4.1.5 Electronic Processing for Direct Marketing and the Nature
of Consent
Both the POPI Act and the ECT Act make copious provisions for protection of
personal data in the context of electronic communications for marketing purposes.
With regard to the nature of consent required, it is my view that with respect to
electronic communication for direct marketing purposes, the POPI Act strangely
establishes both the opt-out and the opt-in system. This is because section 69 (2) provides that the processing of personal information of a data subject for the purpose of
direct marketing by means of electronic communication is prohibited unless a data
subject has given his (prior) consent. Consent according to the Act is “any voluntary,
specific and informed expression of will in terms of which permission is given for
the processing of personal information”.
96 This clearly shows an ‘opt-in’ system is
envisaged. However, subsection 2 of section 69 provides that processing of personal
data electronically for direct marketing purpose may be lawful if the data subject is a
customer of the responsible party. The Act provides for some other conditions.
97 In
this case, it is arguable that the responsible party can process by default and it is left
for the data subject to object. This, in my view, shows an ‘opt-out’ system.
Unlike the POP I Act, the ECT Act unequivocally provides for an ‘opt-out’
system. In terms of the latter Act, “Any person who sends unsolicited commercial
communications to consumers, must provide the consumer with an option to cancel
his or her subscription to the mailing list of that person”.
98 But then, it must be stated
that all of the provisions of the ECT Act relating to data protection will be repealed
when the POPI Act fully comes into force.
99
4.1.6 Protection of Employees’ Personal Data in the Context
of Electronic Processing
The POPI Act has a broad scope to cover personal information processing of
employees through electronic means provided it “forms part of personal information
entered in a record by or for a responsible party making use of automated or
non-automated means”.
100 It does not discriminate in terms of personal information
of employees.
Regulator. This can be found in http://www.justice.gov.za/inforeg/docs/InfoRegSARegulationsDraft-Aug2017.pdf.
96 Section 1 of the POPI Act.
97 See Section 69(3) of the POPI Act.
98 Section 45 of the ECT Act. See also Roos (2016a), p. 425.
99 See the Schedule to the POPI Act.
100 See Section 3(1)(a) of the POPI Act.
Data Protection in the Internet: South Africa
361
of Consent
Both the POPI Act and the ECT Act make copious provisions for protection of
personal data in the context of electronic communications for marketing purposes.
With regard to the nature of consent required, it is my view that with respect to
electronic communication for direct marketing purposes, the POPI Act strangely
establishes both the opt-out and the opt-in system. This is because section 69 (2) provides that the processing of personal information of a data subject for the purpose of
direct marketing by means of electronic communication is prohibited unless a data
subject has given his (prior) consent. Consent according to the Act is “any voluntary,
specific and informed expression of will in terms of which permission is given for
the processing of personal information”.
96 This clearly shows an ‘opt-in’ system is
envisaged. However, subsection 2 of section 69 provides that processing of personal
data electronically for direct marketing purpose may be lawful if the data subject is a
customer of the responsible party. The Act provides for some other conditions.
97 In
this case, it is arguable that the responsible party can process by default and it is left
for the data subject to object. This, in my view, shows an ‘opt-out’ system.
Unlike the POP I Act, the ECT Act unequivocally provides for an ‘opt-out’
system. In terms of the latter Act, “Any person who sends unsolicited commercial
communications to consumers, must provide the consumer with an option to cancel
his or her subscription to the mailing list of that person”.
98 But then, it must be stated
that all of the provisions of the ECT Act relating to data protection will be repealed
when the POPI Act fully comes into force.
99
4.1.6 Protection of Employees’ Personal Data in the Context
of Electronic Processing
The POPI Act has a broad scope to cover personal information processing of
employees through electronic means provided it “forms part of personal information
entered in a record by or for a responsible party making use of automated or
non-automated means”.
100 It does not discriminate in terms of personal information
of employees.
Regulator. This can be found in http://www.justice.gov.za/inforeg/docs/InfoRegSARegulationsDraft-Aug2017.pdf.
96 Section 1 of the POPI Act.
97 See Section 69(3) of the POPI Act.
98 Section 45 of the ECT Act. See also Roos (2016a), p. 425.
99 See the Schedule to the POPI Act.
100 See Section 3(1)(a) of the POPI Act.
Data Protection in the Internet: South Africa
361