Persónuvernd (Iceland) - 2021101915
From GDPRhub
| Persónuvernd - 2021101915 | |
|---|---|
 | |
| Authority: | Persónuvernd (Iceland) |
| Jurisdiction: | Iceland |
| Relevant Law: | Article 5 GDPR Article 6 GDPR Article 13 GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 07.02.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 2021101915 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Icelandic |
| Original Source: | Persónuvernd (in IS) |
| Initial Contributor: | ls |
The Icelandic DPA held that a person who transferred recorded calls to the police as evidence of abuse had a legitimate interest to do so and did not have to inform the person whose calls were recorded.
English Summary
Facts
After suffering mental abuse and threats, person A (controller) recorded telephone calls from her ex-partner (and father of her child) B and forwarded them to the police, lawyers and the public prosecutor. B, the data subject, stated that these recordings were made without his knowledge and consent. He therefore lodged a complaint with the Icelandic DPA.
A explained that B had been mentally abusive and that it was therefore the transfer of the recordings was self-defence and evidence of the abuse.
Holding
The DPA distinguished between two operations: the recording of phone conversations and their transmission to the police. For the recording of the phone calls, the DPA explained that the processing of data by an individual that only concerns his or her private interests or those of his or her family is not subject to the GDPR.
However, the transfer of the recordings to the police was subject to the GDPR as they were outside the private sphere. The DPA considered that it was necessary to transfer the recordings to the police for A's safety. A therefore demonstrated a legitimate interest in the processing in accordance with Article 6 GDPR which superseded B's interest in protecting his privacy.
The DPA also found that the principle of minimisation of Article 5(1)(c) GDPR was respected. As regards the right to information under Article 13 GDPR, the DPA balanced B's interest in receiving this information against the controller's (A) urgent interest in informing the police. It concluded that Controller A was not obliged to provide the information under Article 13.
In conclusion, no violation was found and the complaint was therefore rejected.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.
Solutions Recording phone calls and sharing them with the police Case no. 2021101915 7.2.2023 Audio recordings made for personal use are generally not covered by the Privacy Act. If they are shared with others, however, the sharing falls under the law and must comply with it. This includes, among other things, that it may be necessary to inform those who are on the recording about the transmission. In this case, however, it was a matter of sharing a recording with the police, which was intended to demonstrate criminal behavior, and in those circumstances it is believed that the obligation to inform the registered party of the sharing can be waived, if certain conditions are met . ---- In this case, the responsible party recorded phone calls with her child's father and passed them on to the police. As was the case here, it was the opinion of the Data Protection Authority that the recording in question was only for the benefit of the responsible party himself and his family, and therefore the processing fell outside the scope of the Personal Protection Act, as the Act does not deal with an individual's processing of personal information that only concerns his or his family's private interests or are intended for personal use only. The transfer of the audio recordings to the police, however, was considered to be the processing of personal information that falls within the scope of the law. As far as this communication was concerned, it was the opinion of the Data Protection Authority that it had been necessary for the responsible party to protect its privacy and security and that it had a legitimate interest in the communication. The complaint also stated that the complainant had not been instructed on the processing of personal information about him. However, there are certain exceptions to the law's principle of the duty of education, and the Norwegian Data Protection Authority considered them to be relevant in this case, as the personal information was shared with the police in order to demonstrate a criminal offence. In addition, it was considered that the responsible party's urgent interests in communicating the complainant's personal information to the police, without having to inform him about it, outweighed the complainant's interests in being informed about the sharing. Ruling about a complaint about the recording of phone calls by [B] and their transmission to the police in case no. 2021101915: i Procedure 1. The reason for the case On October 4, 2021, Personal Protection received a complaint from [A] (hereinafter the complainant) about the recording of [B]'s phone calls without his consent or knowledge and their dissemination to the police, district prosecutor, courts and lawyers. Personal protection invited [B] to comment on the complaint by letter, dated 15 September 2022, and her answers were received by e-mail on 4 and 18 October s.