Data Protection, recording of phone calls.

JoeB-

Hi

A well known credit card company uses the following message on their automated phone call system.

well known company wrote:

'We sometimes record calls so we can continue to give you the best possible service.'

What do people think?, compliant with Data Protection legislation or not?


Personally I don't think so.
The use of the word 'sometimes' introduces ambiguity. So it's not clear if a particular call is being recorded or not, and that's the whole point of the DP legislation!


Also, the reason given for recording is vague and not precise. It's also objectively false and so the entire reason is thus rendered nonsensical.


So, what do people think? Would people expect the DP commissioner to allow the message above or not?

shanered

I think its a fair enough warning, in other words, expect it to be recorded.
I think its usually used for employee monitoring but potentially legal reasons.
The warning is enough in my opinion to expect to be recorded.
This is just my opinion.

ResearchWill

JoeBallantine wrote: »

Hi

A well known credit card company uses the following message on their automated phone call system.




What do people think?, compliant with Data Protection legislation or not?


Personally I don't think so.
The use of the word 'sometimes' introduces ambiguity. So it's not clear if a particular call is being recorded or not, and that's the whole point of the DP legislation!


Also, the reason given for recording is vague and not precise. It's also objectively false and so the entire reason is thus rendered nonsensical.


So, what do people think? Would people expect the DP commissioner to allow the message above or not?

What section of the relevant Acts do you think it breaches.

JoeB-

I believe that callers should be individually informed as to whether or not their calls are being recorded. The message 'we sometimes record calls' does not provide any information as to whether or not a particular call is being recorded.



Section 2 subsection 1 clause c(i) (of the 1988 Act) requires
http://www.irishstatutebook.ie/1988/en/act/pub/0025/sec0002.html#sec2

http://www.irishstatutebook.ie/1988/en/act/pub/0025/sec0002.html#sec2 wrote:

(c) the data—
(i) shall be kept only for one or more specified and lawful purposes,

I don't think the reason given in the message is sufficiently 'specified'.


That particular section also requires companies who seek to record calls to first specify why. (The word 'specified' is in the past tense, indicating that the reason for collecting data must be given first, and the data is collected second.)



Back to the reason given. The message

'We sometimes record calls so we can continue to give you the best possible service.'

gives as a reason for recording 'so we can continue to give you the best possible service.'

That reason is objectively false (clearly, it'd be possible to provide a better service)... , and rendered nonsensical as a result. So they have not complied with the requirement that data 'shall be kept only for one or more specified and lawful purposes'. They have failed to give a reason that makes sense.

ResearchWill

JoeBallantine wrote: »

I believe that callers should be individually informed as to whether or not their calls are being recorded. The message 'we sometimes record calls' does not provide any information as to whether or not a particular call is being recorded.



Section 2 subsection 1 clause c(i) (of the 1988 Act) requires
http://www.irishstatutebook.ie/1988/en/act/pub/0025/sec0002.html#sec2


I don't think the reason given in the message is sufficiently 'specified'.


That particular section also requires companies who seek to record calls to first specify why. (The word 'specified' is in the past tense, indicating that the reason for collecting data must be given first, and the data is collected second.)



Back to the reason given. The message

'We sometimes record calls so we can continue to give you the best possible service.'

gives as a reason for recording 'so we can continue to give you the best possible service.'

That reason is objectively false (clearly, it'd be possible to provide a better service)... , and rendered nonsensical as a result. So they have not complied with the requirement that data 'shall be kept only for one or more specified and lawful purposes'. They have failed to give a reason that makes sense.

You are reading the section incorrectly, that section only says that data is kept for a lawful purpose it says nothing about the reason for creation. If any recording is kept then the purpose for keeping it must kept for a specified purpose. I can see no requirement that the data controller must inform you of the purpose.

JoeB-

Hi

Data is not created, rather it is collected.

If a Data Controller has harvested data then he must have a purpose, as per the section I linked to. The purpose must pre-exist the collection of data, as otherwise there would be a breach at the time the data is collected.

