Telemarketing and the POPI Act – A simple guide

Although the Protection of Personal Information Act (POPIA) introduced further regulations for the telemarketing business practice, it is reassuring to notice that the role of telemarketing and the importance of call centres for the proper functioning and growth of the economy was taken into great consideration.

Over the past couple of weeks, we have published a series of articles relating to Direct Marketing and the Protection of Personal Information Act 4 of 2013 (POPIA) compliance. 

We touched on elements of navigating direct marketing in the business environment such as opting in and out  as well as service messaging and a little bit on cold calling. 

In this article, we will focus broadly on elements of telemarketing in line with procedures as required by POPIA.

What is cold calling really?

Cold calling is a business practice mostly used to create leads in the telemarketing industry and other industries, as well as to market products to consumers who may not have exposure to other forms of electronic communication such as email. In one of our previous blogs, we briefly discussed how cold calling is affected by POPIA. The cold calling technique, together with other telemarketing techniques, is crucial for commerce and the growth of the economy.

Consent is fundamental for the processing of personal information and must be the “default go to consideration” before a responsible party processes personal information. Section 69 (previously discussed) also highlights the importance of obtaining consent when processing information for the purpose of direct marketing, but what happens if it is not possible to get this much sought-after consent or when a responsible party needs to seek consent from a data subject and the only way to reach the data subject is through a telephone call? We all have to make that first call at one point and, sometimes, subsequent calls in our daily work activities.

To call or not to call?

The inception of POPIA highlighted the importance of a data subject’s participation when processing personal information. The process of ensuring this participation has at times created legislative uncertainties as to what is required of the responsible party. The following sections of POPIA leave a telemarketer with the question: to call or not to call?

• Section 11: Consent, justification, and objection
• Section 12: Collection directly from the data subject
• Section 18: Notification to data subject when collecting personal information
• Section 69: On unsolicited electronic direct marketing.

POPIA: Section 69 misconceptions

To place issues into perspective, it is important to point out that when it comes to telephonic communications, the provisions of section 69 with regards to unsolicited direct marketing through electronic communication do not apply to all forms of telephonic communication. They apply only to SMSs and automatic calling machines.

Telephone calls which involve live human intervention therefore do not fall under the provisions of this section, which is a common misconception when reference is made to consent for direct marketing. When conducting direct marketing through telemarketing, it is advisable to distinguish between the types of communication and apply the correct section of POPIA and other pieces of legislation such as the CPA that may regulate the business practice in question.

The following sections of POPIA are worth considering when Telemarketing through telephone calls:

• POPIA: Section 11 – The Consent requirement

This section requires the responsible party to obtain consent before processing personal information of data subjects. There are, however, circumstances when it may not be possible for telemarketers to obtain this consent. The section makes provision for such circumstances and some of these provisions may apply to the telemarketing industry and any other responsible parties that engage in telemarketing as a business practice.

Circumstances which do not require consent are as follows:

• Where processing protects a legitimate interest of the data subject;
• If processing is necessary for pursuing a legitimate interest of the responsible party or a third party to whom the information is supplied.

Calling clients without their consent is therefore allowed in these circumstances unless the data subject objects as stated in section 11(3), in which case the responsible party will have to refrain from calling the data subject.

It is important to note that, unlike section 69, section 11 does not place a burden on the responsible party to–

• contact the data subject only once;
• provide an opt-out mechanism to the data subject. The responsibility lies with the data subject to object and ask the responsible party to stop calling them. This may only work if the responsible party does not have another legal basis which compels them to call the data subject, such as a contract that the data subject may be party to.

For call centres and other industry players that make use of telephonic direct marketing, this means that as long as they meet the requirements of section 11(1)(d) and (f), they may contact the data subject–

• without consent;
• as many times as possible through telephone calls,

until such a time as the data subject objects, at which point the responsible party must stop calling the data subject.

We take it that where the responsible party needs to secure consent for electronic direct marketing, these provisions can be used to seek and build a relationship with the data subject in order to open a conduit for electronic direct marketing in the future.

