Big spam call loophole in South Africa

Telemarketers in South Africa must request consent to market to an individual through their first call to individuals. However, no regulation specifies a limit to how many times telemarketers can call to request consent.

Therefore, telemarketers could spam call South Africans to request consent if they don’t answer these calls.

This is according to Information Regulator chair Pansy Tlakula, who admitted during a media briefing on Wednesday, 11 September 2024, that nothing prevents telemarketers “from calling you until they find you”.

“What is important is that that first call should be for obtaining your consent. Members of the public have to be educated on that,” she said.

Tlakula added that if a telemarketer contacts you for the first time and immediately attempts to market products or services, it is the recipient’s responsibility to confront the telemarketer about not obtaining their consent.

She explained that, from her own experience, the “unsubscribe” or “opt-out” links sent via direct marketing SMSes or emails are useless.

“Try to click on unsubscribe. I will tell you the following day you will receive the same message. It means the system is not working,” said Tlakula.

“I have personal experience of clicking unsubscribe, but all the time, I keep on receiving messages from companies I have unsubscribed from.”

In February 2024, the Information Regulator issued a direct marketing guidance note for public consultation that designates telemarketing as a form of electronic communication that must be regulated under the Protection of Personal Information Act (POPIA).

Those found to contravene the act through telephonic marketing could face fines of up to R10 million or jail time.

“Following receipt of a complaint on direct marketing, we would conduct an investigation, which may be followed by an enforcement notice,” the Information Regulator said.

It also noted that it may carry out a section 89 assessment on its own initiative or by request.

“The Assessment Report is equivalent to an enforcement notice,” it said.

“Should the responsible party fail to adhere to the instructions in an enforcement notice, this may result in us issuing an infringement notice which carries a fine of up to R10 million and/or imprisonment.”

The Information Regulator slapped FT Rams Consulting with an enforcement notice in late February 2024 over spam calling.

However, this was because the company allegedly didn’t unsubscribe people when asked to do so and not because it called them without consent.

The watchdog found the company to be in contravention of various sections of POPIA.

“The Regulator received a complaint from a data subject (a person about whom the personal information relates) following countless direct marketing messages received by them,” it said.

“Regardless of the multiple attempts to opt out and requests to be removed from the company emailing list, FT Rams Consulting blatantly ignored the pleas from the data subject and continued to send them marketing messages on email.”

Following an investigation, the regulator determined that FT Rams Consulting had obstructed protecting the data subject’s personal information, thus breaching POPIA.

It instructed the firm to stop sending unsolicited direct marketing messages via any means of electronic communication to which a data subject has not consented.

It must also ensure that the first communication it sends to a data subject requests their consent, and it can only do so once for each data subject.

It gave FT Rams Consulting 90 days to comply with its instructions and provide evidence of its compliance. If it failed to do so, it would be subject to a fine of up to R10 million or imprisonment for up to 10 years.

However, this period has lapsed, and the Information Regulator has yet to reveal the outcome.