In its Decision No. 629/2010 of 13 September, 2010 (Decision) the National Data Protection Commission (CNPD),NationalData Protection Supervisory Authority, issued the legal framework, the grounds of legitimacy and the guiding principles for the processing of personal data resulting from recording calls for the correct compliance with Law No. 67/98, of October 26th, amended by Law No. 103/2015, of August 24th (LPDP), namely when they are intended to facilitate proof of commercial transactions and other communications carried out in the context of a contractual relationship between the data controller and the data subject.
Almost seven years after its adoption and when contractual relations between controllers and the data subjects have become less and less face-to-face, CNPD has decided to partially review the Decison, exclusively regarding the redefinition of the ninety (90) days period to the preservation of the recording calls, with binding effects for all authorizations issued so far for this purpose.
This deadline, that has revealed to be insufficient in view of the latest conservation periods established in specific legislation for certain sectors of activity, or that simply defined new rules for certain contractual relations, is now outdated.
In other words, these new legal requirements aim fundamentally at:
(1) safeguard situations of doubt or even litigation as to the agreed terms and the fulfillment of pre-contractual and contractual obligations that are manifested by an increase in distance commercial relations, enabling both parties to carry out the legitimate proof in commercial transactions and other communications regarding the contractual relationship;
(2) providing, at the same time, supervisory authorities with a longer period of time enabling them to catty out their tasks effectively, in particular by enhancing the possibility for the reconstruction of operations carried out in certain sectors of activity.
In this case, and where there is no specific legal provision defining the retention period for recorded calls, according to Articles 5 (1) (e) and 23 (1) (f), of the LPDP, the CNPD reappraised the period initially fixed in the following terms:
a. In respect to general distance contracts, the recording calls may be retained for a maximum period of 24 (twenty-four) months, increased with the respective limitation or prescription period, except in the cases of distance contracts regarding insurance activity, where the term of conservation must correspond with the duration of the contractual relationship, allowing the conservation until the fulfillment of all obligations arising from the contract;
b. In electronic communications contracts in which binding periods are established, those responsible must keep the recording calls for the duration of the agreement, equivalent to 6 (six) or 12 (twelve) months, or 24 (twenty-four) months plus the corresponding limitation and expiration period of 6 (six) months; regardless of the agreed binding periods, just as the possibility of according new binding periods with the data subject, this period cannot exceed the maximum limit of 30 (thirty) months;
c. In general electronic communications contracts, there is a duty to preserve the recording calls related to the duration of the agreement, increased with the corresponding limitation and prescription period of 6 (six) months, with a maximum limit of 30 (thirty) months; where in cases of termination of the electronic communications contract, the recording calls will only be retained for a period of 6 (six) months, counting from the moment in which the contractual link between the parties is terminated;
d. Finally, regarding financial transactions, the period for the conservation of recording calls for the purpose of combating money laundering and terrorist financing is established for 7 (seven) years, to be counted from the execution date of the respective operations.
In this latter case, it is important to emphasize that the preservation of the recording calls is only carried out for the purposes of supervision or inspections. Contrarily, for the purpose of proving commercial transactions and any other communications regarding the contractual relationship between the controller and the data subject, the parties are bound to the respective term of conservation.