The processing of personal information of a data subject for the purpose of direct marketing by means of any form of electronic communication, including automatic calling machines, facsimile machines, SMSs or e-mail is prohibited unless the data subject—has given his, her or its consent to the processing; or
is, subject to subsection (3), a customer of the responsible party.
A responsible party may approach a data subject—whose consent is required in terms of subsection (1)(a); and
who has not previously withheld such consent,
only once in order to request the consent of that data subject.
The data subject’s consent must be requested in the prescribed manner and form.
A responsible party may only process the personal information of a data subject who is a customer of the responsible party in terms of subsection (1)(b)—if the responsible party has obtained the contact details of the data subject in the context of the sale of a product or service;
for the purpose of direct marketing of the responsible party’s own similar products or services; and
if the data subject has been given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to such use of his, her or its electronic details—at the time when the information was collected; and
on the occasion of each communication with the data subject for the purpose of marketing if the data subject has not initially refused such use.
Any communication for the purpose of direct marketing must contain—details of the identity of the sender or the person on whose behalf the communication has been sent; and
an address or other contact details to which the recipient may send a request that such communications cease.
‘‘Automatic calling machine’’, for purposes of subsection (1), means a machine that is able to do automated calls without human intervention.
A data subject who is a subscriber to a printed or electronic directory of subscribers available to the public or obtainable through directory enquiry services, in which his, her or its personal information is included, must be informed, free of charge and before the information is included in the directory—about the purpose of the directory; and
about any further uses to which the directory may possibly be put, based on search functions embedded in electronic versions of the directory.
A data subject must be given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to such use of his, her or its personal information or to request verification, confirmation or withdrawal of such information if the data subject has not initially refused such use.
Subsections (1) and (2) do not apply to editions of directories that were produced in printed or off-line electronic form prior to the commencement of this section.
If the personal information of data subjects who are subscribers to fixed or mobile public voice telephony services have been included in a public subscriber directory in conformity with the conditions for the lawful processing of personal information prior to the commencement of this section, the personal information of such subscribers may remain included in this public directory in its printed or electronic versions, after having received the information required by subsection (1).
‘‘Subscriber’’, for purposes of this section, means any person who is party to a contract with the provider of publicly available electronic communications services for the supply of such services.
Subject to subsection (2), a data subject may not be subject to a decision which results in legal consequences for him, her or it, or which affects him, her or it to a substantial degree, which is based solely on the basis of the automated processing of personal information intended to provide a profile of such person including his or her performance at work, or his, her or its credit worthiness, reliability, location, health, personal preferences or conduct.
The provisions of subsection (1) do not apply if the decision—has been taken in connection with the conclusion or execution of a contract, and—the request of the data subject in terms of the contract has been met; or
appropriate measures have been taken to protect the data subject’s legitimate interests; or
is governed by a law or code of conduct in which appropriate measures are specified for protecting the legitimate interests of data subjects.
The appropriate measures, referred to in subsection (2)(a)(ii), must—provide an opportunity for a data subject to make representations about a decision referred to in subsection (1); and
require a responsible party to provide a data subject with sufficient information about the underlying logic of the automated processing of the information relating to him or her to enable him or her to make representations in terms of paragraph (a).