The document provides an overview of various laws and regulations that affect direct marketing in South Africa, including the Protection of Personal Information Bill. It summarizes the key principles of the PPI Bill, such as obtaining consent for collecting and using personal information, ensuring information is accurate and securely stored, and giving consumers control over how their information is used. The Bill aims to protect privacy rights and regulate how personal data is handled, with provisions for opt-in requirements for electronic messages and the establishment of an Information Regulator responsible for enforcement. Industry associations can develop codes of conduct to achieve self-regulation under oversight of the Regulator.

1. DIRECT MARKETING ASSOCIATION OF SOUTH AFRICA

2. A recession is a terrible thing to waste!

3. Disclaimer The views expressed on this presentation are my own and do not necessarily represent the views of the association The presentation should serve as a guideline and not legal advise. If this was legal advice I would have sent you invoices by now! 5/26/2010

4. I lied! Protection of Personal Information Bill B09 of 2009 5/26/2010

5. Our journey today Brief history of the DMA Laws that affect Direct Marketing The Constitution and Bill of Rights Act 108 of 1996 The Promotion of Access to Information Act no 2 of 2000 The Promotion of Administrative Justice Act no 3 of 2000 Electronic Communications and Transactions Act no 25 of 2002 Electoral Act of 1998 Identification Act of 1997 Unfair Discrimination and Promotion of Equality Act of 2000 Unfair Businesses Act of 1988 The Lotteries Act no 57 of 1997 National Credit Act no 34 of 2005 Consumer Protection Act Protection of Personal Information Bill 5/26/2010

6. Brief History of the DMA Re-Founded in November 2005 The DMA currently has 289 members and 10 founder members Members range from agencies to large corporate companies and service providers Our 10 founder members are AVIS, HOME CHOICE, ABSA, FNB , NEDBANK, MTN, SAPO, PLATINUM e-PRODUCTS, COMPUTER FACILITIES AND RCS GROUP The DMA currently holds self regulatory status from the DTI 5/26/2010

7. More media = greater sophistication- more laws to deal with Print TV Unaddressed Radio mail E-mail E-Commerce E-mail Mobile Specialized print Telephone Word of mouth Sponsorship 7 Sales promotion

9. DM Spend in 2007/2008 5/26/2010

10. DM Spend in 2009-ESTIMATE 5/26/2010

11. Never before has one industry been hit by so many Laws!!- lets start our journey through the law jungle! 5/26/2010

12. The Constitution and the Bill of Rights Act 108 of 1996 5/26/2010

13. The Promotion of Access to Information Act no 2 of 2000 5/26/2010

14. The Promotion of Administrative Justice Act no 3 of 2000 5/26/2010

15. Electronic Communications and Transactions Act no 25 of 2002 (e-mails, SMS, Faxes, Telemarketing) 5/26/2010

16. The Electoral Act 1998 5/26/2010

17. The identification Act 1997 5/26/2010

18. Unfair discrimination & promotion of Equality Act 2000 5/26/2010

19. Unfair Business Practices Act of 1988 and subsequent legislation (i.e. negative options, pyramid selling, revolving money schemes, marketing promotions, debt consolidation and recalculation)- DMA uses it as a best practice guideline 5/26/2010

20. The lotteries Act 57 of 1997 5/26/2010

21. National Credit Act 34 of 2005 5/26/2010

22. What the regulator says Cap banks:- payroll retail 5/26/2010

23. Regulations that affect us? 75 Marketing and sales of credit at home or work 74 Negative option marketing and opting out requirements Advertising practices 119 Increases in limits R21 Required content for advertising R22 Required format for advertising Definition of advertising 5/26/2010

