Call Recording

18 May 2018

• data protection
• GDPR
• PRIVACY

If an organisation has not obtained consent to record calls for training purposes, can it cite 'legitimate interest'?

Some sectors, such as the insurance industry, are required to do so from a regulatory perspective, such as the FCA, and so recording the call does not present a problem.

But for unregulated businesses, this may present an issue to be thought about. Capturing consent is not mandatory, nor does GDPR say Consent is required for audio recordings. But reasoning, such as Legal Obligation, Performance of a Contract or Legitimate Interest (with appropriate weighting) could very be used as the lawful basis. Nevertheless, GDPR would still require this to be made clear to Data Subjects.

Any recording could potentially contain personal data and the only time Consent is needed explicitly, is if the Personal Data is extracted as part of a tool, technique or technology used explicitly to identify the caller.

While legal, contractual, police, health and regulated entities fall into the other lawful bases, ‘training purposes’, or ‘training and monitoring purposes’ are likely to fall into the legitimate interest category.

Further, it is not only important to identify the correct legal basis under GDPR, but thought too should be given to the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000, and associated case law, which are key for monitoring and recording.