THE Information Regulator (Regulator) issued its first Enforcement Notice as a result of a direct marketing complaint.
This comes at a time when the public is highly frustrated with the influx of direct marketing messages. The Regulator issued an Enforcement Notice to FT Rams Consulting, a training institution, following findings of the contravention to various sections of the Protection of Personal Information Act (POPIA).
The Regulator received a complaint from a data subject (a person about whom the personal information relates) following countless direct marketing messages received by them. Regardless of the multiple attempts to opt out and requests to be removed from the company emailing list, FT Rams Consulting blatantly ignored the pleas from the data subject and continued to send them marketing messages on email.
The Regulator determined that FT Rams Consulting interfered with the protection of personal information of the data subject, and thus breached the conditions for the lawful processing of personal information. Furthermore, the Regulator found that FT Rams Consulting also violated section 69 of POPIA which regulates direct marketing by means of unsolicited electronic communications.
“Our leniency regarding direct marketing through unsolicited electronic communications is going to be a thing of the past because responsible parties (public or private bodies) ignore the provisions of section 69 of POPIA and infringe on the rights of data subjects.
In response to this, we are also putting together a guidance note which will clearly spell out the dos and don’ts of processing personal information for the purposes of direct marketing by means of unsolicited electronic communication,” said Adv Pansy Tlakula, Chairperson of the Regulator.
The Regulator found that FT Rams Consulting had failed to adhere to POPIA and contravened sections 69 (1) and (2) and subsequently other sections of POPIA by transmitting to the data subject, without first obtaining their consent, persistent direct marketing communications through emails pertaining to the courses or webinars which it offered.
Furthermore, that although the data subject was provided with the option to “opt out”, this did not remedy the situation.
Section 69 (1) of POPIA states that the processing of personal information of a data subject for the purpose of direct marketing by means of any form of electronic communication is prohibited unless the data subject has given their consent to the processing.
Section 69 (2) clearly states that a responsible party may approach a data subject who had not previously withheld such consent only once to request the consent of that data subject. This means that the first message which FT Rams Consulting was supposed to send to the data subject was one in which it requested the data subject’s consent.
POPIA defines consent as voluntary, specific and informed expression of will in terms of which permission is given for the processing of personal information. If the data subject consented to receiving direct marketing messages, they also had to indicate the preferred means of communication which FT Rams Consulting could use to send direct marketing messages to them. Also, FT Rams Consulting was supposed to use the prescribed form to obtain the data subject’s written consent. All these requirements were not complied with.
In the Enforcement Notice, the Regulator has ordered FT Rams Consulting, among other things, to immediately stop sending unsolicited direct marketing messages by means of any electronic communication, including telephone, fax, SMS, email or automated calling machine, to any data subject who has not consented, including the complainant.
They must ensure that the first communication sent to data subjects is one in which FT Rams Consulting requests their consent and must approach such data subjects only once to obtain consent.
FT Rams Consulting must use the form prescribed by the Regulator for this purpose.
The use of this form is compulsory. Furthermore, they must also ensure that they only send such a message to a data subject who had not previously withheld his or her consent.
FT Rams Consulting has been ordered to provide an undertaking to the Regulator regarding compliance with these orders.
FT Rams Consulting has also been ordered to compile and maintain a database of all data subjects who had previously withheld or did not consent to receiving unsolicited direct marketing messages and submit a design of such a database to the Regulator. This will ensure that the data subjects on the database are not contacted again.
The FT Rams Consulting is ordered to adhere to the instructions contained in the Enforcement Notice and demonstrate such to the Regulator within 90 days of receipt of the notice.
Non-compliance with an Enforcement Notice is regarded as a contravention of the law and can upon conviction result in a fine of up to R10 million or imprisonment for a period not exceeding ten (10) years or to both such a fine and imprisonment.
