Complaint Case Notes

編號: 0096/2017/IP

標題: Compelling voice recording of automated phone system

立案原因: Report

個案簡介:

    An individual reported to the GPDP (Gabinete para a Protecção de Dados Pessoais) that while he called the hotline of Company A, he selected the option, as allowed by the automated phone system (APS), to contact the operator.  The APS indicated that his call would be recorded; no options, however, were allowed to refuse the recording. 
  This individual believed that such practice was in breach of Article 6 of the PDPA (Personal Data Protection Act), and therefore asked the GPDP to investigate. 

分析:

    To ensure service quality, some organizations might install APS and the voices it records are clear voice data which allows identification. Consequently, the recorded voices relate to identifiable individuals (the hotline staff and the callers), and therefore they qualify as personal data.  Under Article 3(1) and 4(1)(1) of the PDPA, the processing of the mentioned data is subject to the same Law.  
  For personal data processing, the legitimate criteria of Article 6 of the PDPA should be fulfilled, for instance, based on the unambiguous consent of the data subjects.  Or in other instances, when legitimate interests, as set out by Article 6(5) of the same Law, exist, data processing is also legitimized.  
  As mentioned, the APS of Company A mainly recorded the voices from the two types of individuals as mentioned.  In relation to the voice data of the company staff, Company A recorded such data for improving and monitoring the staffers’ service quality for the customers, which is necessary for its management needs and in line with Article 6(5) of the PDPA. 
  On the contrary, the callers’ audio data should be recorded after having obtained their prior and unambiguous consent.  Under Article 4(1)(9) of the PDPA, “data subjects’ consent” must mean any freely given specific and informed indication of his wishes.  As long as a caller selected the option of contacting the hotline operator, then the APS prompt will remind the caller that the upcoming conversations will be recorded for enhancing service quality, before the call is put through to the operator.  As such, the caller must have understood and was aware of the recording about to take place, and he was allowed to continue or terminate his call.  If he decided to continue the call, his action already illustrated his wishes to accept the conversations to be recorded and, henceforth, Company A would then legitimize its data processing based on the “unambiguous consent of the data subjects”.  
  In summary, Company A did not violate the PDPA. 

處理結果:

    In the current stage Company A was not found violating the PDPA and therefore this case was closed.  

註:
Please refer to Article 3, 4 and 6 of the PDPA.