When is Consent Required to Record a Conversation?

You have probably heard a statement at the start of a telephone call, or this could be in a Teams or a Zoom meeting, along the lines of “Before we continue, I’d like to let you know that this call [or conversation] may be recorded for training and quality purposes. If you do not wish the call [or conversation] to be recorded, please let me know”.

The reasons for such an announcement are the somewhat complex provisions of Commonwealth and State and Territory legislation relating to the recording of conversations and the collection and use of personal information.

The main relevant Acts of the Commonwealth [”Commonwealth Acts’] are the:

Privacy Act 1988 (Commonwealth) [“Privacy Act”] and the Australian Privacy Principles contained in the Privacy Act [“APPs”];
Telecommunications (Interception and Access) Act 1979 (Commonwealth) [“TIA Act”].

For the States and Territories, the Acts [“State and Territory Acts”] are the:

Surveillance Devices Act 2016 (SA);
Surveillance Devices Act 2007 (NSW);
Surveillance Devices Act 1999 (Vic);
Surveillance Devices Act 1998 (WA);
Invasion of Privacy Act 1971;
Listening Devices Act 1991 (Tas);
Listening Devices Act 1992 (ACT);
Surveillance Devices Act 2007 (NT).

The relevant legislative requirements in relation to the recording of conversations are, broadly, in two areas:

The Privacy Act and the Australian Privacy Principles, relating to personal information of individuals; and
The provisions of the TIA Act and the various State and Territory Acts referred to above relating to the recording, or use of devices for recording, conversations.

State and Territory Acts – Listening Devices

The State and Territory Acts are the legislation that applies specifically to the recording of conversations. A conversation may be one that is carried out personally or face-to face, or on the telephone or by means of a communication platform. The State and Territory Act are, generally, in similar terms but there are variations in the terminology.

As the names of most of the State and Territory Acts suggest, these Acts are concerned with the use of “listening devices”, which may be included within a more general definition of “surveillance devices”. A listening device is defined in words that are the same or reasonably similar in each of the State and Territory Acts to mean:

“any device capable of being used to overhear, record, monitor or listen to a conversation or words spoken to or by any person in conversation …”

Some of the Acts do not have a definition of “device”, but in the Victorian legislation; “device”:

“includes instrument, apparatus and equipment”.

The definition of a “listening device” in the various State and Territory Acts would include recordings made with a telephone or via Zoom or similar platforms.

Offences and Consent Requirements

Each of the State and Territory Acts create an offence for using a listening device to record a private conversation without relevant consent. Penalties vary, but can be substantial. In South Australia in the case of a body corporate the maximum penalty is $75,000.

The principal distinction between the respective State and Territory Acts is that in the majority of States and Territories (South Australia, New South Wales, Western Australia, Tasmania and ACT) the consent of all parties to the conversation is necessary [“All Party Jurisdictions”]. In other States and Territories (Victoria, Queensland and Northern Territory) a person who is a party to the conversation may record it without informing the other party or parties [“One Party Jurisdictions”].

Consent may be both express or implied so where a statement is made at the commencement of a conversation (by a recording or verbally) and no objection is made by a party to the conversation, the consent of the party to the recording will be implied.

An organisation that carries on business in all States and Territories, or in an All Party Jurisdiction, or in a One Party Jurisdiction but also one or more All Party Jurisdictions, should, to be safe, assume that the consent of all parties to a conversation is required in each case unless it is clear that all parties to the conversation are in one or other of the One Party Jurisdictions.

A party to a conversation by whom consent is required means, in the State and Territory Acts, with some variations in language, a person by whom words are spoken in the conversation.

Recording of a Conversation by a Party

The consent requirements for the recording of a private conversation in the All Party Jurisdictions are in similar terms and relate to the recording of the conversation by a party to the conversation. This may mean that the recording of the conversation by an organisation, such as a business, where a party to the conversation is an employee or officer or representative of the organisation is not a recording by that party. However, it seems to be generally assumed that consent will be effective where there is an opening statement that a conversation will be recorded. If the person representing the organisation making recording is a party to the conversation and is able to control whether or not the conversation is recorded, then it would seem reasonable to assume that the recording of the conversation will be taken to be made by that party.

Private Conversations

As noted above, the State and Territory Acts prohibit the use of a listening device to record a “private conversation.” The definition of a private conversation varies to some extent in each of the State and Territory Acts, but each of the State and Territory Acts has a qualification to the definition that is in the following, or similar, terms, which is that a private conversation:

does not include a conversation made in circumstances in which all parties to the conversation ought reasonably to expect that it may be heard by a person who is not a party to the conversation.

Accordingly, if there are circumstances, which may include the terms of relevant documentation or a recorded or verbal statement at the start of a conversation, which alert persons to the fact that conversations may be recorded, this may mean that a conversation is not a private conversation and the provisions of the State and Territory Acts will not apply to a recording of the conversation. Such a commencing statement should also mean that if a party to the conversation does not object to a recording of the conversation that the consent of the party to the recording would be implied.

It is possible that if there are clear indications in an organisation’s trade documentation (which may include its website, terms and conditions, Privacy Policy, order forms, invoices and similar documentation) that conversations will be recorded, and the purposes for recording, that this may mean that a party to a conversation should expect that the conversation will be recorded and that the conversation would, accordingly, not be a private conversation. If this is the case, then the provisions of the State and Territory Acts relating to the use of listening devices to record the conversation would not apply.

However, this would not apply to a person, such as a prospective customer, who is not aware of the trade documentation or notices or advices on the Website of the organisation that conversations may be recorded prior to a conversation in which that person takes part. In these circumstances an opening statement advising that the conversation will be recorded will mean that there should be such an expectation and consequently that the conversation is not a private conversation.

