You may have read about the possible legal consequences of individuals recording conversations without consent. What happens when organisations record conversations without consent?
If you, as an individual, are acting on behalf of an organisation when you record a conversation that contains personal data about a person and consent from that person has not been obtained, you will not be sued.
However, the organisation that has commissioned you to record that conversation containing the person’s personal data may be reported by him/her to the Personal Data Protection Commission (PDPC) or he/she may sue the organisation for the contravention of the PDPA.
The Personal Data Protection Act 2012
The Personal Data Protection Act 2012 (PDPA) is an Act that governs the collection use and disclosure of personal data by organisations.
The PDPA applies to all organisations, including:
- individuals
- companies
- associations/bodies of persons
It does not matter whether the organisation is incorporated or unincorporated, recognised under Singapore law, or whether it has an office or place of business in Singapore.
However, the PDPA does not impose any obligations on:
- any individual acting in a personal or domestic capacity;
- any employee acting in the course of his employment with an organisation;
- any public agency or any organisation that acts on behalf of a public agency in relation to the collection, use or disclosure of the personal data
What is personal data?
Under the PDPA, “personal data” refers to data about an individual who can be identified from that data. Any data will also be considered as personal data if the data, combined with information that the organisation collecting the information already has, may lead to the identification of an individual. Whether the data is true or not does not matter. Consent needs to be obtained from the individual before the data can be collected, used or disclosed.
Examples of personal data include:
- NRIC number
- Full name
- Passport number
- Photograph or video recording of an individual
- Name and residential address
For example, John’s telephone number is registered with Company A, a telecommunications company. Company A would as such have access to information related to him. One day, his network connection suddenly becomes very slow and he calls Company A to lodge a complaint. He provides the customer service officer with an alternative telephone number to contact him with. That telephone number would constitute personal data, as he may be readily identified by anybody who calls that number. Therefore, if Company A discloses that telephone number without John’s consent, they may be sued by him.
Who needs to obtain the consent?
If you are recording a conversation that contains the personal data of an individual in the form of audio or video recording in the course of your own business, you will be required to obtain consent from the individual.
However, if you are recording the conversation on behalf of and for the purposes of an organisation or in your capacity as an employee of that organisation, you do not need to obtain consent from the individual. That responsibility falls on the organisation.
Where was the conversation recorded?
In general, consent need not be obtained if the conversation recorded was made at a location or an event that is open to the public, such as a mall roadshow, and the personal data in the conversation recorded is generally available to the public.
If an individual voluntarily permits a video recording of a conversation containing his personal data, express consent from the individual need not be obtained as he will be considered to have consented to the conversation and his personal data being recorded.
Consent will need to be obtained if the individual and his personal data were recorded while he was in the background and he is identifiable from the background.
What would happen if a complaint is made to the Personal Data Protection Commission?
When a complaint is received by the PDPC, the PDPC may take the following actions:
- Facilitate communications between parties if it can help to address the individual’s concerns
- Refer the matter for mediation by a qualified mediator if the matter cannot be resolved directly and require additional assistance and when both parties agree on mediation
- Direct the parties to resolve the matter through alternative dispute resolutions
- Conduct an investigation to determine whether the organisation was compliant with the PDPA
Under the PDPA, the PDPC may order you or the organisation to:
- Stop collecting, using or disclosing personal data in contravention of the PDPA; or
- Destroy personal data collected in contravention of the PDPA; or
- Pay a financial penalty of:
- For individuals: 5% of the person’s annual turnover in Singapore for persons with annual local turnover exceeding S$20 million, or up to S$200,000, whichever is higher.
- For organisations: 10% of the organisation’s annual turnover in Singapore for organisations with annual local turnover exceeding S$10 million, or up to S$1 million, whichever is higher.
What happens if the individual sues the organisation?
Under Section 48O of the PDPA, any individual who has suffered loss or damage directly as result of a contravention of the PDPA with regard to the collection, use and disclosure of personal data by an organisation has a right to sue for relief in civil proceedings in a court.
The burden lies on the individual to show that he has suffered loss or damage directly because of the recording, use and disclosure of the conversation with the personal data.
Remedies for contravention of the PDPA
If the individual can successfully prove that he has suffered loss or damage from the recording, use or disclosure of the conversation with personal data, the following remedies may be awarded against you or the organisation:
- an injunction to stop the organisation from collecting, using and disclosing the conversation with the personal data;
- a declaration that the organisation will not collect, use or disclose the recorded conversation;
- damages for causing loss to the individual; and
- any other relief that the court thinks fit