á. together with a copy of the judgment of the District Court [...] no. [...]. The complainant was then given the opportunity to provide comments on [B]'s answers via e-mail on 20.s.m. and received them by email the same day. In light of the responses received and the complainant's comments to the Personal Protection procedure, it was confirmed that he had until December 14, 2022 to submit further comments to [B]'s responses. The complainant's answers were received by e-mail on December 7, 9 and 10. Judging from the complaint, Personal Protection considered that there was also a complaint about the processing of the complainant's personal information by the police in the capital area, and the police were therefore notified of the complaint on November 21, 2022 and given the opportunity to comment on it. During the course of the case, it was stated in the complainant's answers that he did not intend to complain about the police's processing, and that aspect of the complaint was therefore cancelled. When resolving the case, all of the above-mentioned documents have been taken into account, although not all of them are separately explained in the following ruling. There is a dispute as to whether [B] was allowed to record phone calls with the complainant without his knowledge and consent and pass them on to the police, district prosecutor, courts and lawyers. 2. Complainant's point of view The complainant relies on the fact that [B], between January and February 2019, recorded phone calls she had with the complainant, but their [child] also took part in said conversations. The complainant also relies on the fact that the phone calls were recorded secretly and therefore without his knowledge or consent. [B] subsequently handed over his phone to the police, who retrieved the communication summary from the device and copied the audio recordings, which were then disclosed to the police, district attorney, lawyers and courts. 3. point of view [B] On the part of [B], it is based on the fact that she suffered violence at the hands of the complainant. Part of the violence was mental violence and the recording of the phone calls was done in self-defense. She only gave the tapes to the police because of the complaint she filed against the complainant and he subsequently received a sentence for the violence against her. [B]'s answers included a copy of the judgment of the District Court [...] in case no. [...] where it is stated that the complainant has been sentenced for [various offences, i.e. on m. violent offence, towards B]. The court's decision was based, among other things, on the complainant's comments on the audio recordings in question. II. Conclusion 1. Delimitation of the case and substantive scope of Act no. 90/2018 This case is two-fold and concerns, on the one hand, the audio recordings [B] of her calls to the complainant, and on the other hand, the transmission of the audio recordings to the police. Personal protection rulings in disputes concerning Act no. 90/2018, on personal protection and processing of personal information. The material scope of the law is discussed in Article 4. of them, but it states that the law and regulation (EU) 2016/679 apply to the processing of personal data that is partially or fully automated and the processing by methods other than automated of personal data that is or is to become part of a file. The authority of the Personal Protection Authority is also determined by the above, cf. Paragraph 1 Article 39 of the law. According to paragraph 2 Article 4 of the law, cf. point c, paragraph 2 Article 2 of the regulation, the processing of an individual, which is carried out solely for the benefit of himself or his family, falls outside the material scope. Also, point 18 of the preamble of Regulation (EU) 2016/679 contains more detailed explanations of the aforementioned provision. It states that the regulation does not apply to an individual's processing of personal information if it is only for the benefit of himself or his family and thus has no connection with business or commercial activities. Examples of activities that fall under the said provision are also listed, but based on that list, it is important whether these are normal and legitimate activities and whether the processing is only for pure private gain or not. 2. Audio recording [B] of calls to the complainant From the case file, it is clear that [B] recorded her private phone calls with the complainant, who is the father of her child. It is also known that the audio recordings were used as proof that she had been threatened and harmed by the complainant. They were therefore obtained for the protection of her safety and private life and they protected her private interests. With the judgment of the District Court [...], in case no. [...], the complainant was convicted [of repeatedly abusing B, including] mental abuse during phone calls he had with her. [B]'s processing of the complainant's personal information, which consisted