With the GDPR enforcement around the corner, businesses that market to or process the information of EU data subjects need to comply with the GDPR’s requirements or face the financial consequences. One of the key changes to the current data protection framework involves audio recordings; businesses will need to actively justify the capture of conversations and the processing of personal data. This means businesses that record conversations for training purposes or to gain insights into customer demographics and behavior will need to create their own recording policies and outline measures that will be taken to obtain consent.
Audio recording pre-GDPR
Prior to the GDPR, audio recording regulations varied widely. Germany, for example, is a two-party consent state, meaning call recording without the consent of both or, when applicable, more, participants is a criminal offense. In the U.K., the Data Protection Act of 1998 (DPA) classifies call recording as a form of data processing, as recorded conversations have the potential to capture personal information, including names, addresses, financial details, religious beliefs, and medical records. Under the DPA, individuals must be informed about the purpose of the recording. When it comes to consent, however, tacit consent is assumed under the DPA as long as individuals are informed about the recording and given the option to opt out. In this way, an audible notification informing the participants that the conversation is being recorded for training purposes satisfies the DPA requirement.
Audio recording under the GDPR
The bar for valid consent has been raised much higher under the GDPR. Consents must be freely given, specific, informed, and unambiguous; tacit consent would no longer be enough.
In addition, businesses recording conversations will be required to actively justify lawfulness of recording, by demonstrating the purpose fulfills one of the following Article 6 conditions:
- Participants have given consent to be recorded for one or more specific purposes;
- Recording is necessary to fulfill a contract to which the participant in the call is a party;
- Recording is necessary for fulfilling a legal obligation to which the recorder is subject;
- Recording is necessary to protect the vital interests of one or more participants;
- Recording is in the public interest or in the exercise of official authority vested in the recorder;
- Or, recording is in the legitimate interests of the recorder, unless those interests are overridden by the interests of the participants in the call which require protection of personal data.
Organizations in certain industries will easily meet one of the conditions due to sector-specific regulations. For example, banks and financial institutions are required by law to record every one of their transactions. But those organizations that record conversations only for training and quality purposes will have a more difficult task, as they will need the participants’ freely given, specific, informed, and unambiguous consent for the specific purpose of recording the conversation.
Be prepared for May 25
The new GDPR will be deployed across the EU and replace the country-specific data protection laws of each member state. With the compliance deadline fast approaching, it is important for every organization to have an established recording policy that sets forth expectations regarding the recording of meetings, phone calls, or other conversations.
The first step in drafting an effective recording policy is to identify all the recording devices used by an organization’s employees. Whether recording takes place over the phone or via an online-meeting application (e.g.WebEx, GoToMeeting, Skype Google Hangouts, etc.), you must: ensure that the policy covers all types of recordings stored at or hosted by any third-party vendors to which your business subscribes, and clarify the appropriate methods through which your employees will be authorized to record conversations.
The second step is identifying the scope by listing all the parties who would be covered by the policy. Depending on how your business functions, in addition to your employees who record calls, you may need to identify any contractors and third parties making recordings on behalf of your organization.
Next, an effective recording policy provides for the retention and destruction of recordings maintained by the organization, ensuring that recordings are created, managed, and disposed of in accordance with applicable regulatory record-keeping requirements and business needs. Storing recordings indefinitely or longer than needed can create unnecessary burdens that could easily be avoided by following the procedures set forth in the company’s recording policy.
To ensure that a recording policy is successful once established, it is important for employees at all levels to be educated about the policy. From upper management to employees who handle the day-to-day operations, all covered parties should be informed about what is expected and required under the policy. Examples of situations where recording a conversation will be strictly prohibited will serve as guidelines to assist covered parties in complying with the requirements.
Lastly, once a recording policy is established, it is critical that it be enforced in accordance with the enforcement criteria it outlines. While having a sound policy in place will help ensure your organization’s commitment to comply with applicable legal obligations to record conversations, failure to enforce can prove costly, as it can result in fines up to €20 million or 4 percent of the worldwide annual revenue of the prior financial year.