We record our calls and both our customers and employees are aware the calls are being recorded.
A disgruntled customer has requested copies of his recent conversations with our client rep in a DSAR.
Do we need to provide the entire contents of the conversation to the client, both his voice and our employee’s? Or only his side of the conversation?
Are all conversations considered personal data regardless of the content or conversation?
Is my voice alone considered personal data and am I entitled to it regardless of the topic?
Is the entire conversation considered my personal data regardless of the topic even if parts of it don’t contain personal data? Thank you
Access requests for voice recordings . Is my voice alone personal data and covered by.a DSAR?
Share
HellenB
So…
The guidance says that you have to state when recording what the purpose is. For instance lots of companies say ‘for training and quality purposes’ but if you can’t prove you do either of these things and you use the word ‘may’ you aren’t processing appropriately and you wouldn’t be able to prove an appropriate legal basis for processing.
With regards to releasing the recording of the call, you don’t have any reason not to. Both parties were in the original call therefore you are not disclosing unknown data.
Elisavet D.
Here we need to distinguish between voice (the sound produced by humans using the lungs and the vocal folds in the larynx) and speech (when we express thoughts, feelings, and ideas orally to one
another through a series of complex movements that alter and mold the basis tone created by voice into specific, decodable sounds). Now is voice or speech personal data according to the GDPR? Only representations of voice and speech (e.g. voice recording, speech sample, written texts) can be considered as personal data if they relate to an identified/identifiable individual. Thus, only voice data or speech data can be personal data. Voice can fall under the definition of “biometric data” (see A4.14) and in some cases when processed for the purpose of uniquely identifying a natural person, it could be a special category of personal data. Voice can also reveal ethnic origin (e.g.if there is an accent) or health data (if there is a stuttering.
Stephen Lark
Not all call recordings are the same but in this instance I believe it is quite straightforward.
The client is aware the audio can be used internally (for training or other purposes) and the employee is aware the audio can be used externally (given to a client). So providing your ‘notice’ states both the above cases then no problem and no audio redaction needed.
Your have raised some good questions on voice being personal data. Yes it is, in much the same way as fingerprints and is therefore subject to the same rules. This is why we announce and have a policy for recording telephone and other audio.
Barry Moult
Brave or foolish – Barry in answering this first
You have raised some issues i have not been questioned about before (always a 1st time)
I am not aware of anyone redacting voice recordings as both parties were part of the conversation.
If you inform your clients the call is being recorded (you must), there is an expectation that the record would be available if requested. (what does your PN say?)
The request for the recording could be that they want to challenge/query something that has been said (advice/next steps). I would find it odd only to give one side of the conversation.
The ICO guidance (not in any detail)
https://ico.org.uk/for-organisations/guide-to-data-protection-1998/encryption/scenarios/audio-recordings/
Nice Guidance
https://www.nice.com/engage/blog/mcr-understanding-the-gdpr-call-recording-rules-2531/
Friends at iapp have commented
https://iapp.org/news/a/how-do-the-rules-on-audio-recording-change-under-the-gdpr/
Yorkie82
We are redacting the voice recording. If we get an access request and we still have the recording. Monitoring has quite a short retention time and for training purpose, you just keep a few recordings anyway. So we redact the employee voice data as the data subject is just entitled to its own recording. If the recording system is recording it on two different recording lines, it is actually quite simple to just release one voice line.
Bgibbon
Thanks.
Does it get tricky when individuals are interrupting or talking over one another?
Yorkie82
Not if you record them on two different audio tracks. It doesn’t matter if they talking at the same time. It is the different sources that decide where it is recorded.
BlueBottle
We record calls for regulatory compliance, so all calls are recorded, and when a customer requests access we deem that the employee does not have a reasonable expectation of privacy in the workplace, and the disclosure of their voice and perhaps name, if stated, would be unlikely to adversely affect them as a data subject; as such, the whole recording is disclosed. We also disclose recorded calls with third parties authorised to discuss the customer’s account, because of the content of the discussion, which relates to the customer’s account and thus the customer, so it is personal data. We do not disclose recordings of the customer to a third party authorised to discuss the account, unless we have explicit authority from the customer for that DSAR.
With CCTV however, I would be looking to redact everything except the requester, as others’ privacy could be violated by disclosure of their identifiable likeness to another person who was in the vicinity.
Elisavet D.
Speech on the other hand can reveal our opinion, information about our habits or preferences, but also information about other individuals. So basically my response concerns the part on whether the recording consists personal data or no. Interesting question! Regarding the disclosure of the recording, just to be same I would deduct the employees voice. It’s always better to be safe than sorry 🙂