Erhvervsstyrelsen (Danish Business Authority) – Complaint Upheld (Denmark, 2021)

The data subject lodged a complaint with the Danish DPA (Datatilsynet) stating that the Danish Business Authority recorded a telephone conversation of them without their consent. The Business Authority had recorded all incoming calls for the previous two years, each stored for a 96 hours period. According to the Business Authority, the conversations were recorded in order to protect employees from criminal offences and for educational and training purposes. The recording of such calls are therefore covered by the legal bases of vital interest of employees and are necessary for the performance of the agency's obligation to provide general guidance. The DPA made clear, that processing based vital interests of another natural person can ultimately only take place if no other legal basis is applicable. And while the Business Authority as public entity cannot base its processing on legitimate interest, the recording of phone calls could potentially be necessary for the performance of a task carried out in the public interest However, the DPA found that the general recording of all phone calls cannot be considered necessary under Article 6(1)(e) GDPR and Article 5(1)(c) GDPR given the intrusive nature of the processing compared to the rare occurrence of actual threats against employees. Similarly, the DPA emphasizes that recording telephone calls for improving the performance of his or her employees in order or to provide better guidance does not exceed the data subject's interest and therefore require their consent. Therefore, the DPA considers the recording of telephone conducted by the Business Authority unlawful, but must be based on the consent of data subjects in accordance with Article 6(1)(a) GDPR. The Business Authority was ordered to inform the DPA of how it plans to bring the processing activities into compliances within 4 weeks.