The simple answer to the question “is it legal to record phone calls in the UK?” is “Yes, but there are some important rules of engagement.”
We are all familiar with the holding message ‘calls may be recorded.’ In fact, we are so at ease with it, that it’s possible to imagine that the rules governing call recording are fairly relaxed.
Understanding call recording rules
Sadly, that is not true, and as with many matters relating to data handling, it’s important that businesses of all sizes understand the data protection rules relating to call recording and the retention of call records.
However, the modernisation of call-handling technology through hosted PBX systems, means that calls can be recorded more easily and cost-effectively, within the relevant regulations.
The general data protection regime, better known as GDPR, covered by the Data Protection Act 2018, sets out the data protection principles, rights and obligations that apply to most UK businesses and organisations.
Call recording is a type of data processing
In UK law there is a long-established principle, covered by the earlier Data Protection Act of 1998, which says that call recording is regarded as a type of data processing. This is because the contents of a call recording can include personal data, such as financial information, details of the customer’s address, amongst other data.
The 1998 Data Protection Act established that implicit consent is assumed, if customers are told about the recording, and given the choice to opt out. In this case, a recorded message was fine.
Raising the bar
However, GDPR has raised the bar and businesses can no longer rely on tacit customer consent. Businesses need to clearly state the purposes that the recorded data will be used for; this needs to be specific and unambiguous.
This means that in order for a firm to lawfully justify the recording of a call, it needs to fulfil one of the following Article 6 conditions:
- Call participants have consented to be recorded for one or more specific purposes;
- Recording is necessary to fulfil a contract to which the participant in the call is a party;
- Recording is necessary for fulfilling a legal obligation to which the data recorder is subject;
- Recording is necessary to protect the vital interests of one or more participants;
- Recording is in the public interest or in the exercise of official authority vested in the data recorder;
- Or, recording is in the legitimate interests of the data recorder, unless those interests are overridden by the interests of the participants in the call which require protection of personal data.
Satisfying the Article 6 conditions
Sector-specific regulations mean that organisations in some business categories will easily satisfy one of the six conditions. For example, banks and financial services firms are legally required to record all their transactions.
But those businesses that record calls only for quality and training purposes will need the customer’s consent: their freely given and informed permission, for the specific purpose of recording the conversation.
Call recording documentation and policies
So, if you plan to record and retain calls, then as part of your obligations under GDPR you need to document how you plan to process customer call data.
You also need to create your own call recording policies and document the actions that you will take to obtain your customers’ consent.
If you would like to learn more about how call recording could benefit your business, Time Communications would be happy to talk you through the options available to you. Contact Time Communications’ expert team on 0113 2059640, you can request a callback on our home page, email at [email protected] or message us here.