Updated guidance on direct marketing and POPIA, part one.

At long last, the Information Regulator has published its Guidance Note on POPIA and direct marketing. We did a close reading of what it said so that you don’t have to. Here’s what you need to know.

The Regulator has taken a controversial view on what they consider to be ‘electronic communication’. They have added the telephone to the list. This has important consequences, not just for marketers but for the rest of us too. Read on to discover why we welcome the Regulator’s view on issues like consent and telemarketing, but we have some reservations about the Regulator’s interpretation of POPIA.

Oh, and before we look at the specifics, remember that guidance notes are advisory in nature. This means they do not have the same standing as legislation and regulations. They merely set out the Regulator’s current interpretation of the law.

Here is the definition of direct marketing in POPIA:

‘to approach a data subject either in person or by mail or electronic communication, for the direct or indirect purpose of-

• promoting or offering to supply, in the ordinary course of business, any goods or services to the data subject; or
• requesting the data subject to make a donation of any kind for any reason’.

The main thing to remember here is that you must know who you’re marketing to (the person must be identifiable). This means that advertising on TV, magazines, or radio, for instance, is not direct marketing.

The guidance note provides these examples of direct marketing channels:

• post or hand-delivered mail
• in person
• letterbox drops distributed to an identified address in a specific area
• telephone
• automatic calling machines
• facsimile machines (yes, they still exist)
• SMS
• email
• push notifications
• direct messages on social media or in apps
• use of cookies

Here’s what we learned after reading the guidance note (quite a few times).

If you can get past the double negatives, you will see that the compliance requirements for unsolicited direct marketing through electronic communication differ from those for direct marketing in person or by post (i.e., not by electronic communication). This is not new; all direct marketers should know this distinction already. Here’s where it gets interesting though: the Regulator has added the telephone to what they consider to be ‘electronic communication’. This is the definition of electronic communication in POPIA:

‘any text, voice, sound or image message sent over an electronic communications network which is stored in the network or in the recipient’s terminal equipment until it is collected by the recipient’.

The guidance note lists the following as examples of electronic communication:

• telephone
• automatic calling machines
• facsimile machines
• SMS
• email
• push notifications
• direct messages on social media or in apps
• use of cookies

Until recently, (almost) everyone believed that the telephone should not be on this list. However, the Regulator obtained a technical opinion that explains how VoIP calls work and argues that call data is stored on various networks, including the recipient’s terminal equipment, and that the recipient collects the data when accepting a call.

The Regulator explains its decision this way:

‘It is the view of the Regulator that telephone calling is electronic communication by virtue of telephone communications technology having become digital over time. Telephone calls predominantly use VoIP (Voice over Internet Protocol) which is packet-switched telephony rather than the public-switched telephony previously used for analogue communication.

The analogue voice is encoded into a digital stream that is divided into small data packets which are labelled according to their order. These voice data packets are transmitted using real-time protocols during a telephone call are stored on the network. The voice data packets are re-assembled to match the original order of transmission, error correction is applied to digital data stream to compensate for the delay caused by packet re-assembly and finally relayed to the recipient’s terminal equipment to be decoded into analogue voice for consumption upon the recipient’s acceptance of the call.’

The Regulator asked the Direct Marketing Association of South Africa (DMASA) and Banking Association of South Africa (BASA) to comment on the draft guidance note and participate in a consultation process. Both associations submitted detailed arguments for disagreeing with this interpretation, but the Regulator wasn’t convinced.

Consent. That’s why.

Telemarketers must ask for a person’s consent when they call them for the first time.According to the guidance note, the telemarketer must ‘read out the contents of Form 4 to the data subject’ to obtain consent. If you’ve ever seen Form 4, you’ll understand why this requirement doesn’t make sense.

Based on the reading speed of the average adult (183 words per minute, we checked), the caller will take more than five minutes to read out the contents of Form 4, excluding the time it will take the data subject to respond. The Regulator conceded that Form 4 doesn’t have to be read word-for-word, but the telemarketer must use ‘substantially similar’ wording. At a minimum, the marketer must identify themselves and get consent (a ‘yes’) for the specific goods or services they will be marketing and the marketing channel (e.g., telephone, email, SMS, etc.) they want to use. Telemarketers must also record this conversation and keep it as evidence of obtaining consent. The guidance note does not state how long you need to keep the recording, so you must figure this out yourself by applying section 14 of POPIA. We think you should keep the recording for as long as you plan to market to that person or until they opt out, and for a while after that as evidence. Telemarketers must also keep a database of everyone who ever objected to receiving direct marketing or withdrew consent to ensure they don’t contact those people again.

The reality is that we need local businesses to be able to market their products and services cheaply and easily in South Africa. POPIA’s purpose is not to protect privacy to the exclusion of all other rights and interests. Instead, it aims to balance competing interests, such as the need for economic and social progress. The Regulator had this to say:

We take into consideration the concerns raised by the industry that some decisions may have impact on the economy, the Regulator is not suggesting that telemarketing should be forbidden, or that call centers should be shut down, however telemarketing as a direct marketing practice must be done within the ambits of the law
~ Chairperson Adv Pansy Tlakula

We’re holding our breaths for a brave direct marketer or industry association to challenge the Regulator’s interpretation in court. This may happen in the form of a declaratory order, or we may need to wait for an unfortunate organisation to get fined and hope that they appeal the finding.

In the meantime, look out for part two of our analysis of the guidance note on direct marketing. We’ll be looking at the use of cookies for direct marketing, and practical ways to get consent. Until then, check yourself before you wreck yourself.