Well - already implemented all GDPR measures?

Some can finally breathe again, while the others are still in the middle of it and according to the latest statistics, there is even a large part that has not started at all. However, the EU General Data Protection Regulation affects not only companies in the united Europe but all the industrialized countries that trade with the EU.

Data protection officers are chosen, data protection regulations revised, data protection processes are set up - which can quickly be overlooked by the one or other companies, that for years telephone calls (planned or unplanned) have been taken within or into the EU and stored on any servers.

For example, an employee can, if necessary, record the already emotionally charged complaints (ad-hoc) at the touch of a button in order to be able to prove later what he has pointed out to the customer. In call centers it is also part of the routine to record calls (permanently) and to evaluate the length of the call, success rates based on the number of calls and conversions, etc. In the financial sector, it is now even necessary to record conversations for documentation purposes.

Call recording can affect us all and not just employees of dubious companies who spy on their workforce.

Is call recording still allowed in future?

In principle, conversational recordings have so far only been permissible if the other party has expressly consented to the recording. Due to a low punishable amount this was not of great interest. The GDPR is likely to have remedied this situation - the new sensitive penalties make one or the other entrepreneurs rethink. What must be respected in future?

1) Legal basis

Each storage of data must have a legal basis - for example, because of a legal obligation (for call recording) or the data is necessary to fulfill the contract or for pre-contractual measures. Even "legitimate interest" can be a legal basis - but be aware that in case of doubt and dispute this interest must be proved.

2) Express approval - how does that work in call recording?

In any case, the interlocutor must be informed of the recording! This can be done by a set announcement, which is triggered in the ad-hoc call recording or in permanent recordings automatically before the conversation begins.

In addition, an explicit consent (opt-in) of the interlocutor can be obtained for legal protection - and especially in the absence of a legal basis or even when sensitive data is recorded (such as discussions on health status, etc. with physicians). This can be done by pressing a button: "Please press 2 to agree to recording the call, press 3 to oppose the recording."

3) Data minimization

One of the principles of the new General Data Protection Regulation is that as much data as necessary but as little data as possible shall be used and stored. Any call recording should be checked for this principle.

Old recordings should now be disposed of. In addition, the retention periods of new recordings must be determined and technical measures taken in this regard.

4) Record call recordings in the data processing directory

Anyone forced by GDPR to maintain a data processing directory must describe every data processing process. In the case of interviews, these must be stated accordingly.

5) Execute call recordings in the privacy policy

Your privacy policy (whether online or in the context of the terms and conditions) may have to include the recording of conversations. In a simple way, the customer / partner must be shown when, for what purpose and for how long data is going to be stored.

Does the law also affect the recording of my own employees?

Yes! The recording of telephone calls always means the recording of personal data of your employees. And for that too you need a legal basis, otherwise this is punishable. For example, the employee may expressly consent in the joint contract to comply with company data protection regulations. Note here that a court might question the voluntariness of this approval.

Anyone who constantly picks up his employees risks legal disputes in the sense of a total surveillance despite all consent and prior information. It is a time limit or repeated approval or revocation advisable. Especially in call centers, together with legal representatives, a data protection compliant application of call recording has to be developed.

If you have any questions about what you have read or about the Voice over IP section, please do not hesitate to contact us at any time or call us at +43 1 24258 (for these telephone calls be sure of our explicit consent to the recording at any time!).

!The measures mentioned here have been compiled by voiptelefonie team to the best of our knowledge and belief, but replace no legal advice on Call Recording!