Direct marketing is a tool used by many organisations to promote their products and services. The purpose of direct marketing might not always be directly to make a purchase, but can also include getting potential customers to:

• Visit a website
• Call for more information
• Return a postcard requesting a quote
• Enter their name and email address Common forms of direct marketing includes:
• Brochures
• Catalogues
• Fliers
• Newsletters
• Post cards
• Coupons
• Emails
• Targeted online display ads
• Phone calls
• Text messages

In South Africa, there are a number of pieces of legislation which regulate direct marketing, and rules which apply in conjunction with this, based on the industry you are in. It is important to know and understand these so that you can properly comply.

Two of the key pieces of legislation which regulate direct marketing are the Consumer Protection Act and POPI. There are certain rules which apply when doing direct marketing under the CPA which must be adhered to, in conjunction with POPI.

CONSUMER PROTECTION ACT

Section 1 of the Consumer Protection Act (“CPA”) defines “direct marketing” as “an approach to a person, either in person, or by mail or electronic communication, for the direct, or indirect purpose of promoting, offering to supply, in the ordinary course of business, any goods or services or to request a donation of any kind.”

The definition includes most forms of direct marketing, including cold calling in person and by telephone, postal marketing, and electronic marketing. It also includes requests for donations, regardless of how this is done.

PERMITTED TIMES

Under the direction of the CPA, direct marketers need to ensure that amongst other things, direct marketing efforts occur within a specific time period. Make sure that where you intend on doing direct marketing, that you are aware of these and abide by them.

Specific days and times of days have been prescribed for direct marketing, and you are not allowed to engage in any direct marketing directed to a consumer at home for any promotional purpose during a prohibited period, unless the person has specifically agreed to it. You are not allowed to contact persons during the following times:

• Sundays or public holidays;
• Saturdays before 09h00 and after 13h00; and
• All other days between 20h00 at night and 08h00 the following day

You will not be in breach if you have sent out the direct marketing during the permitted periods, even if the consumer receives the direct marketing outside of these times, but the onus to prove that the direct marketing was dispatched during the allowed period will rest fully with you.

CPA COOLING OFF

The CPA provides that where a transaction is done as a result of direct marketing, a consumer is entitled to give written notice to the supplier to cancel the transaction and does not have to provide a reason for this. The notice must be provided within 5 days after the later of when the transaction was concluded, or when the goods were delivered. The supplier is then obliged to cancel the transaction without penalty.

CPA OPT-OUT

Don’t forget the “unsubscribe” option

Consumers must be provided with an “opt-out” option. This option should be included by providing an “unsubscribe” button, a tick box or an indication of how someone can be removed from a direct marketing list.

Physical post boxes containing a direction that “no junk mail” will be accepted should not be used for direct marketing.

DMA NATIONAL OPT-OUT DATABASE

There is a national “opt-out” database where members of the public can register to “opt-out” and not be contacted by any member of the Direct Marketing Association of Southern Africa.

https://www.nationaloptout.org/

This ensures that addresses, email addresses, telephone and cell numbers are no longer available to organisations, who are members of the DMA, who want to make offers and send information that data subjects do not wish to receive.

POPI APPLICATION

“Direct marketing” is defined in POPI as “to approach a data subject, either in person or by mail or electronic communication, for the direct or indirect purpose of –

• promoting or offering to supply, in the ordinary course of business, any goods or services to the data subject; or
• requesting the data subject to make a donation of any kind for any reason;” It is therefore very similar to the definition contained in the

All data subjects have the right to object to any direct marketing, in which instance you are required to stop this.

There are additional specific rules around direct marketing contained in Section 69 of POPI which apply to direct marketing which is done by means of “electronic communication”.

“Electronic communication” is defined as “any text, voice, sound or image message sent over an electronic communications network, which is stored in the network or in the recipient’s terminal equipment until collected by the recipient”. This includes automatic calling machines, facsimile machines, SMS’s and e-mail. An “Automatic calling machine” is a machine that is able to do automated calls without human intervention.

Face-to-face contact, person-to-person telephone calls and postal direct marketing is not included.

PERMITTED ELECTRONIC DIRECT MARKETING

You are allowed to process the personal information of data subjects for electronic direct marketing where the data subject:

• has specifically consented to the processing or
• is a customer of the responsible party doing the marketing

OPT-IN

Prospective  customers  must  provide  express  consent,  or “opt in” before receiving any electronic direct marketing. The “opt in” requirement does not apply to direct marketing which is done by way of In-person, person-to-person telephonic and postal direct marketing. The provisions of the Consumer Protection Act “opt-out” will most likely apply to these.

