Text
21 May 2024
Re: USE OF ARTIFICIAL INTELLIGENCE (AI) IN CALL ANALYSIS AND MONITORING OF CALL CENTER EMPLOYEES
You inform that you represent a U.S. based company engaged in the hospitality business (Company). The Company operates a business process outsourcing subsidiary in the Philippines that provide customer services to its customers.
The Company is currently reviewing an Artificial Intelligence (AI) program, to be administered by a third-party system provider, that will analyze call recordings and email exchanges between its call center employees and customers (the “tool”). The tool will analyze the call recordings and emails using behavior and sentiment analysis to autoscore call center employees and rank them against other employees to identify opportunities for employee coaching and development, among others.
You further inform that Al-based analytics are performed on the interaction and will process the following personal data: names, address, job title and other unique identifier that could identify an individual or device. The analytics provide insights and autoscores the interaction of the customer and the employees. The autoscoring and predictions are limited to the call center employees and there are no rankings, scorings, or predictions on the customer level at this time.
You also mention that objections by employees may be raised to the Company’s privacy team. If the team determines that the Company’s interests do not outweigh that of the employee’s, the employee can be opted out of the analysis.
The Company intends to rely on legitimate interest as the lawful criterion for processing personal data in connection with the proposed activity.
Thus, you seek advice on the following concerns:
- Whether the Company could rely on legitimate interest as its legal basis for processing personal information in connection with this activity? 2. Whether the use of automated scoring/analysis to aid in measuring performance, identifying coaching, and learning opportunities is justified given the above-stated purpose/interest? 3. Whether the employees have the right to object to the processing and whether such right outweighs the legitimate interest of the Company?
Discussion
Personal information; lawful criteria for processing
The Data Privacy Act of 2012 (DPA) applies to the processing of all types of personal information and sensitive personal information (collectively, personal data). Personal information is defined as any information whether recorded in a material form or not, from which the identity of the individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.1
The names, address, and other unique identifiers such as one’s voice or speech pattern are considered as personal information. The DPA allows the processing of personal information when it is necessary for the purpose of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.2
Section 3(a) of NPC Circular No.2023-073 defines legitimate interest as any actual and real interest, benefit, or gain that a Personal Information Controller (PIC) or third party may have in or may derive from the processing of specific personal information.
In MAF v. Shopee,4 the National Privacy Commission (NPC) provided the following conditions for processing based on legitimate interest, viz.:
(1) the legitimate interest is established; (2) the processing is necessary to fulfill the legitimate interest that is established; and (3) the interest is legitimate and lawful, and it does not override the fundamental rights and freedoms of data subjects
In determining if legitimate interest is established, the following must be considered:
-
The purpose of the specific processing activity must be specific, such that it is clearly defined and not vague or overbroad.
-
The purpose of the specific processing activity must not be contrary to laws, morals, or public policy following the principle of legitimate purpose; and
-
The interest established must be declared to the data subject prior to the processing or at the next practical opportunity, following the principle of transparency and the right of the data subject to be informed.5
Applying the above conditions to this case, the use of automated scoring to evaluate employee performance can be considered as a legitimate interest since it directly contributes to the Company’s goal of improving its services. By assessing and identifying areas of improvement of its employees, the Company can enhance overall performance which will ultimately benefit both the employees and the Company.
Adherence to Data Privacy Principles; Legitimate Purpose, Proportionality
To determine whether the processing is necessary to fulfill the legitimate interest that is established, the means or method chosen for the specific processing activity undertaken by the PIC or third party should be necessary and lawful. Thus, the means to fulfill the legitimate interest must be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose, in accordance with the principle of proportionality; and the means chosen to accomplish the legitimate interest is itself lawful. The PIC cannot violate any law in the process of accomplishing its legitimate interest.6
In this case, you state that the Company’s aim is to identify trends across interactions, supply additional feedback to other areas of the business, help in targeted training based on identified trends, among others. Hence, the personal data processed should be strictly used only for such purposes to comply with the second condition provided in the MAF case. Further, to comply with the principle of proportionality, the data to be collected should only be for the declared specified purposes made known to the employees.
It is important for the Company to strike a balance between its processing activities and the rights of its data subjects. Additionally, even if a personal information controller has a legal basis for processing information, it is still required to follow the fundamental data privacy principles of proportionality, transparency, and legitimate purpose. The processing of personal information must be limited only to the extent that is necessary for the stated purpose and that there are no other means to achieve such legitimate purpose.
Lastly, the principle of proportionality dictates that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. We advise that the use of the AI tool should be used only to achieve the goals and objectives of the Company stated in its privacy policy. The Company should also make sure that their employees are properly informed of this policy before the tool is utilized by the Company. This could be established and disclosed to the employees through the Company’s privacy notice and policies.
Right to Object; Limitations
The right to object to the processing of personal data applies in instances where processing is based on consent or legitimate interest. Nevertheless, it is still possible to continue processing personal data despite the objection where, for example, the same is necessary for the performance of or in relation to a contract or service to which the data subject is a party, or when necessary or desirable in the context of an employer-employee relationship.7 We refer to NPC Advisory No. 2021-01 on Data Subject Rights which provides:
SECTION 7. Right to Object. — The data subject shall have the right to object to the processing of his or her personal data where such processing is based on consent or legitimate interest. xxx
C. When a data subject objects, the PIC shall cease the processing of personal data and comply with the objection, unless the processing falls under any other allowable instances pursuant to in Sections 12 or 13, other than consent and legitimate interest.
Should there be other grounds to continue processing the personal data, the PIC shall have the burden of determining and proving the appropriate lawful basis or compelling reason to continue such processing. The PIC shall communicate and inform the data subject of said lawful basis or compelling reason to continue processing.
Thus, the determination of whether the legitimate interest of the Company outweighs those of the employees’ objections, or if they can cite other grounds to continue processing personal data is a matter that should be decided upon by the PIC and not the NPC.
Please be advised that the foregoing was rendered based solely on the information you provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
Please be guided accordingly.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, (2012). ↩
-
Id. ↩
-
National Privacy Commission, Guidelines on Legitimate Interest, NPC Circular No. 2023 – 07, (13 December 2023). ↩
-
National Privacy Commission, MAF v. Shopee Philippines, Inc. NPC 21-167 (Sept. 22, 2022). ↩
-
Id. ↩
-
Id. ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 34 (b) (2) (2016). ↩