The final Regulations relating to the Protection of Personal Information Act, 2013 (the "POPI Act") have now been published.

Following the first draft of the Regulations (the "Draft Regulations") which were published for public comment on 8 September 2017, the Information Regulator has on 14 December 2018, published the final regulations (the "Final Regulations"), a copy of which can be found here.

Of import is Regulation 6 which requires that a responsible party that wishes to process personal information of a data subject for the purpose of direct marketing by 'electronic communication' (which is defined in the POPI Act) must submit a request for written consent to that data subject on a prescribed form (Form 4), which is contained in the Final Regulations.

Although the amended Form 4 has been shortened, the principle remains the same, namely that in order to directly market to a data subject that is not your customer (as detailed in section 69(3) of the POPI Act), the data subject must opt-in.

The Draft Regulations provided that consent must be in writing "on a form which corresponds substantially with Form 4".  This provided for a measure of flexibility in relation to the manner in which consent was to be given by a data subject.  However, the manner in which consent must be provided to a responsible party under the Final Regulations is now fixed, as Regulation 6 of the Final Regulations requires that written consent must take the form prescribed in Form 4.

Regulation 6 of the Final Regulations further contemplates that the responsible party must "submit" a request for written consent to the data subject.  The definition of "submit" has been broadened to include data messages and electronic communications. This means that Form 4 can be sent to the data subject in numerous ways, including via SMS.  It is, however, unclear how the data subject must return the completed Form 4 to the responsible party.  The Draft Regulations required that Form 4 must be returned by post, facsimile or e-mail to the responsible party. The Final Regulations are silent on the matter, and no method is prescribed.  It would appear that the data subject would not be able to SMS his/her consent to the responsible party, as Form 4 requires the data subject's signature.

Now that the long-awaited Final Regulations have been released, we expect the implementation date of the POPI Act to be proclaimed in due course.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.