TIA Act

The TIA Act prohibits the “interception of communications” that are “in transit” without consent or lawful authority. The recording of a face-to face-or in-person conversation is not a relevant communication and the recording of a telephone call or other telecommunication by a party to the call is generally not considered to be an unlawful interception because the communication has already reached the device of the party making the recording.

Privacy Act / Personal Information

The APPs relate to personal information as that is defined in the Privacy Act (Section 6) as follows:

personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

whether the information or opinion is true or not; and
whether the information or opinion is recorded in a material form or not.

An individual who is a party to a recorded conversation will almost certainly be identified or identifiable and information in the discussion may be information relating to the individual and will be personal information. However, if the individual who is a party to the conversation is an employee or representative of a company or other entity, and the subject matter of the conversation relates to goods or services to be provided for, or by, the company or other entity, this will not be personal information as the company or other entity will not be an individual.

Information in a recorded conversation that is personal information will be subject to the APPs if the organisation making the recording is an organisation that is an APP entity which is, generally, one that has an annual turnover in excess of $3 million so that it is not a small business operator and is an AAP entity.

Some observations as to the obligations of an APP entity in relation to personal information follow below, but these are only brief comments and further consideration or advice may be required if an organisation intends to record conversations containing personal information.

APP 1 Open and Transparent Management of Personal Information

An APP entity is required to maintain an up-to-date privacy policy explaining what information is collected, how it is collected, the purposes of collection, storage and security arrangements, disclosure practices and destruction and/or de-identification practices.

If an organisation wishes to record conversations, the Privacy Policy of the organisation may require some further consideration.

APP 3 Collection of Solicited Personal Information

Personal information that is collected by an APP entity must be reasonably necessary for the functions or activities of the entity. The purposes for which information contained in recorded conversations is used by an organisation must be capable of being purposes that are reasonably necessary for the functions and/or activities of the organisation.

APP 5 Notification of Collection

An APP entity is required at or before collection of personal information from an individual (or as: soon as practicable afterward) to take reasonable steps to notify the individual of:

the fact of collection of the information
the purposes of collection
the consequences if information is not collected
disclosures that may be made of the information
access to the privacy policy of the entity.

This obligation may be satisfied by the terms of the Privacy Policy and trade documentation of the entity, if the individual is aware of these, or by an appropriate statement at the commencement of a conversation that is to be recorded.

APP 6 Use and Disclosure of Personal Information

Personal information collected by an APP entity by way of a recorded conversation, or otherwise, must, in brief summary, only be used for the stated primary purpose for which the information is collected or a related purpose that would be expected by the individual to whom the information relates.

APP 11 Security and Destruction of Personal Information

An APP entity is obliged to take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access or disclosure and personal information that is no longer needed is required to be destroyed or de-identified.

Requirements for Consent

As noted above, the majority of the State and Territory Acts require all parties to a telephone conversation to consent to the recording of the conversation, so that it is, in practice, necessary to assume that this consent is required in all cases if an organisation carries on business in any of the All Party Jurisdictions unless it is clear that all parties to the conversation are in one or other of the One Party Jurisdictions.

Commentaries on the State and Territory Acts suggest that the only safe way to ensure consent is for a statement to be made at the commencement of a conversation, either by way of a recorded statement or one made by a representative of the organisation making the recording, to advise the other party or parties to the conversation that the conversation will be recorded and the purposes of this recording.

Some businesses may prefer that such an opening statement not be made for telephone calls or other communications between personnel of the organisation and customers or suppliers as this may not accord with the friendly and personal approach that characterises dealings of the organisation with customers and suppliers and may be seen to be overly formalistic. It may in some cases be possible, at least for the majority of persons with whom personnel of an organisation have conversations which the organisation wishes to record, to ensure that these conversations are not “private conversations” within the meaning of relevant legislation, and do not require consent for recording, if appropriate statements relating to the recording of conversations appear in the organisation’s trade documentation. This would, however, require very careful consideration of the terms of the trade documentation, including the Privacy Policy, of the organisation.

However, as noted above, a person, such as a prospective customer, who is not aware of the trade documentation or Privacy Policy of an organisation and any advice or statement that conversations will be recorded would not be taken to have given implied consent or to expect the recording of telephone conversations. This can only safely be achieved by ensuring a statement is made at the commencement of a conversation advising that it will be recorded and the purposes of the recording.

Recordings by Individuals

Many of the comments above relate to the recording of conversations by an organisation in the course of business. However, the requirements of the State and Territory Acts in relation to the recording of conversations and the requirements for consent apply to any person, including natural persons.

Most individuals, or natural persons, however will not be an APP entity under the provisions of the Privacy Act, and accordingly will not be required to comply with the APPs, although it is possible for an individual to be an organisation if the individual is not a small business operator. A small business operator is an entity (including an individual) with an annual turnover that does not exceed $3 million for a financial year. Therefore, an individual may be an organisation that is an APP entity that is required to comply with the APPs.

The Bottom Line - Upfront Warnings

These comments about the requirements of the State and Territory Acts and the Commonwealth Acts and the need for consent for recording of conversations are an attempt to summarise the provisions of the legislation. However, because of the length and complexity and variations in the terms of the various Acts, an organisation should obtain advice in relation to the specific legislation applicable to its circumstances if it contemplates recording conversations. The bottom line, however, in most cases will be that unless an organisation or an individual that wishes to record conversations is confident that all parties to the conversations are in One Party Jurisdictions an advice or warning should be given upfront that a conversation will be recorded.