| (a) | has given his, her or its consent to the processing; or |
(2)
| (a) | A responsible party may approach a data subject— |
| (i) | whose consent is required in terms of subsection (1)(a); and |
| (ii) | who has not previously withheld such consent, |
only once in order to request the consent of that data subject.
| (b) | The data subject’s consent must be requested in the prescribed manner and form. |
| (3) | A responsible party may only process the personal information of a data subject who is a customer of the responsible party in terms of subsection (1)(b)— |
| (a) | if the responsible party has obtained the contact details of the data subject in the context of the sale of a product or service; |
| (b) | for the purpose of direct marketing of the responsible party’s own similar products or services; and |
| (c) | if the data subject has been given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to such use of his, her or its electronic details— |
| (i) | at the time when the information was collected; and |
| (ii) | on the occasion of each communication with the data subject for the purpose of marketing if the data subject has not initially refused such use. |
| (4) | Any communication for the purpose of direct marketing must contain— |
| (a) | details of the identity of the sender or the person on whose behalf the communication has been sent; and |
| (b) | an address or other contact details to which the recipient may send a request that such communications cease. |
| (5) | "Automatic calling machine", for purposes of subsection (1), means a machine that is able to do automated calls without human intervention. |
