On 8 September 2017, the Portuguese Data Protection Authority ("CNPD") has published in its website Decision No. 1039/2017, adopted on 27 July 2017, in which the CNPD revises the time periods to keep recordings of telephone calls.
Recordings of telephone calls may be made under the terms of article 4 (3) of Act no. 41/2004, of 21 August (as amended by Act no. 46/2012, of 21 August), which permits "legally authorised recording of communications and the related traffic data when carried out in the course of lawful business practice for the purpose of providing evidence of a commercial transaction or of any other communication made in the framework of a contractual relationship", provided the data subject has been informed and has given his/her consent.
Since there is no legal provision providing the time period to keep the aforementioned recordings, it falls to the CNPD to fix such period, a power which is vested on the CNPD by article 23 (1) (f ) of Act no. 67/98, of 26 October (the Data Protection Act). This was done in the CNPD’s Decision No. 629/2010, which provided a maximum period of 90 days for keeping recordings of telephone calls whenever the purpose was to provide evidence of commercial transactions or of other communications made in the framework of a contractual relationship.
The CNPD, recognizing (i) the increasing offer of goods or services by telephone, (ii) that current technology allows companies to have more efficient mechanisms to prove transactions and communications and (iii) the fact that the law itself has laid down longer retention periods for recordings of telephone calls in certain contractual relationships, has decided to amend said Decision 629/2010, providing new maximum retention periods.
In the revision it has carried out, the CNPD has analysed various statutes in which the legislator provides periods to keep recordings of telephone calls longer than 90 days, which, according to the CNPD, may have the underlying perception that the development of distance commercial relationships has also increased the number of situations of doubt, or even of litigation, regarding the conditions actually agreed upon and the fulfilment of pre-contractual or contractual obligations, which require “the confirmation of the statements made by the parties in the course of telephone contacts”.
The CNPD focuses in particular on the Electronic Communications Act (Act no. 5/2004, of 10 February), on both the legislation governing the prevention of money laundering and financing of terrorism (Act no. 25/2008, of 5 July, meanwhile effectively repealed as of 17 September 2017 with the entry into force of Act no. 83/2017, of 18 August) and the legal regime of distance contracts (Decree-Law no. 24/2014, of 14 February). In this latter case the CNPD also takes into account the specifics of the regime for distance contracts related to financial services entered into with consumers, especially in the context of insurance business activity.
In view of the above observations and in particular of the aforementioned statutes, the CNPD has adopted Decision No. 1039/2017, partially amending the above-mentioned Decision 629/2010, with regards to the maximum period to keep recordings of telephone calls made for the purposes of providing evidence of commercial transactions or of other communication related to the contractual relationship. Accordingly:
i. With regards to distance contracts, the recordings may be kept for a maximum period of 24 months, plus the applicable limitation period. In the cases of distance contracts related to the insurance activity, the retention period must coincide with the contract duration period and the retention shall be permitted until all obligations under the contract are fulfilled.
ii. In electronic communications contracts where loyalty periods are established, the recordings of the telephone calls must be kept for the agreed period of 6, 12 or 24 months, plus the 6-month limitation period. The CNPD further determines that regardless of the agreed loyalty periods or of the possibility of data subject’s “re-loyalty”, the retention period cannot exceed the maximum limit of 30 months.
iii. In electronic communications contracts without a loyalty period there is the duty to keep the recordings of telephone calls during the agreed validity period, plus the 6-month limitation period, up to a maximum of 30 months. However, in case of termination of an electronic communications contract, the recording may only be kept for a maximum period of 6 months from termination.
iv. The CNPD considers that in the framework of financial transactions the maximum period to keep recordings of telephone calls made for the purpose of preventing money laundering or financing of terrorism is 7 years, pursuant to the aforementioned Act no. 25/2008. In this respect, it must be noted that, as stated above, Act no. 25/2008 will be repealed with the entry into force, on 17 September 2017, of Act no. 83/2017 referred to above. This should not, however, change the conclusions of the CNPD, since according to article 51 (2) of Act no. 83/2017 the financial and non-financial entities covered by this statute shall be (in terms similar to those provided for in Act no. 25/2008) under the obligation of retaining for a period of 7 years the originals, copies, references or any other durable medium with equal evidential value of the supporting documents or of the records of transactions, in order to allow for the identification of such transactions even if they are part of a business relationship that has already ended.
The CNPD has further decided that the maximum 90-day period to keep recordings of telephone calls provided in authorizations it has issued for this purpose is amended in accordance with the above.