GDPR Rules for Call Recording

Demystifying GDPR: A Comprehensive Guide to Recording Phone Calls in the UK

Are you unsure about the rules and regulations of recording phone calls in the UK?

Look no further! Our comprehensive guide on GDPR compliance and recording phone calls will help you navigate the legal landscape with ease.

We’ll provide you with all the information you need to ensure your phone call recordings conform to the necessary guidelines.

How recording telephone conversations is affected by the GDPR

Recording phone calls can be a valuable tool for businesses, providing a means to review conversations, ensure quality control, and resolve disputes. However, it’s important to understand the legal requirements surrounding call recording in the UK.

The legal framework that governs phone call recording is primarily governed by the General Data Protection Regulation (GDPR) and the Privacy and Electronic Communications Regulations (PECR). These regulations aim to protect the privacy and personal data of individuals, and failure to comply with them can result in significant penalties.

Under the General Data Protection Regulation (GDPR), recording telephone conversations is considered a form of processing personal data. As such, it is subject to the GDPR’s data protection rules.

In general, if you wish to record a telephone conversation, you must have a lawful basis for doing so. This means you must have a legitimate reason for recording the conversation, aligning with the GDPR’s transparency, fairness, and proportionality principles.

Several lawful bases may apply to recording telephone conversations, including:

1. Consent: You can obtain explicit consent from the individual before recording the conversation. However, it’s important to note that consent may not be a sufficient lawful basis in some cases, such as in an employment relationship.
2. Legitimate Interests: If you have a legitimate interest in recording the conversation, such as for quality assurance or training purposes, you may be able to do so. However, you must ensure that the individual’s privacy rights do not outweigh your legitimate interests.
3. Contract: If the recording is necessary for the performance of a contract with the individual, you may be able to record the conversation without their explicit consent.
4. In addition to having a lawful basis for recording the conversation, you must also provide the individual with certain information, such as the purpose of the recording and how long it will be kept. You must also ensure that the individual’s rights under the GDPR are respected, such as the right to access their personal data and the right to have it erased.
5. It’s important to note that different countries may have specific rules and regulations regarding recording telephone conversations, so it’s important to check local laws and regulations before recording any conversations.

A customer’s right to be forgotten under GDPR regulations.

The right to be forgotten, known as the right to erasure, is one of the data subject rights provided by the General Data Protection Regulation (GDPR). This right allows individuals to request that their personal data be erased in certain circumstances.

Under the GDPR rules, individuals have the right to ask for their personal data be deleted if:

1. The data is not or is no longer necessary for the purpose for which it was collected.
2. The individual withdraws their consent to process the data; there is no other lawful basis for processing it.
3. The individual objects to processing of their data, and there are no overriding legitimate grounds for the processing.
4. The data was unlawfully processed.
5. The data has to be erased to comply with a legal obligation.

If a person requests that their data be deleted, the data controller must respond without undue delay and no later than one month from the date of the request. The data controller must verify the identity of the individual making the request and then assess whether the request is valid.

If the request is valid, the data controller must erase the personal data without delay unless there is a legitimate reason for keeping the data, such as to comply with a legal obligation.

It’s important to note that the right to be forgotten is not absolute, and there may be situations where an individual cannot exercise it, for example, if the data processing is necessary to exercise their right to freedom of expression and information or for the establishment, exercise, or defence of legal claims.

How long do companies keep recorded phone calls UK?

In the UK, it’s crucial to grasp the duration for which companies store recorded phone calls, especially in light of the stringent guidelines outlined by the GDPR.

Ensuring GDPR compliance hinges on a comprehensive understanding of phone call recording data retention policies, as it directly impacts individual privacy and data protection rights.

In the Financial Services sector, the FCA mandates that firms retain recorded calls for a period of five years. Some regulated companies, like Aviva, automatically announce this requirement to customers at the outset of each call, while others continue to mention that calls will be recorded for training purposes.

The way companies choose to inform their customers should align closely with the guidelines provided by the Information Commissioner’s Office (ICO). Careful consideration in this regard is essential.

Consequences of non-compliance with GDPR in recording phone calls

Non-compliance with GDPR in recording phone conversations can have severe consequences for businesses. The Information Commissioner’s Office (ICO) can impose fines of up to €20 million or 4% of the global annual turnover, whichever is higher. These fines can significantly impact businesses, both financially and reputationally. In addition to fines, businesses may also face legal claims and damage to their brand image if individuals’ rights are violated.

Businesses must understand the legal requirements and take the necessary steps to ensure compliance with GDPR in the recording of telephone conversations. By doing so, they can avoid the consequences of non-compliance and maintain their customers’ trust and confidence.

How Vidicode enables the customer’s right to be forgotten under GDPR

Under the GDPR, customers have the right to request that any personal data held by an organisation should be erased. To comply with this requirement, organisations must ensure that any data stored on their systems has been deleted.