If the Data Controller does not need to specify to me, then to who does he need to specify the purpose of collection? The Acts require that a reason be specified... but I accept that it doesn't seem to make explicit that it be specified to the data subject.


It is probably the requirement in

Section 2 subsection 1 clause a (of the 1988 Act) (just a line or two above the previous linked section on Irish Statute)

that requires disclosure of the purpose to the data subject. It requires that data be obtained 'fairly'. Secret collection of data is likely not considered fair.




Anyway, .. the DP website is very clear on these issues.

On page
http://www.dataprotection.ie/viewdoc.asp?m=&fn=/documents/FAQ2012/Contacting_Customers.htm#6

FAQ 12.6 makes things very clear.

FAQ 12.6 wrote:

Under data protection legislation it is accepted that there can be a legitimate business interest basis for the recording of calls in business critical areas in certain sectors, subject to the provision that callers should be clearly informed, ....

As the Data Protection Acts state that a person's information should only be collected for specific purposes of which they should be pre-advised, the purpose(s) for which the calls are being recorded should be pointed out to callers before any personal data is collected.

I am not certain how the DP commissioner has arrived at his conclusions but there they are.



My point is that I don't believe the message I've posted
'We sometimes record calls so we can continue to give you the best possible service.'
complies with the requirements of FAQ 12.6 above.

ResearchWill

JoeBallantine wrote: »

Hi

Data is not created, rather it is collected.

If a Data Controller has harvested data then he must have a purpose, as per the section I linked to. The purpose must pre-exist the collection of data, as otherwise there would be a breach at the time the data is collected.

If the Data Controller does not need to specify to me, then to who does he need to specify the purpose of collection? The Acts require that a reason be specified... but I accept that it doesn't seem to make explicit that it be specified to the data subject.


It is probably the requirement in

Section 2 subsection 1 clause a (of the 1988 Act) (just a line or two above the previous linked section on Irish Statute)

that requires disclosure of the purpose to the data subject. It requires that data be obtained 'fairly'. Secret collection of data is likely not considered fair.




Anyway, .. the DP website is very clear on these issues.

On page
http://www.dataprotection.ie/viewdoc.asp?m=&fn=/documents/FAQ2012/Contacting_Customers.htm#6

FAQ 12.6 makes things very clear.




I am not certain how the DP commissioner has arrived at his conclusions but there they are.



My point is that I don't believe the message I've posted
'We sometimes record calls so we can continue to give you the best possible service.'
complies with he requirements of FAQ 12.6 above.

The data subject has been informed, of both the recording and the reason. You feel the reason is insufficient, I don't, if you believe it is not make a complaint to the DPC.

Many companies say its for traing purposes or quality control this company says the reason they record some calls is to continue to provide quality service. As long as any data so collect is not used for any other purpose other than quality controll then I can't see that they have done any wrong. But my opinion matter for nothing as the only opinion that matters is the DPC.

CIARAN_BOYLE

JoeBallantine wrote: »

I believe that callers should be individually informed as to whether or not their calls are being recorded. The message 'we sometimes record calls' does not provide any information as to whether or not a particular call is being recorded.

I can think of at least six or seven major international companies whose message

calls may be recorded for training and quality assurance purposes.

Given that so many companies say may be recorded I'd say it has to be allowed.

JoeB-

Hi

I don't think we should accept something as being legal simply because many companies engage in the practice.

For example, it is now illegal to list properties for sale or rent without a valid BER cert being displayed. But many properties continue to be listed, illegally, by large, supposedly legitimate, companies.


Research Will,.. you say

Research Will wrote:

The data subject has been informed, of both the recording and the reason.

You infer from the message 'we sometimes record calls.. ' that all calls are recorded?
How do you arrive at that conclusion?

The DP Acts specifically require that subjects be informed before any data is collected. Phone recordings are considered data. Subjects must be informed if their individual call is being recorded.
The message 'we sometimes record calls..' gives no information as to whether or not the current call is being recorded.



