Deputy Data Protection Ombudsman: Customers need to be told before starting to record calls
The Deputy Data Protection Ombudsman has ordered a company serving as controller to change its practices for informing customers and implementing the right of access. The company had not told consumers that their calls were being recorded. Neither did it offer consumers the opportunity to obtain copies of their recorded calls.
Customers must be informed of call recording without delay
The Data Protection Ombudsman received a complaint that the controller had not informed a consumer that their call was being recorded. The Deputy Data Protection Ombudsman’s investigation revealed that the controller was recording its sales calls, but only informed the customer of this if the call led to a contract with the consumer. If a contract was not signed, the consumer was never told of the recording.
Recording telephone calls is a form of collecting personal data, and companies must inform consumers of it. An individual’s recorded voice constitutes personal data if the individual can be identified from the recording. Customers need to be informed of the recording before the company starts recording their calls.
Consumers are entitled to a copy of the telephone call
The investigation also revealed that, if data subjects wanted to exercise their right of access to the data, the company serving as controller only offered them the opportunity to listen to the recordings, which does not meet the requirements of the right of access provided for in the General Data Protection Regulation. According to the GDPR, the controller must deliver a copy of the recorded phone call if so requested by a data subject. In this context, data subject refers to the individual whose speech the organisation is recording.
According to the Personal Data Act repealed in 2019, a transcript of the recorded telephone call had to be delivered if the data subject requested to have the data in writing. With the application of the GDPR, the controller can also deliver a copy of the personal data undergoing processing in another format, such as a recording. At its discretion, the controller can also offer the data subject an opportunity to listen to the recordings.
Company cautioned
The Deputy Data Protection Ombudsman cautioned the company serving as controller and ordered it to change its practices for recording calls and implementing the right of access.
The decision is in line with the Data Protection Ombudsman’s prior interpretation of the right to access telephone recordings, dating from the time of the Personal Data Act. Today, the processing of personal data is subject to the General Data Protection Regulation as supplemented and clarified by the national Data Protection Act. The Deputy Data Protection Ombudsman’s decision is the first decision on telephone recordings made under the General Data Protection Regulation.
The decision is not final and is still open for appeal in the administrative courts.
More information:
Deputy Data Protection Ombudsman Anu Talus, tel. +358 29 566 6766, anu.talus(at)om.fi