By: Myles Illidge – MyBroadband

South Africa’s Information Regulator has decided that telemarketing amounts to electronic communication and must be regulated in terms of the Protection of Personal Information Act (POPIA), with offenders who don’t change their ways facing fines up to R10 million or jail time.

This would come after an investigation and the issuing of an enforcement notice. Those who fail to adhere to the enforcement notice will then be issued an infringement notice and a penalty.

“Following receipt of a complaint on direct marketing, we would conduct an investigation, which may be followed by an enforcement notice,” the Information Regulator told MyBroadband.

However, it noted that it may also carry out a section 89 assessment on its own initiative or by request, which an assessment report will follow.

“The Assessment Report is equivalent to an enforcement notice,” it said.

“Should the responsible party fail to adhere to the instructions in an enforcement notice, this may result in us issuing an infringement notice which carries a fine of up to R10 million and/or imprisonment.”

Speaking to News24, Nomzamo Zondi, senior manager for communications at the Information Regulator, said the watchdog will issue its first enforcement notice this week.

“This enforcement notice is a result of our investigation into complaints about direct marketing,” she said.

The Information Regulator deems the entity in question to have violated the provisions of POPIA, and it has identified 14 other potential offenders on which it intends to issue enforcement notices.

In an interview with ITWeb, Information Regulator chair Pansy Tlaukula revealed that her organisation had completed a direct marketing guidance note to be put out for public consultation.

She added that she expects direct marketing companies to fight the changes, which involves adding a telemarketing clause within Section 69 of POPIA.

“The rules are very clear but I think with direct marketing. My sense is that we’ll probably end up being in court,” said Tlakula.

“They will wait for the time when there is a complaint, and once we decide against them, they’ll probably take us on review and the issue of whether a telephone is electronic communication or not will come to the fore.”

Tlakula explained that the issue isn’t that these companies call consumers for marketing. The problem is that they spam people with calls even if they decline the communication.

“If you decline the communication, they should stop, but they don’t stop,” she said, adding that she, too, is getting frustrated with the situation.

Information Regular baring its teeth

In July 2023, the watchdog issued South Africa’s Department of Justice and Constitutional Development (DoJ&CD) with an infringement notice and a R5-million fine, resulting from a ransomware attack the department suffered in September 2021.

The DoJ&CD had failed to comply with the enforcement notice it received from the watchdog on 9 May 2023.

Simply put, the Information Regulator deemed that the department was negligent regarding the protection of its systems, opening them up to an attack.

It instructed the DOJ&CD to submit proof that it had renewed the security software licences, which it said could have prevented or mitigated the ransomware attack.

“The thirty-one days given to the department expired on 9 June 2023,” the regulator said.

“To date, the department has not provided the Regulator with a report on (the) implementation of the actions required in the Enforcement Notice or any other communication in that regard.”

“The DoJ&CD has 30 days from 3 July 2023 to pay the administrative fine or make arrangements with the Regulator to pay the administrative fine in instalments or elect to be tried in court on a charge of having committed the alleged offence referred in terms of POPIA,” it added.

However, the Justice Department said it planned to appeal the punishment in court.