Over the past few days, you may have received various e-mails from business entities claiming that you indicated that you would like to receive information from such business, OR that you are a previous customer and as such could receive the electronic marketing.
You would have further been informed that should you wish not to receive such e-mails, you can “unsubscribe” or use the “opt-out” function.
Section 11 of the POPI Act prescribes that personal information may only be processed if inter alia the data subject consented to such processing. The section furthermore determines that the responsible party bears the burden of proof for the data subject`s or competent person`s consent as referred to in subsection (1)(a).
This begs the question of whether the business entity can obtain your consent “by default” should you fail to “unsubscribe” or “opt-out”.
Section 69 prescribes direct marketing by means of unsolicited electronic communications. In terms of the section, the processing of personal information of a data subject for the purpose of direct marketing by means of any form of electronic communication is prohibited unless the data subject has given his, her, or its consent to the processing.
This still does not seem to answer the question of whether the responsible party may further process my information by default.
Why is everyone asking for your POPI consent?
The answer can be found in section 69(2) of the Act, which stipulates that a responsible party may approach a data subject whose consent is required in terms of subsection (1)(a); and who has not previously withheld such consent, only once in order to request the consent of that data subject.
The Act proceeds to stipulate that the data subject’s consent must be requested in the prescribed manner and form.
The Regulations have a further very clear indication as to electronic marketing. Regulation 6 determines that a responsible party who wishes to process personal information of a data subject for the purpose of direct marketing by electronic communication MUST in terms of section 69(2) of the Act submit a request for written consent to that data subject.
The legislature for these purposes compiled a prescribed form (Form 4) which can be found in the Regulations, and which clearly requires any data subject to expressly agree to receive direct marketing of goods or services by means of electronic communications.
Do businesses need to get consent from their customers?
There is, however, another proviso if the data subject is a customer of the responsible party. In this event Section, 69(3) prescribes that a responsible party may only process the personal information of a data subject who is a customer of the responsible party in terms of subsection (1)(b) if the responsible party has obtained the contact details of the data subject in the context of the sale of a product or service; for the purpose of direct marketing of the responsible party’s own similar products or services; and if the data subject has been given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to such use of his, her or its electronic details at the time when the information was collected; and on the occasion of each communication with the data subject for the purpose of marketing if the data subject has not initially refused such use.
In other words if you were a customer of the business entity and if all the boxes are ticked in Section 69(3), and more specifically if you were provided with the opportunity to consider whether to receive electronic marketing at the time of providing your details, the “unsubscribe” or “opt – out” option can be used and must be included in any subsequent electronic marketing.
If you are not a previous customer within the ambit of the Act, no electronic marketing may be conducted unless you specifically consented thereto.
