This afternoon we received an unusual and unexpected WhatsApp message from one of the two local cinema companies, Nu Metro.

The message was from the official Nu Metro account stating, “You’ve watched Dune: Part 1 at Nu Metro, now Xperience Dune Part Two.”

You can see a screenshot of the message below:

The message comes with an image and a link to buy tickets for Dune Part Two (check out our review here). Obviously, cinemas should be trying to reach customers when they have one of the biggest movies of the year arriving at their box offices. Especially cinemas in South Africa which struggled to stay afloat during the long pandemic period and after when big screen movies seemed to have lost their lustre as Hollywood recovered and streaming became king.

Unfortunately, this form of direct marketing is outlawed by the Protection of Personal Information Act (PoPIA) 2020, unless the receiver has given express consent.

According to PoPIA Compliance, the act reads: “Section 69 of the Act outlaws direct marketing by means of any form of electronic communication unless the data subject has given their consent. Such an electronic communication obviously includes emails, SMSs and automatic calling machines. A subject can only be approached once to obtain such a consent.”

We then began asking ourselves: when did we give consent for this?

Yes, we did buy tickets to watch Dune Part 1 at Nu Metro in 2021, and we had a great time at a memorable IMAX screening. We recall purchasing the tickets online through the Nu Metro website. We venture to say this is what most moviegoers do nowadays – book ahead of time online.

When purchasing tickets online with Nu Metro, you are required to input some personal information in order to receive the tickets you are purchasing. This includes your name, phone number and email address. You are also asked if you want to sign up for the Nu Metro newsletter via a box tick.

This is how the company received our phone number, by which they sent us the WhatsApp ad. The company also recorded this information and timed it, so they knew we were a potential target for the new Dune film, since we already watched the first one.

At no point in this process so far have we been expressly asked for our consent to receive direct marketing. A newsletter is not direct marketing. And, on top of that, we did not select to receive the newsletter anyway. We found the original booking reservation email from 2021, the one that the company sent us, so we are sure of what email account we inputted.

We contacted Nu Metro about the direct WhatsApp marketing and enquired about the consent process, in particular where we consented to receive marketing at any point during the purchasing of tickets. Nu Metro got back to us quickly to their credit and apologised for the WhatsApp message.

According to the representative who contacted us, the only option to consent or not is the “sign up to newsletter” button. We are unsure if this is the only option, but Nu Metro customer service should know what options are available. Firstly, it may not be clear to customers that receiving the newsletter is also expressly consenting to receive direct marketing via WhatsApp.

Secondly, according to Nu Metro’s own privacy policy, the company will only process the personal information of customers, including phone numbers, if:

• “[customers] have consented thereto,
• if a person legally authorised by you, the law, or a court, has consented thereto,”
• if it is necessary to conclude or perform under a contract, we have with you,”
• if the law requires or permits it,
• and if it is required to protect or pursue your, our or a third party’s legitimate interest.”

Does inputting your information to buy tickets equal consent? We’re not sure. It seems Nu Metro may not be too sure either as the company is using the Promotion of Access to Information Act 2 of 2000 Manual (PAIA) as reference and not the more recent PoPIA to know what to do with user data.

Here, Nu Metro says that using its online channels will mean that the company will capture your personal information. In terms of marketing, Nu Metro says plainly: “We will use your personal information to market financial, investments and other related products and services to you. We may also market non-banking or non-financial products, goods, or services to you.”

“We will do this in person, by post, telephone, or electronic channels such as SMS, email, and fax,” the company’s privacy policy reads. This, of course, is outdated according to PoPIA.

We checked to see if competitor Ster-Kinekor has a similar lack of communication in terms of asking for consent. It turns out that when you purchase tickets via the Ster-Kinekor website, you consent to the company’s terms and conditions. Yet these also do not expressively mention consent to receive direct marketing, instead Ster-Kinekor has a similar privacy policy to Nu Metro’s.

It’s shocking that Nu Metro is not making it more clear when customers consent to receive direct marketing. That is, if, the company is asking for consent at all. Which they should or else they would be in breach of PoPIA. The maximum penalties of doing so are a R10 million fine or imprisonment for 10 years.

By extension, Ster-Kinekor should also be making it more clear when and if customers consent to marketing. It is now 2024. Customers have the right to know what corporations are doing with their private information. Who they are giving it to, and for what purpose. While it may seem harmless now – a little direct advert for a movie we were already planning to watch – what if these companies continue this and increase it?

Would you like your WhatsApp channels replete with marketing from random firms you may have purchased things from? Between chats of your significant other and your family members, here’s one to buy liquor or to subscribe to the latest streaming platform. Worse still, these ads mention you by name and tell you things like “We know you like beer, you bought some on this date. Why not but some more!”

This is a future we definitely want to stay far away from, and the good news is that there is legislation in place to do so. Companies just have to adhere to it.

We’re still awaiting Nu Metro to get back to us with more information about the process, and will update this feature when, or if, we receive it.