---

The client contact book is the heart and soul of the property business. They take years to build, often at great effort and even greater expense. But we also have to recognise that they contain private information about individuals, some of whom we have never met or had direct dealings with.

So what does POPIA have to say about this vital information that we all collect, store and use? Let’s remember that all personal information (being information relating to an identifiable, living natural person and, where it is applicable, an identifiable, existing juristic person) will have to be processed in accordance with POPIA. For a refresh on the relevant definitions, please refer to Series One, part 3

Let’s unpack it together…

I want to start off by asking, what are client contact books exactly?

Client contact books contain information about people who are/were looking to become home owners. These could be people you sold to in the past or potential home owners where no deal was ever finalised. In essence, previous clients or potential client’s information you have retained.

Are they only made up of clients you have dealings with?

No. Often you would buy contact details of home owners so you can contact them to see whether they’d like you to sell their home for them.

What kind of information do they typically contain about clients?

Usually records of what type of house someone was looking for at the time, their name and their contact details. A client’s name and contact details would be considered ‘personal information’ for purposes of POPIA.

Can you give an example of how someone would typically use a contact book?

Let’s say you get a new listing on your books. You would then open your contact book and call all clients who were looking for a similar listing to your new listing. So it’s kind of like matching someone’s search history to your new listing to see who might be a good fit and then contacting them to see if they are in the market to buy.
Another example is when you’re looking for more houses to sell. You would call up people you know to own a house, and find out if they’re thinking of selling, with the intention to secure the listing for yourself if they are.

But all those contact details are considered personal information, right?

Yes, essentially contact books contain personal information about individuals.

So once the POPIA grace period is over, will anyone be legally allowed to capture, store or even use those details to market their services to customers?

That depends. There are three different categories to consider:

• The first category deals with all the contact details from someone who is either currently a client or was a client in the past. It doesn’t matter whether you did a deal or not, if they gave you their contact details directly and asked you to find them a home or sell their home, they fall into this first category.
• Category two deals with all contact details gained from a Show Day. So if someone attended a Show Day and completed their details on your register, they fall into this category.
• The third and final category deals with the contact details you bought or were given by someone other than the Data Subject themselves. So if someone didn’t give you their details directly (and you obtained their details from any other source, other than the Data Subject), then they fall into this category.

So how does the POPI Act deal with each of these categories?

So let’s look at Category One, where you obtained the information directly from a client in the context of offering your services to them. If you still need or want to contact these clients about the same thing you got their details for originally, this would most likely be permitted under POPIA, as you are using their contact details for the conclusion or performance of a contract to which they are (or will likely be) a party.

But how do you know if someone is still in the market to buy?

You don’t always know, in which case if you’re looking to initiate a new engagement with them, POPIA gives you one opportunity to contact them for direct marketing purposes. If they’re not interested in your services, you are not permitted to contact them again unless you get their consent to do that. We will cover consent and its requirements in a future episode.

Does POPIA allow me to process the personal information of my clients?

Yes, it does. In two instances.

1. if you have obtained their details in the context of the sale of a product or service and you are using their details for purposes of this service (marketing their house for sale or assisting them in finding a house to purchase).
2. if you are contacting them for the purpose of direct marketing of your own products or services, provided that you follow the prescribed criteria of POPIA (which, in essence, requires you to give them a reasonable opportunity to object, free of charge, and without too much formality to use their details.

And what about direct marketing?

That depends on the type of direct marketing you use. POPIA only applies to direct marketing by electronic means, while the Consumer Protection Act, 2008 applies to all direct marketing. So, if you use unsolicited electronic communications you must comply with the provisions of POPIA and the Consumer Protection Act, 2008. But if you use choose the traditional direct marketing route, that does not involve unsolicited electronic communications, you will be subject to the Consumer Protection Act, 2008.

What do you mean by unsolicited electronic communications?

This refers to all text, voice, sound or image messages sent over an electronic communications network, which is either stored in the network or in the recipient's terminal equipment until it is collected by the recipient. Some examples of this are email, automated dialers & pre-recorded messages, voicemail messages, WhatsApp messages and SMSes.

So all other forms of communications around direct marketing would be considered traditional direct marketing?

Yes, that’s correct.

We’ve covered information gathered from past or present clients. What about information gained from Show Days?

The is Category two clients. This one is a bit more complicated. POPIA states that a Responsible Party (which would be the Estate Agent if the Estate Agent is collecting personal information from ‘data subjects’) may only process Personal Information if:

• a) the data subject consents to the processing
• b) processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party;
• c) processing complies with an obligation imposed by law on the responsible party
• d) processing protects a legitimate interest of the data subject;
• e) processing is necessary for the proper performance of a public law duty by a public body; or
• f) processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.

That is quite detailed. I guess it becomes a bit more complicated when you might not have direct or personal dealings with every person on your register.

Indeed. The purpose of that list is to make sure you are actually entitled to request their personal information in a Show Day register. If you have been through the criteria and feel you are entitled to collect it, then you must comply with the lawful conditions of processing that personal information, which includes, amongst the other requirements of POPIA, only collecting the absolute minimum information, safeguarding it and not using it for any other purpose other than the purpose for which is was collected.

What does that mean?

It means that if you want to use those details for direct marketing purposes, you must still obtain that person’s consent in the prescribed manner and form (POPIA has prescribed a form that must be used for this purpose). Their consent must also be voluntary, specific and informed. In other words you must be very clear about what that person is consenting to, and they must know they can say no if they want to.

And how many times can you approach a person to gain consent?

Once again, you can only approach them just one time, and only if that person has not previously withheld consent.

And what about the third category? The contacts that were bought or given indirectly?

Remember these contacts haven’t given you their direct consent to process their personal information for any purpose (including direct marketing). So in order to use (process) their personal information, you must obtain their consent. And for direct marketing purposes, you can contact them once to request their consent for direct marketing purposes, but only in the prescribed manner and form. And only if they have not previously withheld consent.

That sounds very complicated. What’s the safest bet?

To always seek consent from anyone you want to contact for direct marketing purposes. We’ll discuss consent in more detail in the next episode, more specifically around what is required when gathering that consent.