Guidance note on direct marketing in terms of the Protection Of Personal Information Act of 2013 (POPIA)

The Information Regulator has published a Guidance note on direct marketing in terms of the Protection Of Personal Information Act of 2013 (POPIA). This is something we have been anticipating for a long time and will prove very valuable for all organisations.

This Guidance Note provides guidance to the responsible parties on how personal information should be processed in compliance with the eight (8) conditions for lawful processing of personal information. Therefore, this Guidance Note assists in the interpretation of POPIA in relation to direct marketing as defined in POPIA.

Some key take-aways from the POPIA Guidance note.

The Guidance note is advisory in nature. Accordingly, the Guidance Note shall not be construed to limit or restrict the Information Regulator’s administration and enforcement of POPIA.
The provisions of POPIA and the Regulations will prevail over the Guidance Note in the event of any inconsistency. The Guidance note should be read in conjunction with other Guidance Notes issued by the Information Regulator. This Guidance note does not constitute legal advice.

The note covers traditional direct mailing, such as post or hand-delivered mail, in addition to electronic marketing.

Legitimate Interest as a lawful basis for processing is discussed in some depth. The onus is on the responsible party to justify the use of legitimate interests as the relevant basis for the processing of personal information. Before adopting legitimate interest as justification for the processing of personal information of data subjects, the responsible party must have regard to whether the processing will protect the legitimate interests of the data subjects. It is not sufficient that the processing will be of benefit to a data subject. Responsible parties may not use the legitimate interest as a basis where the data subjects are likely to view the processing as pervasive, disruptive, intrusive and generally not acceptable to the recipient. 

To rely on legitimate interest as a lawful basis for processing personal information for direct marketing purposes, the responsible party should ideally conduct a Legitimate Interest Assessment. and must undertake the following three (3) stage assessment:

1. The first assessment relates to the purpose test that helps to objectively identify a legitimate interest and that requires the following related considerations to be made by the responsible party:-
   1. What is the purpose of processing personal information of data subjects?
   2. What is the benefit to be derived from the processing?
   3. What is the interest (benefit) of the responsible party or of any third party in the processing?
   4. Is the processing not in conflict with the interests of society?
   5. What will be the consequences for the responsible party if the processing does not proceed?
   6. Is the processing compliant with a legislation, by-law, rule or policy?
2. The second assessment relates to the necessity test to consider the connection between the processing and the interests pursued as well as purpose stated in the first test above. The responsible party should determine aspects not limited to the following:
   1. Is the processing of personal information necessary to achieve the specified purpose?
   2. Is the processing proportionate to what the responsible party is trying to achieve with the processing purpose?
   3. Can the processing never proceed with less personal information processed or with no processing of personal information at all?
   4. Is the processing method (including method of communication) the least intrusive method (approach) available to achieve the specified purpose? 
3. The third assessment relates to the balancing test. The responsible party should balance the legitimate interest of that responsible party against the interests and rights of the data subject. The rights of the data subjects will override the interests of the responsible party or a third party. In the balancing test, the responsible party should determine factors not limited to the following:
   1. the nature of the personal data it wants to process and whether the processing involves any type of personal information that falls under the special personal information in terms of section 27 (1) of POPIA e.g. (biometric information, health information, genetic information) or the processing personal information is related to children and minors. There are stricter requirements for the processing of the latter type of personal information. In addition to the preceding considerations in (a) to (c), the responsible party should ask the following questions
      1. Is the personal information such which data subjects are likely to consider as ‘private’?
      2. Is the personal information about the data subjects in their personal or professional capacity?
   2. the reasonable expectations of the data subject who will be affected by the processing and
   3. the likely impact of the processing on the data subject and whether any safeguards can be put in place to mitigate the negative impacts

NOTE: This is only a summary of part of the Guidance note. Readers are strongly encouraged to read the whole Guidance Note on Direct Marketing in terms of the Protection of Personal Information Act.

We will provide further information in later parts of this article.