawful processing of personal information

The Guidance Note provides that a responsible party who processes personal information for purposes of direct marketing must also comply with all the conditions for the lawful processing of personal information and other applicable provisions of POPIA.

Lead generation and the sharing of personal information

The Guidance Note recognises that lead generation is not defined by POPIA, but is a direct marketing practice involving the collection of personal information in terms of which –

• leads are identified through various ways including sign-up forms, pop-ups, landing pages, and social media posts;
• these methods of identifying leads enable the collection of personal information and the generation of lists of contact details of data subjects which are shared (either sold or rented) amongst responsible parties.

The Guidance provides that such practice must comply with –

• section 15 of POPIA which sets out the requirements for further processing;
• section 18 of POPIA which sets out the notification requirements when collecting personal information; and
• section 71 of POPIA which sets outs the requirements for engaging in profiling and automated processing (If applicable).

Comment and conclusion

It is important to remember that the Guidance Note is not the law. Indeed, the legal effect of the Guidance Note is that it is advisory in nature. The Guidance Note itself recognises this and provides that the “provisions of POPIA and the Regulations will prevail over the Guidance Note in the event of any inconsistency.“

Nevertheless, the Guidance Note cements the Regulator’s view that a telephonic call is a form of electronic communication for purposes of section 69(1)-(3) of POPIA even though one can argue that live telephonic calls do not fall within the ambit of an electronic communication which section 1 of POPIA defines as “any text, voice, sound, or image message sent over an electronic communications network which is stored in the network or in the recipient’s terminal equipment until it is collected by the recipient“.

Written by Ahmore Burger-Smidt, Head of Regulatory and Dale Adams, Senior Associate; Werksmans