Pursuant to Article 104 § 1 of the Act of 14 June 1960 Code of Administrative Procedure (Journal of Laws of 2022, item 2000 t.j.) in connection with Article 7 (1) and (2) of the Act of 10 May 2018 on Personal Data Protection (Journal of Laws of 2019, item 1781 t.j.) and Article 12 (3) and (5), Article 15 (3) and (4), Article 58 (2) lit. c of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 119 of 4 May 2016, p. 1, Official Journal of the EU L 127 of 23 May 2018, p. 2, and Official Journal of the EU L 74 of 4 March 2021, p. 35), hereinafter referred to as Regulation 2016/679, having conducted administrative proceedings concerning a complaint by Ms. M. G., residing in W, about irregularities in the processing of her personal data by F. P. S.A., with its registered office in W. (formerly: F. D. P. S.A.), consisting in the non-fulfilment of a request for access to a copy of personal data concerning her, i.e. a request made pursuant to Article 15(3) of the aforementioned Regulation, by refusing to provide access to the content of a recording of a telephone conversation, the President of the Office for the Protection of Personal Data

orders F. P. S.A., with its registered office in W., to fulfil, with respect to Ms. M. G., residing in W., the information obligation set out in Article 15(3) of Regulation 2016/679 by providing a copy of her personal data recorded in the recordings of telephone conversations with the consultant, taking into account Ms. M. G.’s voice

Justification

The President of the Office for the Protection of Personal Data, hereinafter also referred to as the President of the Office for the Protection of Personal Data, received a complaint from Ms. M. G., residing in W., hereinafter also referred to as the Complainant, about irregularities in the processing of her personal data by F. P. S.A. with its registered office in W. (formerly: F. D. P. S.A.), hereinafter also referred to as the Company, consisting in the failure to fulfil the Complainant’s request for access to a copy of personal data concerning her, i.e. a request made pursuant to Article 15(3) of Regulation 2016/679

In the course of the investigation conducted in the present case, the President of the Office for the Protection of Human Rights established the following

  1. The complainant indicated that she had requested the Company to provide her with a copy of her personal data in the form of recordings of telephone conversations with the Company’s consultants. As she was refused to comply with the aforementioned request, she requested the intervention of the President of the DPAO (evidence: the Complainant’s letter of […] September 2020).
  2. The Company stated that it obtained the Complainant’s data directly from the Complainant in connection with the conclusion of a cooperation agreement on […] March 2018 concerning the handling and settlement of transactions paid by payment cards (evidence: explanations of the Company of […] March 2021).
  3. By letter dated […] March 2020, the applicant requested the Company to provide access to the recording of her conversation with the Company’s consultant dated […] September 2019. The Company responded to the aforementioned request on […] April 2020 indicating, quote: “we do not find the telephone call, from the telephone number […], made with the F. D. P. Customer Service Centre on […].09.2019 that you refer to in your request of […].03.2020. Accordingly, we request to know from which telephone number and to which telephone number you made the call on […].09.2019 in order to obtain information on how to terminate the contract”. Accordingly, the Complainant, by letter dated […] May 2020, again requested access to the aforementioned recording (without indicating the additional information requested by the Company). The Company replied to the aforementioned correspondence […] July 2020, again stating that it was not finding the aforementioned conversation and again requesting the Complainant to indicate additional information. The Complainant, by letter dated […] July 2020, made the following request to the Company: “please make available the recordings of all calls made by me from the telephone number […] to all your helplines between 2019-07-[…] and 2019-12-[…]”. The Company replied to the above correspondence […] August 2020 indicating that, quote: “all available conversations with our consultants have been listened to. The conversation of […].09.2019 concerned the payment deadline of the invoices and the collection proceedings against your company. A further call dated […].10.2019 concerned the confirmation of the fact that the Agreement of […].03.2018 had been terminated. Two further conversations, both dated […].01.2020, concerned the ongoing debt collection by E. K. P. Sp. z o.o. You have been informed that a debit note has been issued for early termination of the Agreement (…). At the same time, we would like to inform you that we do not provide access to the recorded calls due to data security reasons”. In response to the aforementioned letter, the Complainant […] August 2020 again requested access to all recordings of telephone conversations held with the Company’s consultants regarding the Agreement. The Company, by letter of […] September 2020, refused to comply with the aforementioned request in justification again indicating that it does not provide access to call recordings due to data security. At the same time, the Company informed the Complainant what was the subject of the conversations held on the days of: […] October 2019 and […] January 2020, including what personal data they contained: in one case, the Complainant stopped by giving her first and last name before starting the conversation, then gave her VAT number for verification purposes, in the other cases, only the company’s VAT number was given (evidence: explanations of the Company of […] March 2021 with attachments – correspondence exchanged between the Company and the Complainant, k. 34-41 of the case file).
  4. The Company, in its explanations of […] March 2021, also indicated that the complaint is unfounded due to the fact that the conversation in question does not contain personal data. The only personal data in the form of the Tax Identification Number was a verification element provided by the Complainant to confirm with whom the conversation was actually to be conducted. For these reasons, and because the conversation also contains relevant information the disclosure of which adversely affected the rights of others (pursuant to Article 15(4) of Regulation 2016/679), the Company denied the Complainant access to the recording and only provided information on the scope of the data processed (evidence: explanations from the Company of […] March 2021).

