The next time a call centre agent tells you they got your number from the “national consumer database”, ask to speak to their manager. Aside from the fact that no such list exists, the Protection of Personal Information Act (Popi) — which, in case you missed it, is law — holds any entity handling personal information responsible for how that information was obtained.

So, how do companies get their data (and your number) in the first place? “It’s a grey area,” admits Warren Moss, chairman of the Direct Marketing Association of South Africa (DMASA). Most lead brokers have built up their data over many years and before there were any laws regulating the access and exchange of that data.

Certain sections of Popi came into effect only in April 2014, while the office of the Information Regulator (to actually enforce the act) is still being established. Moss expects this to happen in the next few months, after which companies will have an 18- to 24-month grace period to be Popi compliant.

“In the past, banks, insurers and cellphone companies would buy data from anyone. Now that there are laws governing the industry, they make sure they buy from reputable companies,” says Moss.

DMASA has an accreditation called the Centres of Excellence, which audits the Popi compliance of list brokers and has 13 accredited brokers. Needless to say, lead brokering, or list brokering, is a perfectly legitimate business practice. Companies can either buy or rent lists from these brokers for their direct marketing campaigns.

Blue Label Data Solutions, listed on DMASA’s Centres of Excellence list, is one such list broker. The company obtains its data in a variety of ways, according to Michael Campbell, investor and media relations executive. These include social media campaigns and opt-in competitions (such as Win a Scooter on Facebook); websites where you can register to receive loan offers (www.mobi-loans.co.za) or promotional deals (www.thinkmoney.co.za); credit bureau updates; public domain information; and using call centres to update existing consumer information.

“If you register on a site like MoneyMavericks or SaveMoney, you can opt in to receiving electronic communication around promotions and products. Some of the [direct marketing] agencies also work with media owners and their databases to generate leads. The entity sending any communication must be the owner of the opted in client’s details,” notes Johan Barnard, King Price’s GM for e-business.

“We’ve had instances in the past where we’ve cancelled agreements with marketing agencies for contravening existing legislation. Our agencies are all mandated by law to screen their databases against the national opt-out list,” he says.

Administered by DMASA, the national opt-out database enables you to opt out of all direct marketing communication.

“Any responsible marketer checks against this list. If you have been registered on the national opt-out list and you’re still receiving direct marketing calls, you should escalate that with the company concerned or contact DMASA via its website,” says Jaco Shutte, director of marketing services at TransUnion Analytic and Decisioning Solutions.

Red flags

That there was so little regulation governing the exchange of data in the past opened wide the doors to abuse. “A bank would literally give a list of numbers to a call centre manager on a memory stick, which was perfectly legal to do. But then that call centre manager gets fired and decides to sell the numbers he’s obtained to a list broker for R100 000 or more. And so the data gets traded and passed around,” DMASA’s Moss explains.

Popi enforces strict rules around how data is processed, stored, protected and shared. Good marketing and data businesses go to great lengths to ensure that data is protected, for example, servers are encrypted, and USB and disk drives are disabled, says Schutte.

A call centre agent phoning you from a non-financial services company should have only your name and ID number, adds Moss. If they have information about your income, who you bank with and what financial products you have, such information would have come from a credit bureau (if it was legally obtained) and in order to access credit-related bureau data they would need to be a member of the Credit Providers Association.

You can also check whether the company contacting you is a member of DMASA. While there is no legal obligation to be a member, the association holds members to a Code of Practice, which complies with existing data privacy laws.

“Consumers must stay vigilant when responding to direct marketing campaigns so as not to fall victim to phishing scams,” Schutte highlights.

Creating jobs and profit

Considering that most people I know don’t even take direct marketing calls (let alone make a purchasing decision off the back of them), the question arises: is the industry profitable?

It’s a “purely mathematical play”, says Moss. “The average call centre agent costs a company about R25 000/month and can make roughly 1 600 calls a month. Let’s say the company is selling personal loans and makes R1 000 profit per personal loan sold. If the agent converts only 10% to 20% of those calls, that amounts to between 160 and 320 sales or between R160 000 and R320 000 a month — for [a] R25 000 [salary]. It’s hugely profitable.”

According to Moss, the direct marketing industry directly employs around 150 000 people. It also arguably helps to grow small businesses and connect customers with value-added services. “Through direct marketing, businesses are able to offer great deals to customers who not only need them, but who also might have to travel great distances to access them through brick and mortar structures,” Schutte maintains.

While Moss does not expect major job losses as a result of Popi, he worries that it may hinder innovation. “South Africa’s data laws are stricter than most countries in the world and make it very expensive to use information. This makes it very difficult to start a business that is reliant on information,” he says.

“Under Popi, you could not start a Facebook, Google or Uber in South Africa. Technology is built around customisation and in order to customise, you need information.”