Secret audio recordings of conversations led to serious criticism
The Danish Data Protection Agency has issued serious criticism of a dental company that secretly recorded conversations with an employee. The company could not rely on a court case three years later as the legal basis for its recordings.
A dental company secretly recorded conversations with an employee during the final two years of a three-year employment relationship. The company decided to record the conversations because of conflicts arising from the employee’s behaviour, quality of work, and complaints from patients. The recordings were also related to meetings regarding sick leave.
The Data Protection Agency decided that the company did not have a legal basis for recording the conversations. It also noted that the company had breached the principle of transparency by not disclosing the fact that the conversations were being recorded.
As part of its assessment, the Danish Data Protection Agency recognised that there may be a legitimate interest in securing evidence for future, potential legal claims. However, at the time the recordings took place, there was no indication that such a claim would arise. The company recorded the conversations more than 16 months before the employee left, and more than three years before the court case was initiated.
IUNO’s opinion
This decision shows that it is difficult to secure a lawful basis for secretly recording an employee. Being recorded as part of a conversation is such an unexpected processing activity that employees by default, should be notified in advance. In this matter, it was not a separate information obligation, but a duty to be notified based on the principle of transparency.
IUNO recommends that companies ensure that all processing activities comply with the principle of transparency. Consequently, it might not always be sufficient to point to the information that employees have received as part of the applicable privacy policy. Some processing activities may be so unexpected that additional information is required.
[Decision of the Danish Data Protection Agency of 26 August 2024, case no. 2024-31-1076]
A dental company secretly recorded conversations with an employee during the final two years of a three-year employment relationship. The company decided to record the conversations because of conflicts arising from the employee’s behaviour, quality of work, and complaints from patients. The recordings were also related to meetings regarding sick leave.
The Data Protection Agency decided that the company did not have a legal basis for recording the conversations. It also noted that the company had breached the principle of transparency by not disclosing the fact that the conversations were being recorded.
As part of its assessment, the Danish Data Protection Agency recognised that there may be a legitimate interest in securing evidence for future, potential legal claims. However, at the time the recordings took place, there was no indication that such a claim would arise. The company recorded the conversations more than 16 months before the employee left, and more than three years before the court case was initiated.
IUNO’s opinion
This decision shows that it is difficult to secure a lawful basis for secretly recording an employee. Being recorded as part of a conversation is such an unexpected processing activity that employees by default, should be notified in advance. In this matter, it was not a separate information obligation, but a duty to be notified based on the principle of transparency.
IUNO recommends that companies ensure that all processing activities comply with the principle of transparency. Consequently, it might not always be sufficient to point to the information that employees have received as part of the applicable privacy policy. Some processing activities may be so unexpected that additional information is required.
[Decision of the Danish Data Protection Agency of 26 August 2024, case no. 2024-31-1076]
Similar
Updated guidelines regarding breaches of data security
New rules on CCTV monitoring
The new NIS 2 Act has entered into force
New draft bill to protect against misuse of deepfakes
New rules on responsible use of AI have entered into force
Simplification of record-keeping obligations under the GDPR is on the way