The final Regulations relating to the Protection of Personal Information Act 4 of 2013 (the "POPI Act") have now been published.
Following the first draft of the Regulations (the "Draft Regulations") which were published for public comment on 8 September 2017, the Information Regulator has, on 14 December 2018, published the final regulations (the "Final Regulations"), a copy of which can be found here.
The Final Regulations are of particular importance for responsible parties that perform direct marketing by means of any form of electronic communication.
Section 69 of the POPI Act provides that the processing of personal information of a data subject for the purpose of direct marketing by means of any form of electronic communication, including automatic calling machines, facsimile machines, SMS's or e-mail is prohibited unless the data subject has given his, her or its consent to the processing; or is a customer of the responsible party who gave their personal information to the responsible party in the context of a sale for the purpose of direct marketing, and has been given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality.
Regulation 6 of the Final Regulations now prescribes the manner and form in which a data subject's consent must be requested and provides that the consent must be requested in writing on the prescribed Form 4. Form 4 specifically requires that the data subject indicates his, her or its consent by ticking a consent opt-in box (which box may not be pre-ticked) and signing Form 4. The responsible party will be required to customise form 4 to include a description of the specific goods or services that will be marketed to the data subject as well as the electronic communication that will be used for such purpose.
Regulation 6 of the Final Regulations further contemplates that the responsible party must "submit" a request for written consent to the data subject. The definition of "submit" has been broadened to include data messages and electronic communications. This means that Form 4 can be sent to the data subject in numerous ways, including via SMS. The Draft Regulations required that Form 4 must be returned by post, facsimile or e-mail to the responsible party. The Final Regulations are silent on the matter, and no method is prescribed. However, the requirement that the data subject's signature is required on the consent will limit the ways in which the data subject's consent can practically be obtained.
Now that the long-awaited Final Regulations have been released, we expect the implementation date of the POPI Act to be proclaimed shortly.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