It is also our conviction that these provisions must not be manipulated to harass the data subject but should instead be perceived as a window for pursuing a compliance framework informed by an ethical rather than a legal dependence.

• POPIA: Section 12 – Collection from the data subject

Section 12 requires the responsible party to collect personal information directly from the data subject. There are also circumstances when this requirement can be waived:

1. Section 12(2)(c): where collection from another source would not prejudice a legitimate interest of the data subject;
2. Section 12(2)(d) (v): where collection from another source is necessary to maintain the legitimate interests of the responsible party or a third party to whom the information is supplied;
3. Section 12(2)(f): compliance is not reasonably practicable in the circumstances or the particular case.

• POPIA: Section 18 – Notification to data subject when collecting personal information

According to section 18, it is also a requirement to notify a data subject when their personal information is collected but there are some exceptions to this rule, some of which can be applied to the telemarketing industry and others that make use of telemarketing through telephone calls:

1. Section 18(4)(b): if non-compliance would not prejudice the legitimate interests of the data subjects in terms of POPIA;
2. Section 18(4)(d): if compliance is not reasonably practicable in the circumstances of the particular case.

Other legislation that also regulates telemarketing

The above sections must be viewed in light of other pieces of legislation that regulate telemarketing, such as the Consumer Protection Act 68 of 2008, the Electronic Communications and Transactions Act and the National Credit Act, etc., which also require responsible parties to cease contact if the data subject requests it. It is reassuring to note that although there is a legislative maze to navigate through, POPIA offers an overarching guide for compliance.

Tips for a Compliance Framework

The first and most important aspect to consider regarding the exceptions pointed out is that these must not be considered as loopholes to evade compliance! The legislative framework that regulates compliance requires a well-formulated strategy by the responsible party for the processing of personal information, which strategy must encompass a holistic approach to addressing issues such as–

• risk assessment
• policy formulation
• impact assessments
• records management
• employee training
• ongoing monitoring.

All this may call for consultation with legal experts who specialise in pulling the different pieces of legislation apart and figuring out where to apply the relevant sections. The role of ethics must not be undermined in building an effective compliance framework; ultimately, it is about motivating your clients (the data subjects) on the value they derive when you process their personal information.

For the telemarketing industry, such a framework would have to consider the following:

• Establish a legal basis and rules for the categories of telephonic communications to be conducted in your business practices. The importance of a POPIA assessment cannot be over-emphasised.
• Formulate and implement an effective procedure to facilitate receipt and records of requests from data subjects that request to be taken off your telemarketing list.
• Avoid calling consumers/data subjects who have objected to telemarketing unless there is another legal basis for calling them.

Conclusion

Although POPIA introduced further regulations for the telemarketing business practice, it is reassuring to notice that the role of telemarketing and the importance of call centres for the proper functioning and growth of the economy was taken into great consideration. It is possible to balance privacy and the pursuit of revenue growth. The reputational damage that can result from the failure to implement, pursue and monitor a proper compliance framework can, however, undo years of a company’s diligence!

SERR Synergy offers a holistic compliance package that is aimed at not just giving an escape route from the scrutiny of the Regulator and other compliance bodies but rather meant to build a lasting relationship with our clients as we guide them to develop a lasting compliance culture within their entities. Our services include information Compliance risk assessments, compilation of risk assessment reports and ongoing guidance on compliance legislation.

About the Author: Pedzisai Maririmba joined SERR Synergy as a Learnership Project Manager in 2016. She then moved to the Information Compliance Department where she now serves as an Information Compliance Advisor. She is an Admitted Attorney of the High Court of South Africa and holds an LLM from the University of Pretoria, an LLB from UNISA and a BSc (Hons) in Media and Society Studies from the Midlands State University. Pedzisai is passionate about Legal Compliance encompassing POPIA, PAIA, Consumer Protection and Cyber Security.

Sources:

Consumer Protection Act 68 of 2008

Electronic Communications and Transactions Act 25 of 2002

Protection of Personal Information Act 4 of 2013