Starting the data mapping for processes and had the legal basis for collecting PII(Name, contact info, email) as consent but I realised that consent is not appropriate since no verbal request for consent was made or documented before the information was received. Therefore, what would be better to use in this case as the legitimate reason for processing the customer data provided? I believe legitimate interest is most suitable given the scenario but would like the opinion of other professionals.
Documenting the legal basis for personal information given orally for customer support
Share
DP-Pro
Ideally we’d need a bit more information about the process to be able to give an informed answer but what you are describing is the fuzzy margin between CONSENT and EXPLICIT CONSENT. Simply by providing contact details could constitute consent, but it is not clear whether this was FREELY GIVEN. Furthermore, without providing any contextual dialogue at the time the details were obtained it is unlikely that the provision of these details was SPECIFIC or INFORMED, meaning that any assumed CONSENT will be invalid. If the details were necessary for a product or service, then CONTRACT might be the more appropriate lawful basis. I tend to regard LEGITIMATE INTERESTS as the last option, because it is so wide and vague in its application, but there are options and the choice is yours..
nhazlewood
In this scenario and customer, prospective customer or even job applicant can contact the call center in order to make a compliant, information on services, quotes, request for changes in account, more information concerning a service already signed up for, even job vacancies.
As part of the customer service process is to take the information of the requester/caller (name, email, contact number) which is noted in a ticketing system and then pass on the request to the relevant department who could deal with the matter by reaching back out to the customer/prospect directly, if the customer representative taking the incoming call cannot address the request on his/her own.
So the purpose of processing is clear, and I agree legitimate interest should be last resort but would consent be applicable in this scenario as it the PII was requested and given freely as it was necessary in order to service the incoming call & request of a customer or prospect?