South Africa: Information Regulator Issues First Enforcement Notice in Direct Marketing Complaint

South Africa: Information Regulator Issues First Enforcement Notice in Direct Marketing Complaint

March 5, 2024, Covington Alert

On February 27, 2024, the Information Regulator (South Africa) (“IR”) published a media statement announcing the first enforcement notice being issued for a failure to comply with the direct marketing provisions of South Africa’s Protection of Personal Information Act, 2013 (“POPIA”).

POPIA generally prohibits marketers from processing personal information for the purposes of direct marketing by unsolicited electronic means unless the data subject has given their consent, or the email recipient is an existing customer. In the latter case, the marketer must have obtained the data subject’s details through the sale of a product or service, and the marketing should relate to similar products or services. The data subject must be given an opportunity to object to the use of their personal information for marketing on each occasion that the marketer communicates with the data subject for marketing purposes.

This groundbreaking move is in line with the IR’s long publicized intention to crackdown on companies violating POPIA’s direct marketing rules. While the IR’s most recent media statement has not set a date for publication of the long-awaited guidance note on direct marketing, it seems likely that the IR will be releasing this guidance soon given recent developments

Failure to comply with the provisions of the enforcement notice could result in a fine of up to ZAR10 million (approx. US$524,000), or imprisonment for a period not exceeding 10 years, or to both such a fine and imprisonment.

Our team would be happy to address any questions you may have.