In this state of facts, the President of the Office for the Protection of Human Rights (OPA) considered the following

With regard to the allegation concerning the Company’s refusal to comply with the Complainant’s request for a copy of the personal data concerning her – i.e. a request made pursuant to Article 15(3) of Regulation 2016/679 – it should be pointed out that pursuant to the first sentence of Article 15(3) of Regulation 2016/679, the controller shall provide the data subject with a copy of the personal data undergoing processing. In turn, according to paragraph 4 of the indicated provision, the right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others

Pursuant to Article 12(3) of Regulation 2016/679, the controller shall, without undue delay – and in any event within one month of receipt of the request – provide the data subject with information on the action taken in relation to the request pursuant to Articles 15 to 22 (first sentence). If the data subject has communicated his/her request electronically, the information shall, as far as possible, also be provided electronically, unless the data subject requests otherwise (fourth sentence). Pursuant to the second sentence of Article 12(5)(b), if the request of the data subject is manifestly unreasonable or excessive, in particular because of its continuing nature, the controller may refuse to act on the request. The burden of proving that the request is manifestly unreasonable or excessive shall lie with the controller (third sentence)

The obligation set out in Article 15(3) of Regulation 2016/679 may be fulfilled by the controller both by making a copy or a copy of the medium (document or recording) containing the personal data and other data and by providing the right holder with the content of his or her personal data, disregarding the information contained in the medium, which is not personal data within the meaning of Article 4(1) of Regulation 2016/679. If a request is received to provide a copy of the personal data being processed, the controller shall decide on a case-by-case basis how it will fulfil the request. In the case of personal data captured on a recording, it will be a choice between providing a copy of the recording or providing a copy of the data contained in the recording. It must be emphasised that the controller must additionally meet the requirement to control the extent of the personal data transferred in the copy. As indicated in the doctrine (cited): “In addition to the cases indicated in Article 12, a particular limitation on the exercise of the right to obtain a copy of data arises from paragraph 4 of the commented Article 15, according to which the transfer of a copy of data must not adversely affect the rights and freedoms of others. This norm, which draws the boundaries between the rights of the data subject and the rights and freedoms of others, cannot become the basis for depriving the data subject of the possibility to exercise the right granted to him/her to obtain a copy of his/her data. It does, however, require the controller, especially when requesting a copy of the data (recital 63), to control the extent of the information provided. It aims at eliminating from the shared data pool the information whose release could infringe the rights of others. In addition to the right to privacy or the right to protection of personal data, the controller, when providing the entitled person with a copy of data, should also take into account, inter alia, trade secrets, intellectual property or copyright protecting software (recital 63)” (J. Łuczak [in:] ‘RODO. General Data Protection Regulation. Commentary’, ed. E. Bielak-Jomaa, D. Lubasz, Warsaw 2018, Article 15)

The evidence gathered in the present case showed that the Complainant requested the Company on several occasions to provide copies of the content of the recordings of her telephone conversations with the Company’s consultant (i.e. on: […] March 2020, […] May 2020, […] July 2020 and […] August 2020), including in a letter of […] August 2020 invoking Article 15 of Regulation 2016/679. The Company responded to the above by sending the Complainant in text form the contents of her personal data processed by the Company, while refusing to send the requested recordings of her telephone conversations with the Company’s consultant due to data security (point 3 of the facts). In turn, in its explanations, the Company alleged that the complaint was unfounded, claiming that the conversation in question did not contain the Complainant’s personal data

In view of the above, it should be pointed out that the manner in which the Company fulfilled its information obligation under Article 15(3) of Regulation 2016/679 did not take into account the fact that, as a result of storing the recordings of the telephone conversations of […] October 2019 and […] January 2020, it processes personal data also in respect of the Complainant’s voice.

