P and Retail Company [2011] AICmrCN 10 (22 December 2011)

Subject heading

Collection of personal information

Law

National Privacy Principle 1.1 and 1.2 in Schedule 3 of the Privacy Act 1988 (Cth).

Facts

The complainant alleged that a retail company recorded outbound calls it made to them without providing notification that it was recording the calls.

When the complainant became aware the retail company was recording the calls they objected as they had not been notified or asked for their consent to record the calls.

The retail company verbally apologised. However, it advised the complainant that they had been notified about the recording of calls by the interactive voice response system when they made their first inbound call to the retail company.

On this basis, the retail company claimed the complainant was aware the call was being recorded and consent to the collection of such information could be implied.

The complainant sought a public apology from the retail company.

Issues

NPP 1.1 states that an organisation must not collect personal information unless the information is necessary for one or more its functions or activities.

NPP 1.2 states that organisations must only collect information by lawful and fair means, and not in an unreasonably intrusive way.

Outcome

The Commissioner investigated the matter under section 40(1) of the Privacy Act.

The retail company outlined that its collection of information via the recording of calls was for training, coaching and monitoring purposes including to process orders and action enquiries. The Commissioner took the view that the collection of the information by recording phone calls was necessary for one of the retail company's functions and the company had met the requirements of NPP 1.1.

In considering whether the collection was by fair and lawful means, the Commissioner had regard to the relevant industry standards[1] and telecommunications recording laws. The Telecommunications (Interception and Access) Act 1979 (Cth) specifies that all parties in the telephone conversation must have actual knowledge that the conversation will be monitored and this notification must occur prior to the activity taking place for both inbound and outbound calls. Notification can be by pre-recorded message, verbal or written notification.

The Commissioner did not accept that the subsequent calls received by the complainant were a continuation of the original incoming call where notification had been provided. The respondent claimed that it was relying on implied consent from the complainant when it collected personal information in subsequent outbound calls. In particular, the retail company claimed that its privacy policy outlines that as part of its terms and conditions that a customer agrees to the collection of personal information in ways the company considers appropriate including for a purpose to which an individual consents (express or inferred consent).

The Commissioner reviewed the retail company's privacy policy and formed the view that it did not provide sufficient notification that the collection of information via call recording would occur. The Commissioner considered that the issue of consent was not relevant in this case as NPP 1 does not require organisations to obtain consent before collecting personal information about an individual. However it does impose a requirement that notice about certain matters is given at or as soon as is practicable after the collection occurs.

As the complainant was not notified that the retail company was recording outbound calls and, taking into consideration the company's other legal obligations, the Commissioner formed the view that the collection of personal information during such calls was unfair and unlawful. Therefore, the Commissioner found that the retail company had not complied with NPP 1.2.

Subsequently, the retail company changed its procedures for recording calls. It implemented a procedure where a standard script is read by the relevant staff member when making outbound calls to advise the individual the call is being monitored and recorded for training purposes. The retail company also offered to apologise in writing to the complainant rather than making a public apology. However, the complainant did not pursue this offer.

The Commissioner subsequently closed the complaint under section 41(2)(a) of the Privacy Act on the ground that the retail company had adequately dealt with the matter.

Office of the Australian Information Commissioner

December 2011

---

[1]Communications Alliance Ltd Guideline G516: 2004 Participant Monitoring of Voice Communications.