Two's Company and Three's a Crowd
04 August 2013Routledge Modise
Data privacy, in the area of electronic communications and transactions, is currently governed by the Electronic Communications Act (ECTA). The proposed Protection of Information Bill (POPI) is set to repeal various provisions of ECTA and is the first piece of legislation set to regulate and create rights and obligations arising out of the right to privacy enshrined in s14 of the Constitution.
The practical conundrum arises where the very provisions set to be repealed by POPI are intended to be amended by the Electronic Communications and Transactions Act Amendment Bill (ECTA Amendment Bill) recently published for public commentary. This article focuses on the provisions relating to direct marketing via unsolicited electronic communications in ECTA, POPI and the ECTA Amendment Bill.
ECTA applies in respect of any electronic transaction or data message. ECTA states that any person who sends unsolicited commercial communications to consumers, must provide the consumer with the option to cancel his or her subscription to the mailing list of that person; and with the identifying particulars of the source from which that person obtained the consumer's personal information, on request of the consumer. Every electronic and unsolicited commercial communication sent to a consumer must provide that consumer with an option to "opt out" of receiving any further communication.
POPI is set to change drastically the landscape regarding unsolicited electronic communications. In its current form, POPI will repeal the relevant provisions of ECTA, and govern that type of communication by requiring that "any form of electronic communication, including automatic calling machines, facsimile machines, SMSs or email is prohibited unless the data subject, has given his, her or its consent to the processing; or is a customer of the party sending out the communication". POPI goes on to allow a responsible party to approach a data subject only once to request the required consent.
Where personal information belongs to a consumer who is an existing customer of the responsible party and if the responsible party obtained the contact details of the data subject in the context of the sale of a product or service then the responsible party may use that personal information for the purpose of direct marketing its own similar products or services. At all times the data subject must be given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to such use of his, her or its electronic details at the time when the information is collected and at each direct marketing communication.
Any communication for the purpose of direct marketing must contain details of the identity of the sender or the person on whose behalf the communication has been sent and an address or other contact details to which the recipient may send a request that such communications cease (that is, ability to opt out). In essence, in terms of POPI, any form of unsolicited electronic communication (including automatic calling machines, facsimile machines, SMSs or email) is prohibited unless the data subject has "opted in" or has consented in advance to receiving such communications. A responsible party may contact the data subject once to obtain such "opt-in" consent so long as they have not previously withheld consent. However, an exemption is created in that "opt-in" consent is not required where the data subject is a customer of the responsible party and the contact details of the data subject have been obtained in the context of the sale of a product or service for the purpose of direct marketing of the responsible party's own similar products or services. The data subject must be given reasonable opportunity to object (free of charge and without unnecessary formality) to the use of his details when the information was collected and at the time of each marketing related communication. Thus in practice, if the exemption applies, all marketing related electronic communications will be on an "opt-out" basis
The ECTA Amendment Bill
The ECTA Amendment Bill was published for comment on 26 October 2012, and amends a number of definitions and provisions of ECTA.
The ECTA Amendment Bill proposes to delete the current s45 and replace it with the following: "No person may send unsolicited communications without the permission of the consumer to whom these unsolicited communications are to be sent or in fact sent." Thus the proposed amendments to ECTA seem to create an obligation to obtain opt-in consent from consumers for the purposes of direct marketing via electronic communications. There is no special dispensation in respect of existing customers.
Which type of consent is required? Currently, for the purposes of direct marketing via electronic communications a consumer must be provided with an option to opt-out from such marketing in terms of s45 of ECTA. POPI, in its current form and once in force, repeals s45 of ECTA and will prohibit direct marketing via unsolicited electronic communications unless the data subject has consented (opt-in consent) or, subject to the requirements previously mentioned, the data subject is an existing customer. Unlike POPI, s45 of the ECTA Amendment Bill does not provide exceptions to this requirement of opt-in consent (for example there is no exemption for unsolicited communications being sent to existing customers) and the requirement seems strict and without exception. Thus the three provisions all require different forms of consent and place different obligations on data processors wishing to conduct direct marketing via unsolicited electronic communications. On 11 September 2012, POPI (the ninth version) was approved by the National Assembly. It now awaits approval from the National Council of Provinces before it can be sent to the President for his assent and signature. The Amendment Bill, on the other hand, is still in its initial phases and was published for public comment on 26 October 2012. It cannot be said with certainty whether POPI or the ECTA Amendment Bill will he promulgated and commence first. Should POPI not commence and repeal s45 of ECTA, data processors may find themselves having to comply with the strict requirement of opt-in consent for the purposes of all direct marketing via unsolicited communications until such time as it does commence.