You further say

Research Will wrote:

...this company says the reason they record some calls is to continue to provide quality service.

But the message doesn't say that. The message says something very different. It says that the reason is to
'continue to provide the (logically impossible) best possible service', not a 'quality service'.

ResearchWill

JoeBallantine wrote: »

Hi

I don't think we should accept something as being legal simply because many companies engage in the practice.

For example, it is now illegal to list properties for sale or rent without a valid BER cert being displayed. But many properties continue to be listed, illegally, by large, supposedly legitimate, companies.


Research Will,.. you say


You infer from the message 'we sometimes record calls.. ' that all calls are recorded?
How do you arrive at that conclusion?

The DP Acts specifically require that subjects be informed before any data is collected. Phone recordings are considered data. Subjects must be informed if their individual call is being recorded.
The message 'we sometimes record calls..' gives no information as to whether or not the current call is being recorded.



You further say


But the message doesn't say that. The message says something very different. It says that the reason is to
'continue to provide the (logically impossible) best possible service', not a 'quality service'.

Not all call centers have call recording on every line. So hence the announcement is correct they may record the call. I would think the use of best possible and quality service are the same. But as I said if you think it's a breach then contact the DPC and make a complaint.

D3sperado

The wording of their notice is not great to be honest and it arguably is not fair processing as is required under the legislation.

The key issue is what they are doing with the recordings, if they use it for training purposes then the current wording is probably ok, however if they are using it for anti-fraud or some other such purpose that is not training related then the notice probably isn't sufficient to infer that the customer on the other end of the phone has given sufficient consent to the use of their personal data in such a way.

Given that the recording will probably contain financial information the company would also have strict reporting obligations if it was compromised in any way.

micosoft

OP. You seem to have decided on the answer you want before asking? I'm not really sure why you are asking then.

I don't understand what your issue with "sometimes" is? It simply means that the caller is aware there is a possibility their call will be recorded and they can hang-up if they are not comfortable with this. That is more then sufficient from a Comreg point of view. It makes no odds if they say sometimes or always - they have "specified" that the call may be recorded. It's not a problem and the DPO/CR don't regard it as a problem.

The second part is your opinion - no objectivity about it. It makes sense to me and I suspect any reasonable person.

I suspect you will not agree as you seem to have a unique and narrow interpretation of the law. What their message says is exactly what they do and it's entirely reasonable.

JoeB-

micosoft wrote: »

OP. You seem to have decided on the answer you want before asking? I'm not really sure why you are asking then.

To get other peoples opinions.

micosoft wrote: »

I don't understand what your issue with "sometimes" is? It simply means that the caller is aware there is a possibility their call will be recorded and they can hang-up if they are not comfortable with this. That is more then sufficient from a Comreg point of view. It makes no odds if they say sometimes or always - they have "specified" that the call may be recorded. It's not a problem and the DPO/CR don't regard it as a problem.

What have COMREG got to do with this?
What is DPO/CR?

The legislation is not about possibilities. The caller should be clearly informed if a recording is taking place. The message does not do so.

micosoft wrote: »

The second part is your opinion - no objectivity about it. It makes sense to me and I suspect any reasonable person.

I suspect you will not agree as you seem to have a unique and narrow interpretation of the law. What their message says is exactly what they do and it's entirely reasonable.

You obviously don't understand what 'logically impossible' means. The reason they have provided is not true, nor could it be true. It is nonsensical. It is a grammatically correct English sentence construction but it is semantically worthless. (i.e it has no credible meaning)

It is similar to this sentence
'The circle was square'
which is grammatically correct but semantically worthless. The sentence makes no sense.

ResearchWill

JoeBallantine wrote: »

To get other peoples opinions.



What have COMREG got to do with this?
What is DPO/CR?

The legislation is not about possibilities. The caller should be clearly informed if a recording is taking place. The message does not do so.