The President of the Office for Personal Data Protection shares the position of the Voivodship Administrative Court in Warsaw as presented in its judgment of 14 July 2016. (ref. II SA/Wa 2080/15), concerning Article 33(1) of the Act of 29 August 1997 on personal data protection (Journal of Laws of 2016, item 922), which, when the Act was in force, regulated the scope of information provided by the personal data controller at the request of the data subject and the deadline for fulfilling the aforementioned information obligation. The court held that – quoted: “the personal data controller, in response to the data subject’s request referred to in Article 33(1) of the Act, should provide information in a simple, comprehensible manner, and not in a way that requires such a person to guess the controller’s intentions or to make some additional interpretation or inference from the answer provided to him/her”

In the opinion of the President of the Office for Harmonisation in the Internal Market, the above remains valid in the current state of the law and applies to the implementation of the obligation under Article 15(3) of Regulation 2016/679, i.e. the form of providing a copy of the processed personal data should not raise doubts in the person requesting it as to whether all their personal data have been covered by the copy

Meanwhile, the Company, in the implementation of the above obligation, did not include among the personal data of the Complainant processed in connection with the telephone calls of […] October 2019 and […] January 2020 her voice

The Company, both in its correspondence with the Complainant and in its explanations, argued as a reason for refusal that disclosure of the requested recordings would adversely affect the rights of others (pursuant to Article 15(4) of Regulation 2016/679). Article 15(4) of Regulation 2016/679 requires that the fulfilment of the data subject’s request must respect the rights and freedoms of bystanders

Indeed, it is within the competence of the controller to assess whether the release of the Complainant’s personal data in the form of telephone call recordings will adversely affect the rights and freedoms of other persons. However, the recognition that such an impact occurs cannot become the basis for depriving the data subject of the possibility to exercise his/her rights under Article 15(3) of Regulation 2016/679

The indicated provision, by drawing a line between the applicant’s rights and the rights of third parties, is intended to protect those third parties in the event that their personal data are included in the sources of which a copy is requested by the data subject – and cannot be regarded as a limitation of the rights of the person requesting the exercise of rights under the law. On the other hand, the finding that the provision of a copy of data may cause an infringement of the rights and freedoms of third parties results in the controller’s obligation to eliminate the information whose provision to the applicant could infringe the rights of third parties – in the case of a recording of a telephone conversation, for example, by anonymising the voice of those persons recorded on the recording. Additionally, it should be emphasised that there are free solutions (software) giving the possibility to remove (mute) the sound from audio recordings

The assessment carried out by the President of the PDPA in each case serves to examine the legitimacy of directing to a particular entity an order corresponding to the disposition of Article 58(2) of Regulation 2016/679 serving to restore the lawful state of affairs in the data processing process – it is therefore justified and necessary only insofar as the personal data processing process covered by the complaint exists. As the evidence in the present case showed, the manner in which the Company implemented its information obligation under Article 15(3) of Regulation 2016/679 towards the Complainant did not include a copy of all her personal data processed by the Company

Thus, there was a prerequisite for the supervisory authority to apply the powers referred to in Article 58(2)(c) of Regulation 2016/679 and order the Company to comply with the information obligation under Article 15(3) of Regulation 2016/679 vis-à-vis the Complainant by providing her with a copy of the personal data recorded in the recordings of the telephone conversations with the consultant of […] October 2019 and […] January 2020, taking into account the Complainant’s voice

In this state of facts and law, the President of the Office for the Protection of Personal Data has ruled as in the operative part

Letter of caution: The decision is final. Pursuant to Article 7(2) of the Act of 10 May 2018 on the protection of personal data (Journal of Laws of 2019, item 1781, i.e.) and in conjunction with Article 13 § 2, Article 53 § 1 and Article 54 of the Act of 30 August 2002. Law on Proceedings before Administrative Courts (Journal of Laws of 2022, item 329 as amended), a party has the right to lodge a complaint against this decision with the Voivodship Administrative Court in Warsaw, within 30 days from the date of delivery of this decision, through the President of the Office for Personal Data Protection (address: Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw). The entry fee for the complaint shall amount to PLN 200. The party has the right to apply for the right to assistance, including exemption from court costs