Will marketing be able to stand the test of time?
22 Jul 2019
In a previous life, suppliers could pretty much market as and how they wanted to. They could choose to whom, how, and what they wanted to market. Marketing messages were innovative, interesting and exciting (albeit not always true….).
This changed when a global emphasis on consumer and privacy rights started to emerge. In South Africa the position has not been any different and suddenly suppliers need to start considering complicated legal concepts like a “legitimate interest” when all they want to do is market their goods or services.
Data protection laws, like South Africa’s Protection of Personal Information Act, 4 of 2013 (“POPIA“), the EU’s General Data Protection Regulation, 2016/679 (“GDPR“) and Mauritius’ Data Protection Act, 2017 (“DPA“), all require that a lawful basis exists to use personal information – also for direct marketing.
What is a lawful basis for processing personal information?
These lawful bases are generally very similar across the different pieces of legislation in the different countries, and include various grounds, for example:
- Consent – it seems obvious that if a person agrees to it, then the information may be used.
- A requirement in law – again obvious that if there is a law that requires you to use information in a certain way, then you must do it – whether the person consents (and likes it) or not.
The most interesting one though, is the so called “legitimate interest” of the supplier or the person whose information it is. In terms of this lawful basis of use, it is lawful for a supplier to use personal information for direct marketing purposes, if the marketing is in the legitimate interests of the supplier. This begs the question: what would constitute a legitimate interest, especially considering that it is not defined by the law?
Legitimate interests
A three stage ‘test’ has been derived from the GDPR:
- Purpose – is there a legitimate reason or purpose for the processing? (Potentially yes – the supplier wants to increase sales through marketing).
- Necessity – is processing the information necessary for that purpose? (Potentially yes – how else will he increase sales?).
- Balance – is the legitimate interest overridden by the interests, rights and freedoms of the data subject? (This is the more difficult one as a balancing act between the supplier and person needs to be considered).
This is unfortunately a rather technical legal approach to the question and will require that the specific facts of each matter be considered before determining whether the legitimate interest justification ground can be relied on.
Additional legislative requirements
It is important to take note that in addition to the general justification grounds, specific legislation or provisions may require consent in certain circumstances. If this is the case, it will not be possible for a supplier to rely on the legitimate interest justification ground in all circumstances. An example is section 69 of POPIA which requires consent for electronic direct marketing in certain specified circumstances, for example, if you want to electronically market to someone who is not your customer yet. This means that if the intended marketing falls within the ambit of the section 69 consent requirements, the supplier will not be able to rely on the legitimate interest justification ground and will indeed need to obtain consent before being able to lawfully do the electronic marketing.
Conclusion
Sometimes you will need consent to do direct marketing. And sometimes you will be able to rely on your legitimate interests to do direct marketing. Make sure you understand your rights and obligations.
Please get in touch with us if you’d like advice on the specifics covered in this blog post or data protection laws in general. Although we are South African lawyers, we have experience in various data protection laws, including the GDPR, and the data protection acts of Mauritius and Botswana, amongst others.
See also:
- The complex issue of privacy when on the internet
- Will privacy laws like GDPR and POPI kill the direct marketer?
- Tweeting truthfully in paid posts – Advice for brands and influencers
