個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0161/2017/IP

Title: Unauthorized recordings of customers’ voices

Reason: Complaint

Brief:

      The current case stemmed from the Complainant’s argument over the services of Company A. The former called the latter a number of times to demand compensation. Later, he discovered Company A, without informing him, covertly recorded his calls, and believed that such unauthorized recordings might have violated the PDPA (Personal Data Protection Act/Law 8/2005). Therefore he asked the GPDP (Gabinete para a Protecção de Dados Pessoais/Office for Personal Data Protection) to investigate.

Analysis:

      Voice of a natural person qualifies as personal data pursuant to Article 4(1)(1) and 3(1) of the PDPA, and consequently the data processing of the current case is subject to the same Law.
     During the investigations, Company A pointed out that the recordings were carried out for its operators’ service etiquette and quality, as well as for future reviews. Such purposes are in line with the conditions for legitimate processing according to Article 6(5) of the PDPA. Despite Company A recorded the conversations to safeguard its legitimate interests, as long as the recordings captured the customers’ voice data they should have a chance to decide whether to have their conversations recorded while expressing their views. If a customer refuses so, then Company A should inform him other means to communicate. Based on the above, it showed that the legitimacy of the processing largely hinges on the unambiguous consent of customers.
     Whenever outside calls are made by its staff, Company A’s system would automatically initiate the recordings; and until a call was picked up, the staff would verbally inform the customers of the recordings. Regardless the current case stemmed from the staff’s inattention and omission, or a customer’s explicit disagreement toward the recordings after he had been informed, Company A failed to achieve the legitimacy for its recordings both before and after informing the customers. The defective procedures of initiating voice recordings are the crux of the issue. Essentially voice recordings should only take place after a customer expressly agreed so, and should never be initiated before a customer gave his consent. In sum, Company A failed to achieve the legitimacy conditions for its processing required by Article 6 of the PDPA.

Result:

    Company A failed to achieve the legitimacy conditions set forth by Article 6 of the PDPA for its recordings of the Complainant’s conversations. According to Article 33(2) of the PDPA this constituted an administrative offense and the GPDP therefore imposed a penalty of MOP$12000 to Company A. In addition, pursuant to Article 43(1), the GPDP also imposed an additional penalty of blocking the voice recording data that were captured without the customers’ consent. This additional penalty shall ban Company A from reusing the voice data unless a customer expressed his antithetical wishes (declarações). After the current case, Company A rectified the procedures of initiating voice recordings.

Reference:
Please refer to Article 3, 4, 6, 33, and 43.

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116