| CNPD - Deliberação 2019/21 | |
|---|---|
 | |
| Authority: | CNPD (Portugal) |
| Jurisdiction: | Portugal |
| Relevant Law: | Article 15(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 05.02.2019 |
| Published: | 05.02.2019 |
| Fine: | 20.000 EUR |
| Parties: | n/a |
| National Case Number/Name: | Deliberação 2019/21 |
| European Case Law Identifier: | Processo n.º 2018/10788 |
| Appeal: | Unknown |
| Original Language(s): | Portuguese |
| Original Source: | CNPD (in PT) |
| Initial Contributor: | n/a |
Portuguese DPA rules that phone call recordings must be made available to the data subject upon his/her request under article 15 GDPR.
English Summary
Facts
A data subject made a data access request pursuant to article 15 GDPR, with a view to accessing several recordings of phone call in which he had participated. The call centre operator - the data processor - was instructed by the controller not to deliver any such recordings unless a judicial order or an administrative authority request was received. Upon expiration of the applicable 90 days storage period, the (chronologically) first phone call recording was deleted without having been sent to the data subject, as he had requested. The remaining three recordings were eventually handed to the data subject upon CNPD's order (through Deliberação n.º 1154/2018, of the 18th December).
Dispute
Are phone call recordings' contents covered by article 15 GDPR as personal data which a data subjects has a right to access upon request?
Holding
Contrary to what the controller argued, the reason why it refused to grant access to the phone call recordings was not because the controller could not assert that the data subject was (in fact) the person sending the access request, but because it had defined an internal rule of not granting access to phone call recordings without a judicial or administrative authority order. In that view, and since (i) the controller knowingly breached the data subject's access right and (ii) given the particularly sensitive nature of the data at stake - electronic communications content data, which is protected under article 34 of the Portuguese Constitution and article 7 of the Charter of Fundamental Rights of the European Union -, the Portuguese DPA decided to sanction the controller with a EUR 20,000 fine.
Comment
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Portuguese original. Please refer to the Portuguese original for more details.
