united-kingdom
The detail in the description of the circumstances is insufficient to be definitive about whether this organisation behaved lawfully or unlawfully.
Certainly there are "personal data" within the meaning of GDPR; it seems there is "special category" data too (the image of the interviewee's face); there is "transfer" to a third party (otter.ai), and (I think) to another country (the USA, where otter.ai is based). Therefore the UK GDPR and Data Protection Act 2018 apply, in which there are many rules.
What is not evident in the description is whether the organisation was forthcoming and transparent about its collection and processing of personal data, the purposes for which this is done, and the "lawful basis" (i.e. legal reason) for each purpose. If it wasn't - if the interviewee could not be said to have been informed of any of this - then on the face of it the organisation behaved unlawfully.
The interviewee - the "data subject" - has a "right to be informed" (GDPR Article 13) about all of that and more. The bare minimum is to provide a privacy policy or privacy notice. In some circumstances, particularly the more sensitive the data or activity, the organisation ought to be more proactive about bringing this information to the attention of the data subject at the relevant time.
This seems to be the first item to address.
Quoting from GDPR Article 12:
The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means. ..
Quoting from Article 13(1):
- Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data
are obtained, provide the data subject with all of the following
information: ...
(c) the purposes of the processing for which the personal data are
intended
Two key points about purposes (Article 5 Principles relating to processing of personal data):
The personal data is "collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;" and "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)". That is to say, the organisation must tell you what is the purpose specifically and the collection and processing must be proportionate to this purpose - the system is disproportionate if the purpose can be reasonably achieved with less.
A real UK case was a leisure gym group that was deemed by the Information Commissioner's Office to have gone overboard on using facial recognition technology (FRT) and fingerprint scanning to monitor employee attendance, because the company wouldn't offer an alternative system to employees who were not comfortable with this and couldn't demonstrate that it could not achieve the same purpose by using ordinary ID cards.
as well as the legal basis for the processing;
There are six lawful bases (Article 6); "consent" is but one of these although the others do not seem relevant/appropriate in the circumstances described.
If the lawful basis is "consent", it must be a "freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her" (Article 4(11)). The organisation must be able to show that the data subject consented to this processing. (Article 7 conditions for consent.)
(d) where the processing is based on point (f) of Article 6(1), the
legitimate interests pursued by the controller or by a third party;
Another answer mentions the lawful basis of "legitimate interest". This paragraph (d) means that if the organisation relies on legitimate interest it must inform the data subject what specifically is the interest, it can't simply say "we have a legitimate interest". Furthermore the implication is that this interest outweighs the interests of the data subject, which is or ought to be a high bar to reach.
(e) the recipients or categories of recipients of the personal data,
if any;
(f) where applicable, the fact that the controller intends to transfer
personal data to a third country or international organisation and the
existence or absence of [F1relevant adequacy regulations under section
17A of the 2018 Act], or in the case of transfers referred to in
Article 46 or 47, or the second subparagraph of Article 49(1),
reference to the appropriate or suitable safeguards and the means by
which to obtain a copy of them or where they have been made available.
Transfers have a whole Chapter dedicated to them, Chapter V. Again the organisation must tell the data subject about all of this ahead of time. "We use this software, it is made by company X, which stores the data in country Y" etc.
The special category data - the facial image - deserves a mention of its own because it has its own conditions for processing (Article 9). Again the only relevant condition seems to be consent, unless the image was "manifestly made public by the data subject" (e.g. it is a Linkedin profile photo).
