Complaint Case Notes

編號: 0058/2015/IP

標題: Recording phone conversations without consent

立案原因: Complaint


    Complainant G was earlier contacted by Manager K of Telecommunications Company A.  K called the Complainant in order to respond to the customer service complaint he lodged.  During the conversations, K expressed that he had accessed the recorded in-person conversations between the Complainant and Manager L of the same Company, which was exactly why the Complainant was informed of the recordings initiated.  Moreover, K also pointed out that the conversations they were having were also recorded.  The Complainant pointed out that before the recordings took place no system prompt was played, which means the conversations were recorded without his consent and violated the Personal Data Protection Act (PDPA).  He filed a complaint with the Office for Personal Data Protection (GPDP) as a consequence. 


    Article 4(1)(1) of the PDPA governs that the sound of any natural person is regarded as personal data.  Furthermore, the available information showed that, Company A, for service improvement, recorded phone conservations in case of any disputes or for other cases.  The recorded sound in the current case is the information relates to identified individuals.  Under Article 3(1) of the same Law, such data should be subject to the PDPA. 
  The investigations showed that Company A for service improvement recorded and archived the said conversation data.  Whenever an individual calls its service hotline, the phone system will play an automatic prompt.  On the other hand, if a call was made by its staff, no prompt will be played automatically and its staff will be required to acquire consent from the parties they called.  Company A admitted that the involved staff of the current case made a number of calls to the Complainant, but its staff failed to get consent from him before the recordings took place.  After this incident, a system prompt has been configured for calls that made by its staff. 
  The sound data of staff as captured by the said system serves the purpose of the Company’s management.  Such purpose is lawful and legitimate, and is in line with Article 6(5) of the PDPA, which governs the preconditions of legitimate processing.  On the other hand, the recording of sound data by Company A should only take place so long as the parties being called expressed their explicit consent.   
  In practice, whenever calls were made by the Company staff, it is not appropriate for the staff to obtain a verbal consent from the party being called after the recording has been initiated, as the other party might disagree to the recording or other circumstances might arise (for instance, the staff forget to seek consent from this party).  In the current case, the recording is illegitimate no matter after or before the staff informed the other party of the conversation recording.  This revealed the point at issue is the misconfiguration of the system, and recording should only start after consent from the other party has been obtained, instead of first initiating the recording before obtaining the consent.  Company A, therefore, recorded the conversations without seeking the consent from the Complainant was a violation of Article 6 of the PDPA, which constituted an administrative offence.   


    The recording of conversations was not legitimate according to Article 6 of the PDPA though, the incident was caused by omission. In addition, the system has been re-configured and improved and the cooperativeness found during the investigation, the GPDP decided to impose a fine of MOP$8000 according to Article 33(2) and 35(1) of the PDPA.  

Please refer to Article 3, 4, 6, 33 and 35 of the Personal Data Protection Act.