Telecommunications company agrees to seek consent to the recording of outgoing marketing calls

PIPEDA Case Summary #2007-384

[Principle 4.2.3, 4.3, 4.3.2 of Schedule 1]

An individual complained that a telecommunications company did not make a practice of obtaining the individual’s consent to its taping of outgoing marketing calls to customers.

The company had called the complainant’s mother, but had not informed her at the time that the call was being tape-recorded.   The company’s policy was to notify individuals of its tape-recording practice in the case of incoming calls, but not in the case of outgoing calls.  For outgoing calls, the company deemed a statement in its written privacy policy to be sufficient notification of the practice.

The Privacy Commissioner found the statement in the privacy policy to be insufficient for the individual’s consent in the case of outgoing calls.  She recommended that the company make a policy and practice of informing customers, at the beginning of each outgoing call, by means of either an automated message or a customer service representative, that the call is to be recorded or otherwise monitored and specifying the reason for doing so.  The company agreed to implement the recommendations.

The following is an overview of the investigation and the Commissioner’s deliberations.

Summary of Investigation

On March 10, 2006, as part of a marketing campaign, a customer service representative for the telecommunications company called the residence of the complainant’s mother, who was a customer of the company.  Early in the ensuing conversation, his mother handed the telephone over to him.

The complainant asked the representative whether the call was being taped, and when she replied in the affirmative, he requested that the taping be stopped.  He also told the representative that she was required to inform the receiving party at the outset that the call was being taped.  He then asked that she have her supervisor contact him.  The representative put him on hold.  The company stated that he then hung up.

Later that month, the complainant’s mother submitted a request to the company for a transcript and a CD copy of the call made to her during the week of March 6 to 10.  In her note, the mother also gave her consent for the complainant to act as her representative.  Two weeks later, the company provided a transcript, but not a CD copy, of the call of March 10.  The complainant subsequently alleged that during the week in question the company had made and recorded not one, but two, calls to his mother’s residence – one that captured his mother’s voice, and one that captured his own.

Some weeks prior to the call of March 10, in response to an information request of the complainant’s, the company had sent him a copy of its privacy policy.  In one section of that policy, the company states that calls received from or placed to customers may be recorded or monitored for quality assurance and that any such recordings would be used solely for ensuring quality service.  Similarly, the company’s voice message for incoming calls states that the call may be monitored and recorded for quality assurance purposes.

The company confirmed that it did make a practice of recording and monitoring customer calls to ensure service quality, but in the case of outgoing calls did not instruct its customer service representatives to bring this practice to the individual’s attention at the time of the call.  The company also indicated that it relied on the above-mentioned privacy policy statement and voice message to notify customers of the practice and purpose of recording calls, whether incoming or outgoing.

On the broader issue of notification, the company argued that most telecommunication companies do not notify their customers of the recording or monitoring of outgoing marketing calls because they see it as an impediment to their business.

Findings

Issued June 21, 2007

Application: Principle 4.2.3 states that the identified purposes for which personal information is collected should be specified at or before the time of collection to the individual from whom the personal information is collected; it goes on to say that the purposes may be specified orally or in writing, depending upon the way in which the information is collected.  Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.  Principle 4.3.2 emphasizes that Principle 4.3 requires knowledge as well as consent and goes on to say that organizations must make a reasonable effort to ensure that the individual is advised of the purposes for which information will be used.

In making her determinations, the Privacy Commissioner deliberated as follows:

• With respect to the company’s purpose of recording calls for quality assurance, it has been established that the company does make a practice of specifying its purpose to the individual customer at the time of receiving an incoming call, but does not make a practice of doing so at the time of making an outgoing marketing call.  In the case of incoming calls, there is no doubt that the company makes a reasonable effort to inform, sufficient for the customer’s consent.  The question was whether the same is true in the case of outgoing calls.
• For such cases, the company has suggested that its statement of the purpose in its written privacy policy is sufficient notification to customers.  The question to be considered is whether this purpose statement constitutes a reasonable effort to inform that is sufficient for consent in the circumstances.
• The Commissioner considered that the statement in the privacy policy was entirely proper, in its own right.  Moreover, such a statement may well be deemed sufficient notification in some cases – notably, where the individual’s acquaintance with the contents of the privacy policy is fairly recent and ready to mind, as the complainant’s may have been in March 2006, after the company had sent him a copy of its policy just a few weeks earlier.
• For the complainant’s mother, on the other hand – and probably for most of the company’s customers – recent and ready acquaintance with purposes stated in a company privacy policy is far less likely to be the case.  The Commissioner noted that, even if they have received and read a written policy at one time, most people need reminding about specifics after a while.  She stressed that this is one reason why the Act not only requires companies to make information about their privacy policies readily available to individuals, but also instructs that they bring their specific purposes to the attention of the individual at the time of the actual collection of personal information.  Consent to collection requires knowledge, and to provide the basis for consent, organizations must make reasonable efforts to ensure not just the possibility, but the presence, of the individual’s knowledge at the time of collection.
• The Commissioner was of the view that, for a practice as privacy-sensitive as the recording of customer calls, customers deserve all the more to be made aware of what is happening at the time it is happening – especially when it is not the customer, but rather the company, that initiates the call.
• In sum, the Commissioner was not satisfied that the company, through its privacy policy or otherwise, made a reasonable effort to inform customers of its purpose of recording outgoing marketing calls for quality assurance and thereby to obtain their consent.  Nor was she moved by the argument that notifying customers of the practice might be an impediment to business.  In her view, if it was indeed an impediment, it was one entirely of an organization’s own making.
• The Commissioner added that, in any event, an organization’s purpose of quality assurance does not trump an individual’s privacy rights.  As far as the Act was concerned, the fact that many customers do not like it when they find out that a company is recording their telephone conversations is no justification for keeping them in the dark.
• The Commissioner recommended that the company make a policy and practice of informing customers, at the beginning of each outgoing marketing call, by either an automated message or by a customer service representative, that the call is to be recorded or otherwise monitored and specifying the reason for doing so.
• The company agreed to implement the recommendation.  The Commissioner therefore determined that the company was now meeting its obligations under Principles 4.2.3, 4.3 and 4.3.2.

The Commissioner therefore concluded that the complaint was well-founded and resolved.

On a final note, the Office amended its guidelines on the taping of customer calls to incorporate our recommendation in this case as a best practice. The guidelines explain that there are some very limited instances in which consent is not required under the Act.  Such instances could include calls made to collect a debt or to investigate a potential case of fraud.  Paragraph 7(1)(b) of the Act provides for such exceptions.