in the recording of these calls, was therefore only for the benefit of herself and her family. In addition, the processing had no connection with professional or commercial activities, but was a normal and legitimate activity that concerned her pure private interest. In view of the above, it is the opinion of the Personal Protection Authority that the recording of the calls involved processing that falls outside the material scope of the law and regulation, cf. Paragraph 2 Article 4 Act no. 90/2018 on personal protection and processing of personal information, cf. point c, paragraph 2 Article 2 of regulation (EU) 2016/679. The complainant has referred, among other things, to the fact that the recording in question did not comply with the provisions of the Telecommunications Act on the recording of phone calls, but in Article 48. applicable law no. 81/2003 on telecommunications (cf. now a similar provision in Article 91 of the new Act no. 70/2022 on telecommunications) stipulated the obligation of the person who wanted to record a call to inform the interlocutor of his intention at the beginning of the call. The aforementioned provision of the Electronic Communications Act may, depending on the circumstances, be relevant when assessing whether the requirements of Act no. 90/2018 and regulation (EU) 2016/679 on educational obligations and transparency have been followed, cf. in particular number 1. Paragraph 1 Article 8 and Article 17 of the Act and point a of the 1st paragraph Article 5 and Article 13 of the regulation. Since the recording as such did not involve the processing of personal information that fell within the scope of the law and regulation, it will not be considered that the law's requirements for education and transparency applied to the recording. It follows that there was no obligation to inform her under the circumstances that existed here. With reference to the above, the aspect of the complaint relating to the recording and the teaching about it is dismissed. 3. Sharing the tapes with the police The aspect of the complaint that concerns the transmission of the audio recordings to the police will then be examined. It is known that [B] went to the police because of the complainant's serious and repeated violence towards her and filed a complaint. With the complaint, [B] submitted audio recordings of his calls to the complainant as evidence in the said criminal case. Since the recordings were shared with the police, they were also shared outside the realm of private life [B]. Can the processing therefore not fall under the exemption clause of paragraph 2. Article 4 Act no. 90/2018, cf. point c, paragraph 2 Article 2 of regulation (EU) 2016/679. Will the aforementioned processing fall under one of the authorization provisions of Article 9. Act no. 90/2018, cf. Article 6 of regulation (EU) 2016/679. For example, personal data may be processed if it is necessary for the legitimate interests of the responsible party or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data are outweighed, cf. Number 6. of the legal provision and section f of the regulatory provision. As mentioned above, [B] went to the police and filed a complaint against the complainant for serious violent offenses against her, and the complainant was subsequently sentenced [...], i.a. on the basis of said recordings. It is the opinion of the Data Protection Authority that it was [B] necessary to share the recordings with personal information about the complainant in order to protect her privacy and security and that she had a legitimate interest in that processing. Then it will not be seen that the complainant's legitimate interests or fundamental rights and freedoms, which required the protection of personal information about him, outweighed them. The media could therefore rely on the authorization to process personal information according to section 6. Article 9 Act no. 90/2018 and point f of paragraph 1. Article 6 of regulation (EU) 2016/679. In addition to authorization according to the above, the processing of personal data must be compatible with all the principles of paragraph 1. Article 8 Act no. 90/2018, cf. Article 5 of regulation (EU) 2016/679. The principles stipulate, among other things, that personal data must be processed in a lawful, fair and transparent manner towards the data subject (paragraph 1 of the legal provision and paragraph a of the regulatory provision) and that it must be sufficient, relevant and not beyond what is necessary based on the purpose of the processing (section 3 of the legal provision and section c of the regulatory provision). When explaining the principle of transparency in the processing of personal data, it is necessary, as appropriate, to consider the provisions on the responsible party's educational obligation towards the data subject, cf. Paragraph 2 Article 17 Act no. 90/2018 and Articles 13 and 14 of regulation (EU) 2016/679. Here, however, it is necessary to consider that according to paragraph 1. Article 23 Regulation (EU) 2016/679, the scope of the obligations and rights mentioned in Articles 13 and 14 may be limited by law. of the