Comparing the protection and use of online personal information in South Africa and the United Kingdom in line with data protection requirements

<jats:sec> <jats:title content-type="abstract-subheading">Purpose</jats:title> <jats:p>The purpose of this study was to investigate the difference between South Africa (SA) and the United Kingdom (UK) in terms of data protection compliance with the aim to establish if a country that has had data protection in place for a longer period of time has a higher level of compliance with data protection requirements in comparison with a country that is preparing for compliance.</jats:p> </jats:sec> <jats:sec> <jats:title content-type="abstract-subheading">Design/methodology/approach</jats:title> <jats:p>An insurance industry multi-case study within the online insurance services environment was conducted. Personal information of four newly created consumer profiles was deposited to 10 random insurance organisation websites in each country to evaluate a number of data privacy requirements of the Data Protection Act and Protection of Personal Information Act.</jats:p> </jats:sec> <jats:sec> <jats:title content-type="abstract-subheading">Findings</jats:title> <jats:p>The results demonstrate that not all the insurance organisations honored the selected opt-out preference for receiving direct marketing material. This was evident in direct marketing material that was sent from the insurance organisations in the sample to both the SA and UK consumer profiles who opted out for it. A total of 42 unsolicited third-party contacts were received by the SA consumer profiles, whereas the UK consumer profiles did not receive any third-party direct marketing. It was also found that the minimality principle is not always met by both SA and UK organisations.</jats:p> </jats:sec> <jats:sec> <jats:title content-type="abstract-subheading">Research limitations/implications</jats:title> <jats:p>As a jurisdiction with a heavy stance towards privacy implementation and regulation, it was found that the UK is more compliant than SA in terms of implementation of the evaluated data protection requirements included in the scope of this study, however not fully compliant.</jats:p> </jats:sec> <jats:sec> <jats:title content-type="abstract-subheading">Originality/value</jats:title> <jats:p>Based upon the results obtained from this research, it suggests that the SA insurance organisations should ensure that the non-compliance aspects relating to direct marketing and sharing data with third parties are addressed. SA insurance companies should learn from the manner in which the UK insurance organisations implement these privacy requirements. Furthermore, the UK insurance organisations should focus on improved compliance for direct marking and the minimality principle. The study indicates the positive role that data protection legislation plays in a county like the UK, with a more mature stance toward compliance with data protection legislation.</jats:p> </jats:sec>