All your personal information is up for sale to debt counsellors — for 55c

● Full names, ID numbers, phone numbers, amounts owed to creditors and other personal information about indebted consumers is being sold by data vendors to debt counsellors for anything from 55c a “lead”.

If you’ve responded to advertisements online offering to reduce your instalments to creditors and to protect your assets from them, or if your debts have been handed to debt collectors, then data vendors could be in possession of your personal information — and selling it.

This is despite the fact that when it is fully implemented, the Protection of Personal Information Act will make this unlawful, according to the Information Regulator.

An e-mail sent from DataTech Advertising to a debt counsellor said: “We have access to debt collection data. These are people being harassed by debt collectors to recover debt or to make payment arrangements.”

The e-mail contained a sample showing how much information is provided per lead. It includes the full name, ID number, “handed over balance” and the name of one of the consumer’s creditors. “These are your ideal debt review clientele as it would be easier to persuade them to consider debt restructuring. Data is ideal for cold calling, SMS or voice broadcasting,” it said.

The normal price per lead sold by DataTech Advertising is 55c, according to the email, but in terms of a promotion, 10,000 leads sell for R3,500 — or 35c a lead — and 20,000 leads for R5,500.

A lead from SA Hotleads sells for R55 and consists of two contact numbers, an e-mail address, the location, and in some instances the total debt and salary of consumers who have responded to adverts on the internet offering them a reduced instalment on their debts and protection of assets, according to an e-mail from SA Hotleads to a debt counsellor.

The SA Hotleads e-mail continued: “We are trusted by some of the biggest debt companies in the country to provide them with leads.”

SA Hotleads did not respond to a request for comment.

In an e-mail to a debt counsellor, DataTech’s Ashley Chetty said: “Data comes from third-party suppliers within the debt collection arena, who have permission to market to these people.”

If you don’t want to be contacted, you need to list your name on the “Do Not Contact” page of the Direct Marketing Association of Southern Africa website, he said, adding that DataTech is a member of the DMASA and complies with its requirements.

The association did not respond to requests for comment.

Chetty told Money that DataTech Advertising buys leads from various “lead suppliers” and sells it to companies. “According to the Protection of Personal Information Act no consent is required on collection of personal information. It is not unlawful to buy and sell personal information. Consent is only required if you market electronically … they must consent or must have the opportunity to unsubscribe or opt out.”

But he declined to answer if he had the consent of consumers to sell their personal information.

The act is not fully in force, but if all the provisions were in force, “the Information Regulator would deem the selling of the credit records of overindebted consumers as unlawful”, the Information Regulator’s Tana Pistorius said. “These practices contravene several conditions for the lawful processing of personal information and sanctions would accordingly follow.”

In terms of the act, personal information may only be collected if there is a justified purpose for doing do, or the data subject has consented. If no consent is obtained to sell personal information, the sale constitutes further processing and is unlawful.

Processing of personal information was unlawful if it fell foul of one or more of eight conditions, Pistorius said. One condition is that personal information must be processed in a reasonable manner that does not infringe on your privacy. It also states that you must consent before an entity can process your personal information, and the personal information must be collected directly from you.

Pistorius said the Protection of Personal Information Act provided that your personal information could only be collected for a specific, explicitly defined and lawful purpose related to a function or activity that the party collecting your information carries out. If your information is processed any further this must be compatible with the original purpose for which the information was collected.

She said a creditor would have a reason to collect your personal information, but further processing of that information by data vendors to sell leads no longer complied with the conditions set out in the act.

She said that if data was collected to sell leads to debt counsellors, the subjects were probably not aware that their personal information was being collected by those who trade in such information.

Another condition in the act sets out security safeguards. In terms of this condition, a party collecting your information and any operator processing it must secure the integrity and confidentiality of that information.

“If databases of credit records of overindebted consumers are available for sale, then creditors and debt collectors have failed to secure the integrity and confidentiality of that personal information. This constitutes a contravention of the act,” Pistorius said.

Mark Heyink, an attorney who specialises in information security, said it is “reprehensible” for a data vendor to suggest that they’re entitled to sell such personal data without consent from the consumer.

“Our personal information is our property. Information is different to physical assets, but the concept of ownership is the same,” Heyink said. “We understand that we can use Microsoft’s software and that this doesn’t mean we own it. Therefore, we can’t sell it. The same goes for our personal information: we may give a party consent to use our information, but that does not give them the right to sell it.”

Heyink said data brokers defended the illegal sale of personal information on the basis of it being established practice. “It’s true that there’s a huge trade in data, but in countries where data protection laws are more mature [and] this is in the confines of clearly set rules.”

Heyink said medical information is a multibillion-dollar industry in the US, but while information such as patient visits to doctors, dentists and pharmacies can be sold, the person is not identified.

Data vendors such as Leading Leads claim the personal information they sell was obtained directly from the consumers concerned and that these consumers have consented to their information being passed on to debt counsellors.

“We post ads on social media targeting overindebted consumers. They will then respond to us with the information we need to forward to a debt counsellor. All consumers consent to being called by a debt counsellor,” said Amy Swartz of Leading Leads. She declined to say whether the consumer consented to their information being sold.

If no consent is obtained to sell personal information … the sale is unlawful