10. Consent required for direct marketing

10.—

1. A data controller shall not process personal data of a data subject for the purpose of direct marketing unless the data subject—

(a) consents to the processing for that purpose; or

(b) is, subject to subsection (4), a customer of the data controller.

2. A data controller shall not approach a data subject, whose consent is required in terms of subsection (1)(a), more than once in order to request that consent.

3. A request for consent in terms of subsection (1)(a) shall be made in the prescribed form and manner.

4. A data controller may, pursuant to subsection (1)(b), only process the personal data of a data subject who is a customer of that data controller—

(a) if the data controller has obtained the contact details of the data subject in the context of the sale of any goods or services;

(b) for the purpose of direct marketing of the data controller’s own similar goods or services; and

(c) if the data subject has been given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to such use of that data subject’s personal data—

(i) at the time the personal data was collected; and

(ii) on the occasion of each communication with the data subject for the purpose of direct marketing if the data subject has not refused such use.

5. Any communication to a data subject for the purpose of direct marketing shall contain—

(a) the details of the identity of the sender or the person on whose behalf the communication has been sent; and

(b) an address or other contact details to which the recipient may send a request that such communication cease.

6. In this Act, “direct marketing” means to approach a data subject in person or by any means of communication (whether electronic or otherwise) for the direct or indirect purpose of—

(a) promoting or offering to supply, in the ordinary course of business, any goods or services; or

(b) requesting a donation of any kind for any reason.