Whether recording of telephone conversations between customers and staff is in breach of the Personal Data (Privacy) Ordinance.

A: We are not in a position to advise on this matter other than with respect to the Personal Data (Privacy) Ordinance, which we do below. If you have any doubt about your legal position in this regard, whether under the Ordinance, having considered our advice below, or any other laws of Hong Kong, we suggest you seek advice from a qualified legal practitioner.

Generally speaking, the Ordinance is concerned with recorded information that relates to individuals, from which it is reasonably practicable to identify the individual concerned and which is in a form in which access and processing is also reasonably practicable. Such recorded information is referred to as personal data under the Ordinance. To the extent that your activities in recording telephone conversations involve the collection of such data they should comply with the requirements of data protection principle ("DPP")1 in Schedule 1 to the Ordinance. Under DPP1, you are required to use only those means of collecting personal data that are lawful and fair in the circumstances. Whether or not your proposed means of recording telephone conversations are lawful under the laws of Hong Kong is a matter on which you should obtain qualified legal advice (as indicated above). However, even if what you propose to do is lawful, you must still consider whether it is fair in the circumstances of the case.

The approach we take when considering whether a means of collecting personal data, such as recording telephone conversations, that are generally considered as being privacy intrusive are nevertheless fair in the circumstances of the case is to ask whether the purpose to be achieved justifies the use of that means in that case. Also, relevant to this issue is whether less privacy-intrusive means are available to achieve the same result. Examples of the recording of telephone conversations that may be considered fair in the circumstances of the case (subject to proper notice being given to the parties) is in the securities industry where this is done to obtain a record of clients¡¦ instructions for use in the event of a dispute. This provides a significant benefit both to the securities company and its clients as disputes over such instructions can be readily resolved. It is also noteworthy that alternative means of confirming a client¡¦s actual instructions, such as written confirmation being given before they are executed, are not practicable in the context of the securities industry. It is suggested that you adopt a similar approach to the above in considering whether your proposed means of collection of personal data are fair in the particular circumstances of your case.

In addition, DPP1(3) requires that when personal data are collected from the individual who is the subject of the data he or she should be explicitly informed of

(a) the purpose for which the data are to be used;

(b) the classes of person (if any) to whom the data may be transferred; and

(c) the individual's rights to request access to and correction of personal data of which they are the subject and to whom to make such requests.

In the case where personal data are collected repeatedly in the same circumstances without a material difference in the information referred to above, it is not necessary to repeat the notification in relation to each collection (section 35 of the Ordinance refers). However, in such circumstances, the individual should be notified on at least an annual basis (section 35 of the Ordinance also refers). If you wish to make use of these provisions, and they apply to your proposal, you should inform both your staff and your customers of the matters required by DPP1(3) at the outset of the recording activity and repeat the notification at least annually.