27. Solicited messages to data subjects by controllers

Subject to section 14, a controller may use postal services, telecommunication services, electronic means or any other similar means for the purposes of disseminating messages only if a data subject has given consent to receive such messages (hereinafter referred to as “solicited messages”).

For the purpose of subsection (1), consent shall be obtained by a controller in accordance with the conditions of Schedule III of this Act.

When obtaining a consent under subsection (1), the controller shall, at the time of collecting contact information and each time where a message is sent, provide to the data subject details on how to opt-out of receiving solicited messages free of charge.

A controller using postal, electronic, telecommunication or any other similar means to disseminate any solicited message, shall inform the data subjects, to whom such messages are intended, of the nature of the message and the identity of the controller or third party on behalf of whom the message is disseminated by the controller.

The Authority may, in consultation with the relevant regulatory or statutory body, determine by way of rules made under this Act, any code or prefix that controllers shall adopt in order to identify different categories of solicited messages.

For the purpose of this section, a “message” includes any written, electronic, oral, pictorial, or video message, that is intended to promote–