Service Messaging – not to be confused with Direct Marketing

As highlighted by the previous articles in our Direct Marketing series, the Protection of Personal Information Act 4 of 2013 (POPIA) imposes stringent requirements on businesses in order to lawfully conduct direct marketing to data subjects.

This, however, does not mean that all communication (be it electronic or otherwise) with a business’s customers or clients, i.e. the data subjects of that business, fall within the ambit of ‘direct marketing’ as defined in POPIA and explained by the first blog in this series.

If you have missed any of our previously published articles in the Direct Marketing series, please find below a quick summary for easy of reference: 

• Navigating Direct Marketing in the business environment
• POPI Act and electronic Direct Marketing – Yes cold calls are allowed
• Direct Marketing – opting in and opting out

In this blog, we clarify a few of the ambiguous elements about service messaging and provide guidance to prevent service messaging from becoming direct marketing.

What is service messaging?

Unfortunately, neither POPIA nor the EU’s General Data Protection Regulation (the GDPR) on which POPIA is modelled, defines ‘service messaging’. Section 1 of POPIA does, however, define ‘direct marketing’, with two elements of such definition being crucial to differentiate between direct marketing and service messaging, namely:

• Direct marketing promotes or offers to supply any goods or services to the data subject; or
• It requests the data subject to make a donation of any kind.

If the communication therefore promotes or advertises any goods or services or requests a donation from the recipient, it would most likely be classified as ‘direct marketing’ and would need to adhere to the direct marketing requirements set out in POPIA.

Although not enforceable within South Africa, the UK Information Commissioner’s Office (the ICO) has provided guidelines for differentiating between direct marketing and service messaging:

• Service messages contain customer service information;
• Service messages do not contain material promoting additional products or services;
• Service messages are sent to an individual for administrative or customer service purposes;
• Examples of service messages include communications which provide customers with contact information of the relevant business; verify the customer’s details; update a customer on any change in the business’s terms and conditions or privacy policy; and verify an order or purchase made.

Tips to prevent service messaging from becoming direct marketing

As mentioned above, a distinction can be made between service messaging and direct marketing; however, the former can (sometimes easily and unintentionally) become the latter if one is not careful. The following can assist your business to maintain the line between the two:

• Attention should be given to the tone, phrasing and context of the service message. The purpose of the message should therefore be kept in mind. Does the message aim to advertise products or services (direct marketing), or is it part of providing the service which the data subject has already signed up for (service message)?
• If a service message also contains a component whereby an additional product or service is offered, or a promotion is advertised, it will most likely constitute direct marketing.
• Be mindful of email signatures / banners which contain advertisements / promotions.
• As far as possible, keep direct marketing communication and service messaging separate from each other.
• Be sure to be upfront with customers when signing up for a loyalty programme about the types of communication which they will be receiving, for example special offers or promotions. The customers should consent to receiving these communications upon signing up and should be given the opportunity to opt out of these messages every time they receive them.

In conclusion

If the purpose of communication to data subjects is borne in mind, it is possible to distinguish between direct marketing and service messages. This distinction will ensure that your business effectively communicates with customers or clients with peace of mind that adherence to POPIA is being maintained.

SERR Synergy assists entities to fully comply with the legislative requirements of POPIA by setting up information security management policies where the information compliance risks of organisations are identified and managed to maintain the confidentiality, integrity and legitimate availability of data. This includes the compilation of Due Diligence Reports, drafting the required Privacy policies and agreements and advising on internal information processing requirements within your organisation.

About the author: Daniele Louw obtained her LLB degree as well as a Post Graduate Diploma in Financial Planning from the University of the Free State. She also obtained a Certificate in Compliance Management from the University of Cape Town. She is an admitted attorney of the High Court, and after practising at a legal firm for 5 years, she decided to pursue a career in compliance. She joined SERR Synergy in 2021 and currently holds the title of Information Compliance Advisor, where she specialises in POPI and PAIA compliance.

Sources:

Protection of Personal Information Act 4 of 2013

The General Data Protection Regulation 2016/679

De Stadler, E; Hattingh, IL; Esselaar, P; Boast, J; 2021, Over-thinking the Protection of Personal Information Act, JUTA