個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0020/2011/IP

Title: Public Department A recorded phone calls without obtaining callers’ consent

Reason: Reports

Brief:

    Citizen X called the contact number of Public Department A and Y, responsible for managing the complaints, answered the call. During the conversation, X was feeling dissatisfied and expressed he wanted to complain the staff of the Department. So the call was forwarded to Z. Both of the two calls were recorded without voice prompts presented before the conversation started. Y and Z admitted that his calls were recorded only after X asked if there was any.
  X believed that Public Department A recorded the calls without obtaining his consent, which could have violated the Personal Data Protection Act, thus he requested the GPDP to follow up.

Analysis:

    In accordance with Articles 4(1)(1) and 3(1) of the Personal Data Protection Act (Law 8/2005), the data processing involved in this case is within the regulatory scope of the said Law.
  Under Article 4(1)(1) of the Law previously mentioned, the data subject is an identifiable person as long as he could be identified, directly or indirectly, and distinguished from others by certain identifying features. In GPDP’s opinion, the recordings made by the system were clear and legible. With elements such as X’s last name and phone number, X’ identity could be established or confirmed. Therefore, the “voice” recorded by the recording system of Public Department A is regarded as the information of an identifiable person, i.e., X, and therefore is taken as personal information.
  According to Department A’s reply, dates back to the end of 2010, it started using a phone recording system to assist callers’ complaints. Due to technical problems, it failed to provide automatic voice prompts, so each time a staff answering a call would actively remind callers of the recording. X had made a number of complaints for different matters. Except the phone call related to the current complaint to GPDP, X was reminded of the recording in the rest of the other calls.
  According to Department A’s declaration made to GPDP, the purpose of telephone surveillance was to “ensure service quality, assess staff performance and protect the legitimate interests of the Department”. In GPDP’s opinion, the voice recordings involved both the Department staff and the callers. To the Department, recording staff while on duty was to monitor their activities. Generally speaking, based on operation, business and overall needs to monitor staff activities is legitimate and lawful, which also meet the legitimacy given in Article 6(5) of the Law previously mentioned. Although recording callers’ conversation safeguards the legitimate interests of the Department, it should also respect the rights of the former, allowing them to decide whether to make their complaints while being recorded. If disagreed, the said Department should offer other means of communications, such as face-to-face meeting, e-mail, fax, letter etc. Therefore, in this case the legitimacy for Department A to record its callers could only derive from their consent.
  For the two recordings to which X’s complaints referred, the recording data provided by the said Department showed that while answering the phone calls from X, his phone calls were recorded without any voice prompts. One recording showed that X was not informed of the recording that was taking place, while the other showed that X was informed only after he asked if any recording was taking place. In GPDP’s opinion, in the last call, after X was informed of being recorded, X did not disagree and continued the call. Therefore, it could assume that X agreed with the recording throughout the call. For the other one, because X was uninformed, GPDP is in the opinion that Department A failed to achieve the legitimacy for the recording.
  As mentioned, in this case the legitimacy of the recordings could only be obtained from the subject’s consent. Article 4(1)(9) of the Personal Data Protection Act stipulated “the data subject’s consent” shall be explicit and shall be made under “any freely given specific and informed” condition. Consent as such shall be derived from the expression of intent, either explicit or implicit, and shall be beyond doubts, reflecting the data subject was informed of and agreed to the processing of his personal data. Although X had “agreed with” the recordings on several occasions, his consent was only made for his previous calls and could not apply the same consent for other calls he later proceeded with other Department staff. If this Department had to record, it shall ask for X’s explicit consent every time. Therefore, for the above mentioned call, without clear prompts in advance, the said recording could not be viewed as based on X’s explicit consent. Thus, Department A’s processing of personal data lacked the legitimacy under Article 6 of the Personal Data Protection Act.
  According to the investigation, the processing of personal data in the current case that failed the legitimacy under Article 6 of the Personal Data Protection Act is not a single incident, but a problem in the processing mechanism. In GPDP’s opinion, Department A’s recording system started automatically after the switchboard forwarded the calls. The caller and staff member were already being recorded before the responsible staff asked if the caller agreed to the recording. Under normal circumstances, if a staff reminded the caller of the recording, this would not be questioned of. However, because “recordings take place automatically before reminding callers”, in special circumstances (e.g. a bad atmosphere the between the staff and the caller’s conversation or a staff forgot to remind a caller of the recording) where a reminder was difficult, or not timely, to be delivered and the recording started, as well as when a caller disagreed to the recording after the reminder, the Department then failed to have the legitimacy to process the recordings, thus violating Article 6 of the Personal Data Protection Act.
  In summary, due to the defect of the phone recording system, the said Department recorded the phone calls between its staff and the callers, which violated Article 6 of the Personal Data Protection Act.

Result:

    The following factors were taken into consideration by GPDP: 1) Department A recorded the conversations between its staff and the callers in order to ensure service quality. Its purpose was legitimate and lawful. However, the defect of the recording system failed to seek consent from the data subjects, but it was not a deliberate violation of the Personal Data Protection Act. 2) It was the first time that Department A violated the regulations of the Personal Data Protection Act. 3) During the investigation, Department A maintained a cooperative attitude, and an automated voice prompt system was installed in mid-2011, which has improved the settings of the caller recording system.
  In summary, GPDP took into account that Department A recorded the phone calls between its staff and the callers but failed to achieve the legitimacy under Article 6 of the Personal Data Protection Act. Under Articles 33(2) and 35(1) of the said Law, GPDP, therefore, decided to impose the said Department a fine of MOP$8,000. The punishment was implemented.

Reference:
Please refer to "Personal Data Protection Act", articles 3,4,5,6,33,35 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116