Whether audio-recording without consent would contravene the requirements of the Ordinance
The Enquiry
Enquired whether audio-recording without consent contravenes the requirements of the Ordinance.
Relevant Provisions of the Ordinance
Collection of Personal Data
Data Protection Principle (DPP) 1(1) of Schedule 1 to the Ordinance stipulates that personal data shall be collected for a lawful purpose directly related to a function or activity of the data user; the collection of the data is necessary for or directly related to that purpose; and the data is adequate but not excessive in relation to that purpose. Under DPP1(2), personal data shall be collected by means which are lawful and fair in the circumstances of the case.
Moreover, DPP1(3) states that when a data user collects personal data from a data subject, all practicable steps shall be taken to ensure that he is informed, on or before collecting the data, of whether it is obligatory or voluntary for him to supply the data and the consequences for him if he fails to supply the data; and the purpose for which the data is to be used and the classes of persons to whom the data may be transferred.
Our Response
The Ordinance is principle-based and technology-neutral, and does not prohibit audio-recording. Generally speaking, whether audio-recording is subject to the regulation of the Ordinance depends on whether the act involves collection of “personal data”. If it is not reasonably practicable for one to directly or indirectly ascertain the identity of an individual from the recording, or the recording party does not intend to compile any information about a specific individual, there is no collection of personal data, and then the Ordinance is not applicable. On the contrary, if a person collects and compiles information about a specific individual through audio-recording, that person as a data user must comply with the requirements of the Ordinance, including DPP1 upon collection of personal data.
Although the Ordinance does not require a data user to obtain a data subject’s consent before collecting his personal data, the data user shall collect adequate, but not excessive, personal data by fair and lawful means, and inform the data subject of the purpose of collection. To avoid disputes, data subjects should be informed that their subsequent conversation will be recorded and the purpose of recording before audio-recording. However, under the conditions specified by the Ordinance (e.g. the data is collected for the prevention or detection of crime, or the prevention of unlawful or seriously improper conduct by persons; and giving the above notice would be likely to prejudice these purposes), data users are exempted from the liability for not giving the above notice.
A data subject may consider audio-recording without his knowledge an undesirable act or intrusion of personal data privacy. Whether it is unlawful or unfair collection of personal data depends on all the circumstances and evidence of the case, e.g. the environment, way and purpose of the recording, reasonable expectation of the data subject on personal data privacy, etc.(Uploaded in September 2020)