Data Protection Commissioner
Data Protection Commissioner

Case Study 2

International Bank-recording of telephone calls-lack of transparency-legitimate business interest-satisfactory response

I received a complaint from an individual who stated that in the course of her employment for a particular company she received a telephone call from one of the major international banking organisations based in Ireland. In the course of the call, she heard 'pips' on the line and, on enquiring, was informed that the call was being recorded but no explanation for the recording was given by the person representing the bank.

My Office contacted the banking organisation involved and inquired why people were not made aware that such recording was taking place and the security procedures in place. It clearly is important in Data Protections terms that an individual is aware of and gives consent to such recordings. I, of course, appreciate that in the financial world it can be necessary when telephone instructions are given that some record has to be available in case a dispute arises.

In response the bank stated that, in line with industry practice in the financial services sector in Ireland, it operated an automated telephone recording system. Under this system, calls are automatically recorded and the recordings are retained for one year. Access to these recordings, permitted only under strictly controlled conditions, is limited either to where evidence is required in the case of a dispute by a customer as to an instruction or confirmation given, or where there is an investigation of suspected fraud or other criminal activity. Only a limited number of senior individuals had access to the recordings, which are kept in a secure room in a secure locked cabinet and then only where documentation had been completed and approved.

The bank initially disputed whether personal data was involved, arguing that although the system was capable of automatic operation in that it listed details of particular calls made at a particular time, to or from a particular telephone number, it was questionable whether the recordings contain data relating to an 'identifiable individual'. It was explained to the bank that, from a data protection perspective, it had the capacity to identify the individual by accessing the telephone recording system and using this in conjunction with other data held by the company thereby bringing it within the scope of the Data Protection Act.

The bank also indicated that their target market in Ireland is aimed at a strict market consisting of multinational corporates, financial institutions and the Government and that their business in Ireland was not retail based. It stated that the telephone recording system which they operated at the time of the Office's enquiry was first implemented in 2000 and did not have the capability of restricting the recording of calls to specific telephone extensions or business critical areas. It was in the process of installing a new system which would have the capability to limit the recording of calls to business critical areas only. It was also introducing automated messages within the telephone system which would advise that the call was being recorded and the purpose of the recording. I consider that a legitimate interest basis exists for the recording of calls in business critical areas in the financial services sector, subject to the proviso that callers should be clearly informed that recording is taking place and the caller can then either go on with the call or not.

Clearly in this case there was not sufficient transparency in relation to the recording of calls - 'pips' on the line would not normally alert somebody to the fact that the call is being recorded. However, I am satisfied that the bank have now addressed this satisfactorily by the automated messaging system, limiting the recording of calls to business critical areas, advising callers that phone calls are being recorded and the purpose of the recording.

I am glad that this important matter which has wider application was brought to my attention and I also appreciated the time taken and the manner in which this banking organisation addressed the issues raised in a constructive manner.