Ombudsman Sandy Hermiston has ordered St. Ignatius Catholic School to destroy all recordings of a performance evaluation meeting with a member of staff, after finding that the school had no legal basis for making the recording.
Hermiston found that the school had not obtained appropriate consent to record the meeting, and had not initially informed the employee that the recording was being made. Also, the staffer did not receive a copy of the recording within the statutory 30 days.
“The Data Protection Law requires that when processing personal data, including the recording of a conversation, the person being recorded must be aware the processing is taking place and the reason for it,” Hermiston said in the press release. “It is also crucially important that consent is only used when appropriate, but not where there is a significant imbalance, such as between an employer and an employee.”
She said that, under the law, consent must also be freely and knowingly given, not implied, which did not happen in this case, and that it appears the employee was never told why the recording was taken.
“Even asking someone ‘Is it OK if I record this?’ does not pass muster with the law, if they are not told the reasons it is happening,” said Deputy Ombudsman Jan Liebaers in the release. “In this instance, seeking consent for the recording after the meeting had already started and then merely asking for the employee’s permission to record – without informing her of the reasons – is not what the Data Protection Law requires.”
Hermiston has ordered the school to destroy all copies of the recording, including any transcripts or extracts, within 10 days of receipt of the enforcement order, including any copies held on behalf of the school, such as that held by legal advisers.
She also recommended that St. Ignatius develop procedures that will allow it to recognise “when consent is an appropriate legal basis for the processing of personal data in accordance with the legal standard set out in the Data Protection Law, including procedures on documenting consent and managing situations where consent is withdrawn”.
Since the complaint about non-compliance with the Data Protection Law was lodged, the school had provided the complainant with a copy of the recording.
Hermiston said that since the employee had not requested the minutes or notes of the performance evaluation meeting in writing, as required under the law, it found no compliance failures on the part of the school in relation to this issue.
“However, best practice is that data subjects should be advised at the time of any verbal requests that they need to put their requests in writing. I encourage the school to recognize the complainant’s verbal request for a copy of these minutes and provide such copy in line with its obligations under section 8 of the DPL,” she said in the enforcement order.
She also advised that the school has 45 days following the receipt of the enforcement order to seek a judicial review of the order in the Grand Court.