In more detail

The Department of Trade, Industry and Competition has called for public comments by 15 January 2025 on the proposed amendments to the Consumer Protection Act (CPA) Regulations, 2011, which amendments are targeted at bolstering remedies available to consumers to combat unsolicited direct marketing practices ("Proposed Amendments").

The Proposed Amendments focus on direct marketing by means of unsolicited electronic communication, particularly, the establishment and operation of the opt-out registry (to be administered by the National Consumer Commission ("Commission")), which will enable consumers to pre-emptively block unsolicited electronic communication from direct marketers.

Understanding the Proposed Amendments

The following are the key changes with respect to direct marketing by means of electronic communication that will be implemented once the Proposed Amendments are finalised and in force:

• Pre-emptive block: Consumers will be able to register a pre-emptive block (in the prescribed form) in the opt-out registry to avoid receiving unsolicited direct marketing electronic communication from direct marketers. 
• Opt-out registry: The opt-out registry will be operated and managed by the Commission.
• Direct marketer obligations: A direct marketer is defined in the Proposed Amendments as a person who engages in direct marketing. A direct marketer will, amongst other things, have to register as such in the opt-out registry prior to contacting any consumer for purposes of direct marketing via electronic communication. Direct marketer registration is subject to annual renewal and payment of the prescribed fee. In addition, direct marketers will have to check their contact list against the opt-out registry before sending marketing messages via electronic communication. To the extent that the consumer's details are on the opt-out registry, direct marketers must refrain from sending marketing messages to that consumer via electronic communication. There is also an obligation on the direct marketer to remove from its database all data of persons who have registered a pre-emptive block by cleansing such data monthly with the Commission. 
• Consumer obligations: To prevent receiving marketing messages via electronic communication, consumers must register a pre-emptive block in the opt-out registry in the prescribed form. It is the consumer's responsibility to ensure that their information in the opt-out registry is always up to date. 
• Enforcement: A consumer who receives a direct marketing message by way of electronic communication despite having registered a pre-emptive block on the opt-out registry, may file a complaint to the Commission using the updated complaint form provided in the Proposed Amendments. After concluding an investigation into a complaint, the Commission may issue a compliance notice to the relevant direct marketer setting out, amongst other things, any steps that are required to be taken and the period within which those steps must be taken and any penalty that may be imposed in terms of the CPA if those steps are not taken. If the direct marketer fails to comply with the compliance notice, the Commission may either: (a) apply to the National Consumer Tribunal ("Tribunal") for the imposition of an administrative fine; or (b) refer the matter to the National Prosecuting Authority for prosecution as an offence. The Tribunal may impose an administrative fine not exceeding the greater of: (a) 10 % of the direct marketer’s annual turnover during the preceding financial year; or ZAR 1,000,000. Further, failure to comply with a compliance notice is an offence, and a direct marketer convicted of such an offence may be liable to a fine or to imprisonment for a period not exceeding 12 months, or to both a fine and imprisonment. However, no direct marketer may be prosecuted for such an offence in respect of the compliance notice if, as a result of the failure of that direct marketer to comply with that notice, the Commission has applied to the Tribunal for the imposition of an administrative fine.

As mentioned, the Proposed Amendments apply to direct marketing by means of unsolicited electronic communication, which is also regulated in terms of section 69 of the Protection of Personal Information Act No. 4 of 2013 ("POPIA"). We, therefore, consider below how these changes impact the provisions of POPIA.

Impact of the Proposed Amendments on the provisions of POPIA

Section 69 of POPIA prohibits processing of personal information of a data subject for the purpose of direct marketing by means of electronic communication, unless the data subject: (a) has given their consent to the processing; or (b) subject to compliance with the requirements set out in POPIA, is a customer of the responsible party (the person who determines the purpose of and means of processing of the data subject’s personal information).

Given the broad definition of a direct marketer in the Proposed Amendments, the responsible party and the operator will be deemed a direct marketer for the purposes of direct marketing via electronic communication. This means, once the Proposed Amendments are finalised and are in force, they will have to comply with the obligations imposed on direct marketers in terms of the Proposed Amendments, including registering in the opt-out registry as direct marketers before contacting any consumer for purposes of direct marketing via electronic communication.

It is important to note that, the implementation of the Proposed Amendments will not mean that a responsible party can send to a person a marketing message via electronic communication, because the person has not registered a pre-emptive block in the opt-out registry. The responsible party will still need to obtain the person’s consent (as prescribed in POPIA) for purposes of direct marketing via electronic communication. Further, it will seem that it will not be enough that the data subject is a customer of the responsible party and that all the requirements of POPIA have been complied with in relation to direct marketing by means of electronic communication to a customer of the responsible party. The responsible party will have to, in addition, check their customer contact list against the opt-out registry before sending them marketing messages via electronic communication, and must refrain from sending marketing messages to customers who have registered a pre-emptive block in the opt-out registry. In addition, the responsible party must remove from its database all data of persons (including customers) who have registered a pre-emptive block, by cleansing such data monthly with the Commission.

It will be interesting to see whether and how these proposed changes will be incorporated into the guidance note that the Information Regulator is expected to issue before the end of the year on direct marketing as regulated by section 69 of POPIA.

Concluding remarks on the Proposed Amendments

The Proposed Amendments represent a significant advancement in protecting consumer privacy and regulating direct marketing practices in South Africa, a welcome development in the face of rampant telemarketing strategies adopted by various businesses in South Africa. By establishing an opt-out registry, these amendments empower consumers to pre-emptively block unsolicited electronic communication, thereby enhancing their control over their personal information and reducing unwanted marketing intrusions. This initiative aligns with the objectives of POPIA, ensuring a comprehensive regulatory framework that prioritises the data subject’s privacy.

On the other hand, businesses will need to adapt to these changes by ensuring compliance when engaging in direct marketing practices by way of electronic communication. Such measures will come at increased compliance costs and may be a severe threat to many businesses who engage in practices these amendments aim to curb.

The successful implementation of these amendments will not only protect consumers but also foster a more respectful and responsible direct marketing environment in South Africa.