Electricity company

What happened

A person filed a complaint with the Finnish Data Protection Authority (Tietosuojavaltuutetun toimisto) regarding not being notified that a sales call had been recorded and being denied access to recording of the call. The Tietosuojavaltuutetun toimisto found that the company’s procedure to record calls did not fulfil the requirements under Article 5(1)(a), 12(1) and 13 GDPR. The decision highlighted that audio is personal data when it is stored and it is possible to identify an individual. As such, companies must inform data subjects when they collect the information. In addition, data subjects have the right to receive a copy of the call. The Data Protection Authority therefore ordered the company to modify its processing operation pursuant to Article 58(2)(d) GDPR.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal data5(1)(a)Read →
• Art. 12Transparent information, communication and modalities for the exercise of the rights of the data subject12(1) · 12(2) · 12(6)Read →
• Art. 13Information to be provided where personal data are collected from the data subjectRead →
• Art. 15Right of access by the data subject15(1)(h) · 15(3) · 15(4)Read →
• Art. 58Powers58(2)Read →

• Data principles
• Data subject rights
• Transparency