The Information Regulator (“Regulator“) issued its first Enforcement Notice regarding non-compliance with the direct marketing provisions of the Protection of Personal Information Act 4 of 2013 (“POPIA“) against FR Ram Consulting (“FR Ram”).

Of importance is what the Enforcement Notice practically means for the direct marketing industry. What is the extent and impact of the Enforcement Notice, the intended and unintended consequences? Has the record been set straight, or not?

The Enforcement Notice was issued against FR Ram following a complaint from a data subject of countless direct marketing messages, particularly emails, received from FR Ram despite multiple attempts by the data subject to opt-out and requests to be removed from the emailing list of FR Ram.

FT Ram was ordered to, among other things, to –

“immediately stop sending unsolicited direct marketing messages by means of any electronic communication, including telephone, fax, SMS, email or automated calling machine, to any data subject who has not consented, including the complainant.” [Emphasis bolded]

The Regulator found that FT Ram ignored the opt-out requests from the data subject and, as a consequence, contravened the conditions for the lawful processing of personal information and section 69 of POPIA. It was found that FT Ram contravened sections 69(1) – (2) of POPIA by transmitting to the data subject, without first obtaining their consent, persistent direct marketing communications through emails and not using the prescribed form to obtain the data subject’s written consent.

The Enforcement Notice comes about at a time when various statements have been made about whether a telephone call constitutes an electronic communication. For example, recently, the Chairperson of the Regulator, Adv. Pansy Tlakula, remarked that –

“I can reveal here that we’ve taken [a decision] that a telephone is a form of electronic communication. Telemarketing will then come within Section 69 of POPIA because these telephone calls have become such an inconvenience. They annoy everybody, including me.”

Taking a step back – and getting back to the basics – what does POPIA say?

POPIA defines electronic communications as “any text, voice, sound, or image message sent over an electronic communications network which is stored in the network or in the recipient’s terminal equipment until it is collected by the recipient“. By this definition alone –

• emails are clearly included within section 69(1)-(3) of POPIA as the marketing message is stored in the network or in the recipient’s terminal equipment. In fact, section 69(1) itself deliberately mentions emails as a form of electronic communication; and
• live telephone calls are however not stored in the network or in the recipient’s terminal equipment except if one leaves a message.

The above begs the question of the extent to which telemarketing constitutes a form of direct marketing in terms of section 69 of POPIA.

The catch-all ground is section 69(4) of POPIA which provides that, duly emphasised, “Any communication for the purpose of direct marketing must…”. Section 69(4) thereafter sets out an opt-out regime in terms of which the direct marketer must disclose its identity and contact details to which the recipient may send a request that such communications cease. The wording of section 69(4) is important. It refers to all communications and not electronic communications.

The Regulator is established pursuant to enabling legislation and equipped with the task of overseeing, monitoring and enforcing POPIA and its regulations. The Regulator is bound by the provisions of POPIA and the Promotion of Access to Information Act 2 of 2000 in the exercise of its powers and functions. It is an administrative body and is also bound by the requirements for valid administrative action set down in the Promotion of Administrative Justice Act 3 of 2000 (“PAJA“). The role of the Regulator is therefore important for the proper governance of data privacy matters in South Africa. The Regulator must carry out its functions without fear, favour or prejudice.

The functions of the Regulator and Legislature complement each other; however, they serve different roles within the legal system. The Legislature is responsible for law-making and policy setting. This accords with section 43(a) of the Constitution of South Africa, 1996 which vests the legislative authority of the national sphere of government in Parliament. This confers on the National Assembly the power to consider, pass, amend or reject any legislation before the National Assembly and to initiate or prepare legislation.

Being an administrative body that is accountable to the National Assembly, all administrative actions and decisions of the Information Regulator must be executed in a lawful, reasonable and procedurally fair manner. If this is not the case, then the action or decision of the administrative body is subject to judicial review in terms of PAJA.

Can a Regulator therefore create the law?

The Regulator expects litigation in relation to its interpretation and Adv. Pansy Tlakula remarked that –

“The rules are very clear but I think with direct marketing – my sense is that we’ll probably end up being in court. They will wait for the time when there is a complaint and once we decide against them, they’ll probably take us on review and the issue of whether a telephone is electronic communication or not will come to the fore.“

It has been reported that the Regulator will issue a Guidance Note on Direct Marketing by Means of Unsolicited Electronic Communications. To this end, Adv. Pansy Tlakula remarked that –

“That is why we needed to take a decision and it took us a long time to take that decision when we finalised the direct marketing guidance note. We took a decision to say once and for all that a telephone is an electronic communication.“

Can the Regulator read in the word telephone into the definition of electronic communications?

Time will tell.

Written by Ahmore Burger-Smidt, Head of Regulatory and Dale Adams, Associate, Werksmans