Protection of personal information: An experiment involving data value chains and the use of personal information for marketing purposes in South Africa

Abstract

South Africa enacted the Protection of Personal Information Act 4 of 2013 (POPI) in an effort to curb the misuse of customers’ personal information by organisations. The aim of this research was to establish whether the South African insurance industry is adhering to certain prescripts of POPI, focusing on direct marketing requirements. An experiment was utilised to monitor the flow of personal information submitted to 20 insurance companies requesting short-term insurance quotations, using new e-mail addresses and phone numbers. The results of the experiment indicate that 92% of the marketing communication received did not have prior consent from the researcher. Contact was made by companies outside the sample, indicating third-party sharing. 86% of the unsolicited short message service (SMS) communication received required customers to pay for unsubscribing from SMSs, which is not in line with regulatory requirements. The non-compliance evident in this experiment acts as an early warning to the insurance industry and South Africa, prompting a more concerted effort towards preparation of compliance with POPI. A personal information processing management framework is proposed to aid the insurance industry in understanding how personal information can be processed in line with the requirements of the Act.

Make personal information security great again: A case of users’ perspectives on personal identifiable information in South Africa

“…Studies have shown that PII can be monetised and have commercial value (Da Veiga & Swartz 2016). Companies can use PII for targeted marketing campaigns, improved business intelligence and strategic advantage (Zenda, Vorster & Viega 2020). Personal identifiable information is considered a tradable commodity, and new markets are emerging to trade such valuable information (Spiekermann et al 2015).…”

“…In South Africa, there was legislation promulgated on the 19th of November 2013, known as the Protection of Personal Information (POPI) Act, meant to protect individual PII collected, stored and processed by both public and private companies, which took effect in 2021 with the grace period elapsing in 2022 (Taplin 2021). The POPI Act prohibits companies from using PII for direct marketing without consent (Zenda et al 2020). The POPI Act takes cognisance of personal information such as users' gender, health, race, sex, religion, disability, age and education (Mabeka 2018).…”

A study on information privacy concerns and expectations of demographic groups in South Africa

“…Individuals can opt out of future direct marketing and potential customers may only be contacted once, whereafter they must opt in for future direct marketing. Studies showed that the opt-in and optout choices of customers are not met (Zenda, Vorster & Da Veiga, 2020). As such, organisations should review their marketing processes and implement measures to comply with the direct marketing requirements of the Act.…”