The impact of POPI on your business cannot be ignored as POPI will place the onus on businesses to protect any personal data processed by it and failure to comply may result in administrative fines while offences in terms of POPI may result in criminal charges or even prison sentences. However, the greatest potential risk to an organisation is reputational.
At a presentation by Routledge Modise Attorneys, Simone Monty, director, presented some key insights into POPI and the Consumer Protection Act (CPA.), particularly in respect of direct marketing and the issues surrounding "opting in" and "opting out" - which are a major concern not only for marketing and advertising companies but for any organisation which uses marketing to enhance its business.
"It is necessary to understand that there is a distinction made by POPI between electronic and non-electronic marketing. While both forms of marketing are dealt with in both POPI and the CPA, POPI makes a number of strict and specific provisions which require compliance when using unsolicited electronic marketing," says Monty.
In respect of the unsolicited electronic marketing, she explains that POPI requires "opt in" consent, subject to certain exceptions for pre-existing consumers. Even once the consumer has "opted in", he/she must still be given the option to opt out at the time of each marketing communication.
The requirements of POPI are more onerous than the CPA which only requires that the consumer be given the option to opt out. Once POPI is in force it will override the CPA, and the requirement of "opt in" consent will need to be met by businesses.
Monty emphasised that POPI does not prohibit direct marketing. Rather, businesses making use of direct marketing once it is in force will have to comply with the more onerous requirements of POPI.
Monty further emphasised the importance of the wording of contracts entered into with existing clients as well as new clients in respect of consent to receive marketing communications. Consent does not need to be written and can be verbal. However businesses must remember that the onus to prove that consent has been given lies with them, and non-written consent should be recorded so as to provide sufficient proof of consent.
In addition, subject to exceptions, POPI requires that information is collected directly from the consumer.
Her advice to marketing and advertising agencies is to work closely with their clients to ensure these requirements are met in compliance with the law.
• POPI gives more protection to consumers than the CPA so when it comes into force it will prevail over the CPA. Where POPI and the CPA apply at the same time, and if there is conflict then the one that gives greater protection will apply.
• When POPI is signed by the President into law, companies will have a year to comply. However it is important to start now to ensure business processes comply timeously.
• The communication to the consumer must be easily understandable, clear and provide an easy option to opt out.