regulation. Corresponding provisions can be found in paragraph 4. Article 17 Act no. 90/2018. In the comments to the provision in the bill that became the law, it is stated that there are exceptions made to the rights of the registered person. These exceptions are based on the sources stated in paragraph 1. Article 23 of the regulation. Personal protection considers it clear from the explanatory documents that the provisions of paragraph 4. Article 17 Act no. 90/2018 is not only aimed at codifying the exemption authority of paragraph 1. Article 23 Regulation (EU) 2016/679 but the legal provision also includes independent exemptions from 13-15. art. of the regulation, in the interests of the specified goals, cf. i.a. ruling of the Personal Protection Authority from 16 December 2021 in case no. 2020010635. According to number 4. Paragraph 4 Article 17 Act no. 90/2018, it is thus permitted to limit the educational obligation according to Articles 13 and 14. of Regulation (EU) 2016/679, it is necessary to prevent, investigate, detect or prosecute criminal offenses or satisfy criminal sanctions, including to protect against and prevent threats to public safety. Is the provision consistent with point d, paragraph 1. Article 23 of the regulation. Pursuant to this, the Personal Protection Authority believes that the provision in question must be clarified so that deviations from the provisions of Article 13 may be permitted. of Regulation (EU) 2016/679 in relation to the sharing of personal information with the police in order to demonstrate criminal offences. In paragraph 3 Article 17 the law also contains an exception rule to the effect that provisions 1.-3. paragraph Article 13 of the regulation does not apply if the urgent interests of individuals related to the information outweigh it. In comments to the provision in the bill that became law no. 90/2018 states that if the data subject's right to information is to be waived on the basis of the provision, an assessment of the interests mentioned in the provision must be carried out. Thus, the interest of the data subject in obtaining information or access must be weighed against the interests of other persons, e.g. due to consideration of trade secrets of a private party, a minor child of the registered person or witnesses in a court case. It is also important to bear in mind that there is a requirement for "urgent" interests of individuals that need to be demonstrated to justify an exception to the data subject's right to information. In the case in question, the Personal Protection Authority believes that this exception may apply, in addition to the above-mentioned provision of section 4. Paragraph 4 Article 17 of the law, but it can be accepted that the responsible party had a pressing interest in communicating the said information to the police without having to inform the complainant about it. Is it taken into account that the police have, among other things, the statutory role of reporting crimes, stopping illegal behavior and following up on cases in accordance with what is prescribed in the law on the handling of criminal cases or other laws, cf. c-section 2. no. Paragraph 1 police law no. 90/1996. As is the case here, the Data Protection Authority considers it clear that these interests of the controller have outweighed the interests of the complainant in receiving information about the sharing. Taking into account all of the above, the Data Protection Authority believes that the responsible party was not, as in the case here, obliged to provide the complainant with education about the processing of his personal information that is being discussed here in accordance with Article 13. of regulation (EU) 2016/679, cf. Article 17 Act no. 90/2018. Then, taking into account that result, it will not be considered that the mediation has violated the transparency requirement of item 1. Paragraph 1 Article 8 Act no. 90/2018 and point a of paragraph 1. Article 5 of regulation (EU) 2016/679. In addition, it will not be seen that the audio recordings that are discussed here were more than what could be considered necessary in order to prove the behavior of the complainant during the period in question. Therefore, Personal Protection believes that [B] has taken care of the proportionality requirement of item 3. Paragraph 1 Article 8 Act no. 90/2018 and point c of paragraph 1. Article 5 of regulation (EU) 2016/679 during the processing. Otherwise, it cannot be seen that [B]'s sharing of the audio recordings of calls with the complainant violated the law. Is the conclusion of the Personal Protection Agency therefore that the communication was in accordance with Act no. 90/2018 and Regulation (EU) 2016/679. Ruling: The part of [A]'s complaint concerning the recording of [B]'s calls to him is dismissed. Sharing [B] of the audio recordings of calls with [A] to the police was consistent with the provisions of Act no. 90/2018, on personal protection and processing of personal information, cf. regulation (EU) 2016/679. Privacy, February 7, 2023 Ólafur Garðarsson chairman Björn Geirsson Sindri M. Stephensen Vilhelmína Haraldsdóttir Þorvarður Kári Ólafsson