You obviously don't understand what 'logically impossible' means. The reason they have provided is not true, nor could it be true. It is nonsensical. It is a grammatically correct English sentence construction but it is semantically worthless. (i.e it has no credible meaning)

It is similar to this sentence
'The circle was square'
which is grammatically correct but semantically worthless. The sentence makes no sense.

In relation to a call being sometimes recorded. Many call centres only have recording on certain extensions and not on all. So the sentence is correct as to say you will always be recorded is incorrect and to say you won't be recorded is incorrect. So to say anything other than may would be incorrect.

JoeB-

You have that wrong Will.

The Acts require that each and every individual caller is individually told whether or not their individual call is being recorded. Giving probabilistic info does not suffice. You cannot say 'There is a 50% chance that your call is being recorded', nor can you say 'We record 50% of our calls'. (nor can you say 'We sometimes record calls')


If a company chooses to record on some lines and not others then they are required to have different messages on each line.

If they choose to sometimes record calls and sometimes not to record on the same line then they need to have different messages at different times on the same line.

The messages must be clear and accurate, and individualised. The DP acts are all about individuals, and individual messages. If a company is recording your call you must have been informed, with certainty, prior to any recording taking place.
Saying 'we sometimes record calls' does not comply.




Incidentally, I know from asking the company in question that they always record all calls on all lines. What do you think of them apples? Should the company tell the truth on their messages?





The point is that the Data Protection Commissioner has made it clear on his website.

http://www.dataprotection.ie/viewdoc.asp?m=&fn=/documents/FAQ2012/Contacting_Customers.htm wrote:

...
subject to the provision that callers should be clearly informed, whether it is incoming or outgoing calls, that recording is taking place

...
...
Any pre-recorded message should reflect the exact purposes for recording the call, i.e. training purposes, dispute resolution purposes etc. The purpose(s) for which the calls are being recorded should be pointed out to callers before any personal data is collected. If the purpose is not obvious, each purpose must be outlined.

I cannot accept that a person has been 'clearly informed' if they've been told in the form of a riddle. Or if they've been given probabilistic info.



However the underlying legislation is less clear.
It says

http://www.irishstatutebook.ie/1988/en/act/pub/0025/sec0002.html#sec2 wrote:

.... the information constituting the data shall have been obtained, .... , fairly,

I wonder what the Circuit Court judge would say. Is it acceptable to give notice of recording in the form of a riddle, or as probabilistic info?





Anyway, the use of 'sometimes' is less of a fault than the completely nonsensical reason they give. I wonder how long they can retain the data based on that reason?

ResearchWill

JoeBallantine wrote: »

You have that wrong Will.

The Acts require that each and every individual caller is individually told whether or not their individual call is being recorded. Giving probabilistic info does not suffice. You cannot say 'There is a 50% chance that your call is being recorded', nor can you say 'We record 50% of our calls'. (nor can you say 'We sometimes record calls')


If a company chooses to record on some lines and not others then they are required to have different messages on each line.

If they choose to sometimes record calls and sometimes not to record on the same line then they need to have different messages at different times on the same line.

The messages must be clear and accurate, and individualised. The DP acts are all about individuals, and individual messages. If a company is recording your call you must have been informed, with certainty, prior to any recording taking place.
Saying 'we sometimes record calls' does not comply.




Incidentally, I know from asking the company in question that they always record all calls on all lines. What do you think of them apples? Should the company tell the truth on their messages?





The point is that the Data Protection Commissioner has made it clear on his website.


I cannot accept that a person has been 'clearly informed' if they've been told in the form of a riddle. Or if they've been given probabilistic info.



However the underlying legislation is less clear.
It says

I wonder what the Circuit Court judge would say. Is it acceptable to give notice of recording in the form of a riddle, or as probabilistic info?





Anyway, the use of 'sometimes' is less of a fault than the completely nonsensical reason they give. I wonder how long they can retain the data based on that reason?

The bit in bold can you point me in the direction of the section of the act that makes that requirement.