It’s time for the PR industry to start taking Popia seriously
Much has been made of the Protection of Personal Information Act (Popia) and its impact on organisations across all industries, but scant attention has been paid to the effect it might have on the PR and media relations industry.
It’s tempting to think of Popia as an act that applies more to big corporations – banks, insurance companies and the like. The truth is that irrespective of whether you are a plumber or a PR professional, Popia principles apply to you.
Everything we do needs to be in line with Popia, and as an industry we all need to be able to show accountability, which includes demonstrating that we have the policies and privacy notices in place, have implemented appropriate processes and have the right contracts with third parties if we use third parties to help us process personal information.
Bear in mind that processing of personal information stretches from collecting any personal information to destroying that information – you can only collect information where you have a clear, explicit purpose for collecting it, and you can’t collect more information than is required for your purpose. You can only collect and process personal information under certain instances and not beyond that scope.
In a nutshell, the responsible party must secure the integrity and confidentiality of the personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures to do so.
Let’s consider that in the framework of the PR and media relations industry. How many of us have sat a junior employee down with a phone line and the instructions to update a media list? I doubt a single one of us could claim to not have done that. Our media lists are an essential tool of trade, and much of the information we collect for those lists is from publicly available sources of information – from websites, blogs, Twitter bios and the like. But some of it is not in the public domain: the cellphone numbers of journalists, for example, are seldom widely available, and are often acquired only after many weeks and months of relationship building.
According to Danie Strachan, a partner at law firm Adams & Adams, just because information is in the public domain does not mean that it is no longer personal and that Popia doesn’t apply. With this in mind, we must ask ourselves: how comfortable are we with sharing invitation lists, event RSVPs or even media lists with our clients and third-party service providers without a clear understanding and agreement about how that information will be used? And how do we manage and secure those lists, packed with names and contact information?
It is not only about that database of journalists and people in the media industry, says Strachan. What about marketing to potential clients? If you’ve previously done business with them for some kind of service, it’s an easy answer, but what about potential clients you’ve never previously had contact with? If you’ve not done business with them before, you cannot send information to them unless they have opted in, he says.
With these questions in mind, I reached out to colleagues in the PR industry to find out how they’re approaching Popia. The responses were varied, but what was striking is that no-one had a real answer. Views on how we should be engaging with Popia as an industry are fairly grey, and there’s lots of talk but very little real action. Time is running out – the act came into force on July 1 2020, with a grace window of one year from the time of publishing, and in theory the Information Regulator will start enforcing the act one year after the commencement date – less than six months away.
There is something we can do to clarify this murky response. Popia allows for a code of conduct to be drafted and approved by the regulator for a specific industry to provide a framework for what is acceptable behaviour and practice for it, explains Strachan. This code of conduct should provide industry members with specific industry-related details and requirements required by Popia, such as the management of databases, template documents and processes.
The development of these codes is typically driven by the industry bodies – in our case, this would be public relations organisation Prisa.
It is time that we united as an industry to work for the greater good. These are challenging times for all agencies, and by working together we can provide a clear path forward that not only keeps us on the right side of our legal obligations to our clients and partners but that also provides a framework for ethical behaviour by all. Our industry can only benefit.
- Sarah Gooding is MD of WE Communications.
The big take-out:
The PR industry should be developing a code of conduct to provide a framework for what is acceptable behaviour and practice in terms of Popia.
Would you like to comment on this article or view other readers' comments?
Register (it’s quick and free) or sign in now.
Please read our Comment Policy before commenting.