24. Credit bureaus code of Ethics and other ombudspersons 5/26/2010

25. Consumer Protection Act 68of 2008 5/26/2010

26. RIGHT TO STOP UNWANTED MARKETING MESSAGES- we don’t call it junk mail. SECTION 11 5/26/2010

28. TIME TO CONTACT THE CONSUMERS SECTION 12

29. EXPIRY AND RENEWAL OF FIXED TERM AGREEMENTS SECTION 14 5/26/2010

30. COOLING OFF PERIOD – 5 WORKING DAYS SECTION 16 5/26/2010

31. PLAIN AND UNDERSTANDABLE LANGUAGE SECTION 22 5/26/2010

32. DISCLOSURE OF PRICE AND SERVICES SECTION 23 5/26/2010

33. DISCLOSURE OF INTERMEDIARIES SECTION 27 5/26/2010

34. GENERAL STANDARDS OF MARKETING SECTION 29 5/26/2010

35. BAIT MARKETING- GOODS ADVERTISED MUST BE AVAILABLE SECTION 30 5/26/2010

36. NEGATIVE OPTION MARKETING SECTION 31 5/26/2010

37. DELIVERING GOODS WITHOUT PAYMENT SECTION 32 5/26/2010

38. CATALOGUE MARKETING SECTION 33 5/26/2010

39. TRADE COUPONS AND PROMOTIONS VOUCHERS SECTION 34 5/26/2010

40. LOYALTY PROGRAMMES- INTENTION TO HONOUR PROMOTIONS SECTION 35 5/26/2010

41. PROMOTIONAL COMPETITIONS SECTION 36 5/26/2010

42. REFERRAL SELLING/MARKETING SECTION 38 5/26/2010

43. Unconscionable conduct SECTION 40 5/26/2010

44. CONSUMERS RIGHT TO DEMAND QUALITY PRODUCTS AND SERVICE SECTION 54 5/26/2010

45. GUARANTEES AND WARRANTEES SECTION 56 5/26/2010

46. LIABILITY FOR DAMAGE TO GOODS SECTION 61 5/26/2010

47. Protection of personal information (data privacy) draft 5/26/2010

48. Content Overview: Timetable, aim 9 principles Exceptions and special provisions Automatic electronic communications Consent/purpose The Regulator Codes of conduct table of content of the Bill Conclusion

49. Timetable for introduction of PPI Bill (09)of 2009 was tabled in August to Parliament by Cabinet. It will now go through the Parliamentary process: hearings before the National Assembly portfolio committee. Could be signed by the President first half of 2010. It will then take another year before the start of its implementation, including the drafting of regulations, the setting up of a National Information Regulator’s office and other support structures. So there is time for all businesses to prepare their operations and minimize the impact of the legislation.

50. The aim of PPI To give effect to the constitutional right to privacy To regulate the manner of collection, usage, processing, retention and deletion of personal information A statutory regulatory agency to be established, information commissioner: to register, monitor, regulate, educate and prosecute the offences To endorse codes of conduct to make industry sectors self-regulated To fall in line with international standards for trans border data flow The law applies to all private and public bodies who handle personal information .

51. 9 principles in PPI Bill Personal information must be: Obtained fairly and lawfully and disclosing the purpose (purpose driven) and used only for the original specified purpose Adequate, relevant and not excessive to purpose Get consent as far as it is practical and offer an opt-out option (consent) In some cases opt-in will be mandatory Accurate and up to date and delete if requested (control) Accessible to the subject Kept securely and destroyed after its purpose is completed The responsible party has an obligation to comply with all principles Trans borders compliance They are exclusions and exemptions for each principle and certain circumstances.

52. 1.Accountability Designate a staff manager to be responsible for adherence to privacy principles throughout the company Draft a company privacy principles code to be used by all departments Train all staff affected Subscribe to an industry code, advise and scrutinize Register with Information Regulator

53. 2. Disclosure When gathering data from individual consumers marketers shall advise them of: What information is being collected How the information will be used Record their consent When acquiring a list from another organization, must insure that consent was obtained for such usage

54. 3.Controlling the use of information (purpose) The purpose for which information is collected shall be identified before the time of collection The collection shall be limited to what is necessary as identified by the company All involved in the use, transfer, rental, sale or exchange of data must be aware of the exact nature of the list’s intended usage

55. 4.Safe storage of information of customers All those involved in the use, transfer, rental, sale or exchange of mailings lists should agree to be responsible for the protection of data and take appropriate measures to ensure against unauthorized access, alteration or dissemination of list data

