Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

An employer (Standard Chartered Bank Limited) who used a voice recording of its employee in a disciplinary process did not violate the employees rights under the law due to the extensive measures taken to comply with the requirements of the DPA19.

Facts

Douglas M. Mbugua (the “Complainant”) was an employee of Standard Chartered Bank Ltd (the “Respondent”), a commercial bank, until he was terminated on allegations of corruption in 2022. The Complainant alleges that the basis of termination was a voice recording made of him without his consent.

The Respondent averred that the Respondent signed a Contract of Employment containing a clause that communications handled over the company’s business lines are recorded. The contract also required the Complainant to consent to his personal data being processed for various stated purposes.

The specific recording in question came up in the course of an investigation under the bank’s SpeakUp framework and was later used in court proceedings involving the parties. The Respondent therefore had legitimate interest to process the personal data.

The Respondent further provided its Group Investigation Standard which outlined the investigative processes undertaken by the Respondent and the safeguards/controls therein that ensured that the privacy rights of employees are protected.

The Respondent also provided employee training programs and the annual code of conduct process intended to recommit staff to ethical conduct.

• Legal Provisions Reviewed

Holding

The ODPC held that:

• The Complainant was notified of the use of his personal data by the Respondent.
• The Complainant consented to the processing of his personal data.
• The Respondent's legitimate interests in the court case and internal investigations, overrode the rights of the defendant to privacy. His objection to the processing of his personal data could not be sustained in the circumstances.