In the May edition of Tourism Tattler we deal with how the Protection Of Personal Information Act (POPI) addresses SPAM (section 69) i.e. approaching a data subject via electronic communication or mail for the purposes of for the purposes of promoting or offering to sell goods or services or to request a donation of any kind.
[box type=”info” width=”630″ ]Did you know that the word SPAM is not really an acronym. Although the “official” definition of the word SPAM is “Unsolicited email” the word was actually inspired by the Monty Python comedy troupe, who did a bizarre, hilarious sketch about a restaurant where every dish contains the canned meat Spam. For some reason, a band of Vikings is sitting in this modern-day restaurant, and at odd moments they begin to sing, “Spam! Spam! Spam! Spam!” – Editor. [/box]
Processing (Bear in mind this includes assimilating, collating, disseminating and storing) of personal information (‘PI’) of Data Subject (‘DS’) for the purposes of Direct Marketing (as defined above – same definition as CPA) (‘DM’) by means of automated calling machines (i.e. no human intervention), fax machines, SMS or e-mail is prohibited unless the DS has consented or is a customer of the responsible person (‘RP’).
If it is a customer the following requirements must be met:
- The contact details (not defined) of the customer must have been obtained in the process of a sale of products or services: it is suggested you include all telephone numbers (land and mobile) and addresses (postal and physical) and identity number;
- The purpose of the DM must be must be the RP’s own similar products or services – it is suggested that the word ‘similar’ may well be narrowly interpreted to avoid abuse so if a sports store sells a customer e.g. soccer boots, unless the consent given is very wide (which is recommended), it cannot send marketing material to the customer about tennis rackets!;
- DS must be given a reasonable opportunity to object, ‘free of charge and in a manner free of unnecessary formality’ to use of his/her electronic details (Compare ‘contact details’ above):
- § at the time the information was collected AND
- § each DM communication, if such use was not initially refused [opt out].
Each DM communication must contain the following:
- Details sender/party on whose behalf it is sent;
- Address for DS send a ‘stop’ request.
Directories:
- A DS whose PI is contained in any electronic or printed directory must be advised free of charge and before the PI is used;
- If the DS does not initially refuse DS must be given reasonable opportunity to object free of charge to use or to request withdrawal of PI;
- In the case of fixed line and mobile phone directories produced prior to POPI, DS must be advised as above and may have information withdrawn.
Automated decision making:
- If a DS’ PI is processed for the purposes providing a ‘profile of aspects of his personality or personal habits’, the DS cannot be held to any decision that has legal consequences flowing from that;
- This not applicable if doing so is part of a contract; at the request of the DS and ‘appropriate measures have been taken to protect the DS’ legitimate interests’, including:
- § DS must have an opportunity to make representations; AND
- § The RP must provide the DS with ‘sufficient information about the underlying logic’ of the automated processing so that DS can make the aforesaid representations.
Disclaimer: This article is intended to provide a brief overview of legal matters pertaining to the travel and tourism industry and is not intended as legal advice. © Adv Louis Nel, ‘Louis The Lawyer’, May 2014.