We have unique technology in our Apresa (SIP & IP), 3CX, Microsoft Teams, BRI (ISDN2) & PRI (ISDN 30) recording solutions enabling calls to be recorded automatically whilst at the same time providing both the agent and/or customer with the ability to control whether the recording of the call proceeds or not. Call marking and screen recording as standard enhances our proposition for rapid find and retrieval of calls under the GDPR right to be forgotten.

The Apresa System has a stop recording feature if the customer decides at the point of contact or during a call that their legitimate interest is being overridden by the call being recorded. An example of this might be where a call is being recorded for training purposes which benefits the company and not the customer at that moment in time. The Apresa will also stop any future recordings of that customer if required.

While there are many advantages to selecting Apresa for GDPR compliance assistance, a valuable option is still available to owners of older call recording systems. Vidicode UK offers phrase and word matching through VoiceCrunch Speech Analytics, a specialised voice analytics platform designed to locate recorded calls based on user-defined words, phrases, sentiments, tones, and emotions.

For more details about Apresa call recording Download Brochure

Apresa offers a comprehensive set of standard features to support GDPR compliance, including:

• Records calls on a wide range of platforms, such as Wildix, 3CX, Microsoft Teams, SIP/VoIP, SIPREC, ISDN II, ISDN E1/T1, TDM, analogue, and radio communication.
• Multi-level access for supervisors, groups, and users with user assignable search restrictions
• Screen recording providing a complete view of the entire customer interaction
• Call colour coding and annotation for fast, easy retrieval and playback
• High security levels with encryption and Fingerprinting MD5, SHA-1
• Automatic backup to NAS (Network Assisted Storage)
• PCI-DSS compliance for payment card transactions
• Statistics for analysis in graph or .csv
• Store on demand (audio & screen)
• Automatic system check
• Free seating

Apresa offers more optional features

• Agent Evaluation Module
• Raid 1 or Raid 5 option
• Redundant power supply
• Virtual or Hosted Implementations

Is it Legal to Record Business Calls in the UK?

It is legal to record phone calls in the UK, subject to specific rules, and it is widely accepted as an essential tool for enhancing business performance and improving customer service. Moreover, industries, including finance and insurance, must record business calls and texts for compliance with regulatory bodies like the FCA.

If a customer intends to pay for goods and services over the phone with a credit card or debit card, this part of the conversation must not be recorded or retained in order to comply with payment card industry regulations (PCI DSS). 

Find out how we Pause Recordings so that payment card details are not retained in order to comply with PCI DSS. 

Whether you are recording a conversation for personal reasons, business purposes, or any other cause, it’s essential to understand your rights.

One fundamental principle to remember is the importance of obtaining the consent of all parties involved before recording a conversation. This means you should inform everyone in the conversation you are recording and obtain their permission.

Legal Framework for Recording Telephone Calls

In the UK, the legal framework surrounding the recording of conversations is primarily governed by the Regulation of Investigatory Powers Act 2000 (RIPA) and the General Data Protection Regulation (GDPR). These laws lay out the rules and
regulations for intercepting and processing communications.

Recording Phone Calls Without Consent

Recording conversations without proper consent or in violation of the law can lead to various risks, including:

Unauthorised recording can result in criminal charges and penalties.

You may be subject to civil lawsuits if the privacy of individuals involved is violated.

Recording conversations without consent can harm your personal or professional reputation.

Illegally obtained recordings may not be admissible in court.

Exceptions

There are situations where recording a conversation without consent may be lawful, such as for crime prevention or detection, national security, or legitimate business interests. However, these exceptions are subject to strict guidelines, and it’s crucial to ensure that your actions comply with relevant regulations and laws

Practical Tips for Recording Phone Conversations

Always Seek Consent: Get permission from all parties involved in the conversation before recording.

Know the Purpose: Clearly state the purpose of recording the conversation.

Stay Informed: Keep yourself updated on the latest changes in relevant laws and regulations.

Consult Legal Advice: When in doubt, seek legal advice to ensure your actions are lawful.

Is it Legal for Individuals to Record Conversations?

It is generally legal for an individual to record a call without the other person’s consent as long as the recording is for personal use and not shared or used in a way that would violate the other person’s privacy or data protection rights. However, it’s important to note a few key points:

Use for Personal Purposes: Recording a call without consent for personal use, such as making notes or ensuring accuracy in a conversation, is typically acceptable.

Non-Commercial Use: Using the recording for non-commercial purposes, such as for personal reference or to protect your own interests, is less likely to raise legal concerns.

Consent for Sharing: If you intend to share the recording or use it in any way that may affect the other party’s rights or privacy, you should obtain their consent beforehand.

It’s important to respect the privacy of others and use recorded conversations responsibly. Even if you do not intend to share the recording, you should be cautious and mindful of the other person’s privacy rights when recording conversations without their knowledge. Always adhere to ethical and legal standards when handling recorded content.

Go Here for telephone call recording options for individual users and SME’s.

For more comprehensive information about the right to object to calls being recorded visit the ICO website

Important Sources:

HMRC forced to delete 5 million recordings 

ICO GDPR Consultation 

GDPR Checklist 

An individual’s right to object