Seven years after the issuance of the Decision 629/2010 (Guidelines on the Processing of Data resulting from Call Recording), the Portuguese Data Protection Authority (CNPD) has now revised said Decision, namely in what concerns the maximum period of retention of the personal data resulting from the call recording.
We recall that, pursuant to the Decision 629/2010, the processing of personal data resulting from call recording is only allowed in three situations: (i) in the context of a contractual relationship, for purposes of evidencing the existence of commercial transactions and any other communications regarding the contractual relationship; (ii) in the context of emergency situations; and (iii) for purposes of monitoring the quality of the service. Pursuant to said Decision 629/2010, personal data resulting from the call recording in the situations (i) and (ii) mentioned above could only be retained for a 90-day maximum period, whilst personal data resulting from call recording for purposes of monitoring the quality of the service could only be retained for a 30-day maximum period.
In view of the increase of distance contracts and, on the other hand, taking into account that the 90-day maximum retention period for “contractual” purposes was, in some cases, non-compliant with the retention duty imposed by law to certain contractual relationships, CNPD decided to issue Decision 1039/2017, amending Decision 629/2010 in what concerns the maximum retention period applicable to personal data resulting from call recording in the context of contractual relationships, for purposes of evidencing the existence of commercial transactions and any other communications regarding the contractual relationship.
Although this new Decision 1039/2017 affects the authorizations for call recording for “contractual” purposes issued by the CNPD prior to this Decision (by extending the retention term established in those authorizations), please note that, in certain situations (e.g., call recording for anti-money laundering purposes), the CNPD had already authorized a retention period different from the 90-days period set out in the Decision 629/2010.
According to this new Decision, the personal data resulting for call recording in the context of a contractual relationship, for purposes of evidencing the existence of commercial transactions and any other communications regarding the contractual relationship shall be retained as follows:
- As to generic distance contracts, the call records may be retained for a maximum period of 24 (twenty-four) months plus the corresponding limitation or prescription period. Where the distance contract refers to the insurance activity, the call records must be retained for all the duration of the contractual relationship, or further where there still are contractual obligations to be fulfilled;
- As to electronic communications contracts with minimum binding periods, the call records must be retained for the duration of the binding period (6, 12 or 24 months) plus the limitation and prescription period which, in these cases, is of 6 months. Nevertheless, the maximum retention period cannot exceed 30 (thirty) months in any event (i.e., regardless of the binding period agreed);
- As to electronic communications contracts in general, call records must be retained for the duration of the contract plus the limitation and prescription period which, in these cases, is of 6 months, with a maximum limit of 30 (thirty) months. In the event of termination of the contract, call records may only be retained for the 6 (six) months following the termination. Where the contract is not concluded, call records must be deleted;
- Finally, as to financial operations, the Law against Money Laundering and Terrorist Financing requires the retention of any records, including call records, for a period of 7 (seven) years in order to allow the reconstitution of the operation. However, the CNPD clarifies that retention duty is only established for supervision and control purposes. Therefore, for purposes of evidence of the commercial transactions, the general retention period applies.