56. 5.Respect for confidential and sensitive information Lists owners and users must be protective of consumer’s rights to privacy of sensitive information like religion, health and sex life, race, political persuasion and criminal behaviour and positive consent will have to be obtained ( some industry exceptions)

57. 6.Give consumers control of usage of information Make reasonable efforts to provide personal own information to consumers on request The marketer must remove the consumer’s name from all internal lists or rental to third parties at the request of the consumer at anytime of such request The marketer must amend any personal information at the request of the consumer or when aware of changes to the data. There is a duty of accuracy in keeping the information (present requirement of PAIA of 2000)

58. 7. Security safeguards Ensure the integrity of personal information and unlawful access Information processed by person acting under authority of responsible party Security measures in place Notification of security compromises to regulator and data subjects

59. 8.Information no longer required Formal guidelines and implementation procedure guidelines must be develop to ensure safe destruction or disposal of personal information no longer required.

60. Exceptions and special provisions Note: Public Domain is excluded Separate provision has been made for the protection of special (sensitive) personal information like religion, health and sex life, race, political persuasion and criminal behaviour. Section ( sect 66) regulates the unsolicited electronic communications to ‘opt-in” conditions (except for present customers) (sect 67) regulates the compilation and use of directories and ( sect 68) automated decisions making Deals with the privacy and advertising to children.

61. PPI: E-mail, SMS, Fax, automatic dialing machines offers section 66 mandates that consent is obtained before contacting new consumers by Email, SMS, automatic SEQUENTIAL dialing machines- opt-in requirement- (spam protection). Does not apply to telemarketing Positive consent does not apply for existing customers ECT Act to be reviewed

62. “consent” “purpose” and usage “purpose” for collection and usage must be disclosed up front “Consent” means any freely given, specific and informed expression of will where data subjects agree to the purpose of usage and processing of personal information An “opt-out” system presumes that the consumer wants to be contacted fro marketing offers BUT the system allows people to block the use of their information. An “opt-in” system presumes that the consumer does not want to be contacted ( even if the information is from publicly available source) and it requires that every consumer be contacted to gain explicit permission. “Implied consent” can apply to existing customers

63. Regulator’ office & Complaints Establishment of a Regulator as an independent authority to administer the Bill, issuing codes of conduct, registering companies who intend to process personal information ( to check the purpose and transparency compliance) Procedures set out to lodge a complaint with the Regulator Regulator’s powers and procedures outlined Regulates the investigations process Offences and penalties

64. Codes of conduct Provisions in the Bill for registration by Associations of business sectors codes. If the code accepted by the Regulator, the sector becomes selfregulated and report to the regulator on its processing of complaints and , from time to time ,has its code reviewed Should a company not adhere to the recommendations of the Association, the remedies and penalties of the Bill will apply. An industry with a Code will also vet its members for compliance to the Bill, and if accepted as a member, the process of prior investigation will not be done by the Regulator.

65. Conclusion ON THE PPI Requirements as Industry standards to reflect: High degree of transparency and responsibility in gathering and handling consumers’ personal information, emphasis on security safeguards of databases and computer systems Set standards for opt-in and opt-out procedures and registers Set standards for active, technical, management changes to current practices for information gathering and handling Encourage companies to have privacy policy and communication with staff, training to handle procedures Registration with the Information Regulator and negotiation to have the standards endorsed under the PPI or be member of an accredited industry association.

66. Table of content of the Bill ( 12 chapters) Chapter 1 : Definitions and purpose Chapter 2 : Application provisions Chapter 3 : Principles and processing of information Chapter 4 : Exemptions Chapter 5 : Information Protection Regulator Chapter 6 : Notification and prior investigation

67. Table of content of the Bill ( contd) Chapter 7 : Codes of conduct Chapter 8 : Unsolicited electronic communications Chapter 9 : Trans-border information flows Chapter 10 : Enforcement Chapter 11 : Offences and penalties Chapter 12 : General provisions

68. Banking and Financial institutions legislation and Codes 5/26/2010

69. The DTI and other BEE business codes, charters 5/26/2010

70. The DMA and our industry way forward 5/26/2010

71. Siyabongabrian@dmasa.orgwww.dmasa.org 5/26/2010