At this point, most businesses are sick and tired of hearing about GDPR. For years, the regulations surrounding call recording have been complex enough - seemingly designed to exacerbate those who simply want to make the most of their data.
Governed by a web of data protection and privacy laws, the rules of what you can and cannot record, and what you can do with the recordings, depend on various factors. Everything from what industry you're operating in, to the kind of transactions you're dealing with in calls, and the information you record has an impact.
On the 25th of May, the rules changed all over again, and organisations throughout the UK, Europe, and the world have been scrambling to keep up.
[info-link]Download our Popular GDPR Smart Guide here[/info-link]
Out with The Old and In with the New
Europe's latest solution for data protection covers call recording, compliance, and data management. It replaces the previous data protection act which came into legislation in 1998, so you could argue that we've been due an update for a while. The previous rules were taken from the Data Protection act 1998. They combined with the Regulation of Investigatory Powers Act in 2000, and the Human Rights Act in 1998 to strengthen the rights that people had regarding how their data was stored and used.
This is because of the potential for recorded calls to capture:
- Personally identifiable information, such as names and addresses
- Sensitive personal information, such as banking or financial details, health information, family details, religious beliefs, sexuality etc.
The good news is that the aims of GDPR aren't completely removed from that of the previous data protection campaign. They're all concerned with data security, the protection of privacy, and the way we process data. Nothing new there.
However, there are a few major changes. For instance, companies wanting to record calls will need to give a good reason for doing so. The GDPR suggest that your recording purpose should fulfil at least one of the following six conditions:
- Recording is crucial to comply with a contract
- Recording complies with legal requirements
- The people in the call have offered their consent to be recorded
- Recording is essential for the protection of one or more participants
- Recording is necessary for public interest purposes
- Recording is legitimately in the interest of the recorder (unless those interests are less important than the interests of the participant)
The Changing Nature of Consent
Essentially, GDPR is all about "consent". Tacit consent isn't enough to keep you out of the spotlight anymore. The new legislation wants to implement a "Principle of Accountability" which pushes businesses to implement detailed measures for acquiring consent and keeping information secure. Call recording is a form of data processing. In the DPA - the previous regulations, companies needed to inform individuals of how their data was processed. That's still something that you'll need to think about today. However, the balance between the needs of the customer, and the preferences of the business is changing.