“Opt-in” consent must be specific, voluntary and informed. There must be full disclosure as to what information is required and what it will be used for. In addition to this, the consent must be in writing, and be obtained using Form 4.

 

FORM 4

 

APPLICATION FOR THE CONSENT OF A DATA SUBJECT FOR THE PROCESSING OF PERSONAL INFORMATION FOR THE PURPOSE OF DIRECT MARKETING IN TERMS OF SECTION 69(2) OF THE PROTECTION OF PERSONAL INFORMATION ACT, 2013 (ACT NO. 4 OF 2013) REGULATIONS RELATING TO THE PROTECTION OF PERSONAL INFORMATION, 2018

 

[Regulation 6]

 

TO:                                                [Name of data subject]           FROM: [NAME OF ORGANISATION]

 

 

Contact number(s):

Fax number:

E-mail address:

[Name, address and contact details of responsible party]

 

 

Full names and designation of person signing on behalf of responsible party:

…………………………………………………….

 

 

 

 

Signature of designated person Date:                

 

PART B

 

I,                                                                           (full names of data subject) hereby:

Give my consent to receive direct marketing of goods or services to be marketed by means of electronic communication.

 

SPECIFY GOODS or SERVICES:

SPECIFY METHOD OF COMMUNICATION:

 

FAX:

E – MAIL:

SMS:

OTHERS – SPECIFY:

 

Signed at …………………………………… this …………………. day of ………………………20…………

 

……………………..……………… Signature of data subject

 

You may only request consent for direct marketing from data subjects once. Where a person has previously withheld consent, you may not approach them again.

You will require procedures to identify persons who have been approached for direct marketing consent and have provided this, and then ensure that processing happens only as permitted in terms of the consent.

You will also need to identify where consent has been requested and denied and ensure that these persons are not contacted again.

As POPI applies to the information you already have, you will also need to ensure that this is made compliant. This includes ensuring that existing databases of persons who are not yet customers are retrospectively made compliant.

Where you can prove a database has been acquired legally, you will be able to contact the consumers and ask for their permission to market to them, but you can only do this once.

EXISTING CUSTOMERS

You are allowed to provide direct marketing without obtaining this specific consent from your existing customer base where you obtained contact details in the context of a sale of a product or service for the purposes of marketing similar products or services to them.

You must also be able to show that when you collected these details, you provided the customer a reasonable opportunity to object, at no cost, to the use of his details for electronic direct marketing purposes.

Where the person does not object, you need to provide an “opt-out” option every time you do direct marketing to the person. The opt-out instructions must be clear and the process must be free of charge and not bogged down in unnecessary formality.

If you have not done this yet, you can get your existing customer database compliant. The key is to get consent when you collect the customer data, which is not necessarily at the point of sale. You are required to keep information up to date, so by running a campaign to update your customers’ details you should, at the same time, inform your customers that you will be marketing to them and give them the opportunity to opt-out.

MANDATORY DISCLOSURES

All direct marketing communications must contain the sender’s details. Any communication for the purpose of direct marketing must contain the details of the identity of the sender or the person on whose behalf the communication has been sent; and an address or other contact details to which the recipient may send a request that such communications cease.

CONSEQUENCES OF NON-COMPLIANCE

Non-compliance with the provisions relating to direct marketing constitutes an “interference with the protection of the personal information” of a data subject.

This can be reported to the Information Regulator and may end up with Regulator issuing an Enforcement Notice, which requires you either to do something specific, or to stop processing the information. Failure to comply with an Enforcement Notice is an offence.

A data subject, or the Information Regulator if requested by a data subject, may also institute a civil action for damages.

WHAT MUST YOU DO?

Where any direct marketing is to be done, ensure that you understand which legislation and codes apply. Your campaign should comply with these in addition to the requirements of POPI.

Where necessary, complete a PPIA and design the campaign around the outcome and recommendations in this.

Ensure that you have the necessary consents and records before doing any direct marketing. Where consent is on record, make sure that any direct marketing is in line with this and that no unauthorised processing happens.

Review the information you are going to collect and ensure the content and process is compliant. Make the required disclosures and provide for opt-outs and objections.

Where you have existing databases, plan how you are going to get these compliant with requirements.

Implement procedures to ensure that you do not contact any person who does not want to be contacted.