For most people, recording voice calls and conversations are all about expectation of privacy. But in heavily regulated industries, privacy often comes into conflict with the need for business to record conversations for the sake of compliance. For most companies, call recording is usually done out of necessity to improve and protect their business.
This conflict between privacy and compliance has heightened the need for companies to have an archiving platform that will enable them to record work-related content while filtering out personal communications as well.
Governed by an interlocking web of data protection and privacy laws, as well as recordkeeping requirements from different regulatory bodies, the current situation for companies in identifying legal ramifications of recording employee conversations is fraught with ambiguity and uncertainty. To shed light on this topic, we present a survey of conversation recording governing laws in various jurisdictions.
1. U.S.
The United States has a plethora of very stringent rules regarding what civilian calls can be recorded. But in general, the telephone recording laws in the U.S. are superseded by the following federal law (with further guidance by individual states):
Federal law requires the notification of at least one party (“one-party consent”) in a call (18 U.S.C. Sec. 2511(2)(d)). However, a “business telephone” exception allows employers to record calls on phones they provide to employees.
States with two-party consent laws are:
- California,
- Connecticut
- Florida
- Illinois
- Maryland
- Massachusetts
- Michigan
- Montana
- Nevada
- New Hampshire
- Pennsylvania
- Washington
All other states have one party consent laws, but even if your company resides in a one-party consent states, if it might make calls to two-party consent states it should either provide notification to both parties or not record these calls.
The U.S. Federal Communications Commission (FCC) defines the methods that can be used to obtain consent:
- Verbal (oral) notification before the recording is made.
- Prior verbal (oral) or written notification of all parties to the telephone conversation.
- An audible beep tone repeated at regular intervals during the call.
2. U.K.
While there are no regulations that prohibit individuals from recording voice calls and conversations, there are various laws in place that regulate companies’ actions regarding capturing voice calls and conversations. The law governing a business’s right to monitor and record a telephone call with its customers is primarily outlined in:
- Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 (SI 2000/2699) (Lawful Business Regulations).
- Data Protection Act 1998 (DPA).
Under the Telecommunications Regulations 2000, companies can only capture voice calls without consent if the recording is used for one of the following legally-justified reasons:
- To allow the business to comply with other regulatory procedures.
- To provide evidence of a business transaction.
- To act as a means of verification that the person being monitored is performing his or her work to standards.
- To protect national security.
- To prevent or detect criminal activity.
- To secure the efficient operation of the telecommunication system.
- To allow the business to detect unauthorized use of the telecommunication system.
The DPA sets out rules for the correct handling of personal data, which requires any recordings of telephone calls to be stored securely with appropriate steps taken to avoid breaches. It focuses on balancing the interest of individuals and businesses – as long as the necessary steps to protect privacy are followed, recording personal data is assumed to be justified.
However, this is not the case with the General Data Protection Regulation (GDPR, which will come into full force in May 2018. It will replace the Data Protection Directive 95/46/EC and was designed to harmonize data privacy laws across Europe. This regulation aims to protect EU citizen’s data and privacy in an “increasingly data-driven world that is vastly different from the time in which the 1995 directive was established”.
In effect, The GDPR directly affects the ability of organizations to make recordings of personal conversations, even those made on business devices.
3. France
The French data protection authority, Commission Nationale de l’informatique et des Libertés (CNIL) also implemented the simplified norms in 2015 which provides guidance on monitoring and recording telephone calls in the workplace. Under the decision, only data processing operations that involve monitoring and recording employee telephone calls on a periodic basis are within the scope of the simplified norms. Moreover, the monitoring and recording of telephone calls may not be implemented by any public or private organization whose tasks consist of collecting sensitive personal data.
4. Germany
Germany is a two-party consent country, meaning recording calls and conversations without the consent of the two or, when applicable, more, parties is a criminal offense according to Sec. 201 of the German Criminal Code. In addition, Germany requires that VOIP users have a German address to use a German number.
5. India
There is no absolute mandate on recording telephone calls in India, though call recordings can be presented as evidence in the court. However, if a person unilaterally recorded a telephone conversation without the consent of the other participant(s), it is possible that the non-consenting party could claim that their right to privacy was violated, in accordance to Sections 43-A and 72A of the Information Technology Amended Act 2008 (ITAA)
6. Singapore
The Personal Data Protection Act of 2012 is an Act that governs the collection, use, and disclosure of personal data by organizations in Singapore. Under the PDPA, “personal data” refers to data about an individual who can be identified from that data. Any data will also be considered as personal data if the data, combined with information that the organization already has, may lead to the identification of an individual.
If a person is recording a conversation that contains the personal data of an individual in the form of audio or video recording during their own business, they will be required to obtain consent from the individual.
However, if the person is recording the conversation on behalf of and for an organization or in their capacity as an employee of that organization, they do not need to obtain consent from the individual. That responsibility falls on the organization.
7. Australia
Australia’s applicable law, The Telecommunications (Interception and Access ) Act of 1979, states that whoever is being recorded must be informed at the beginning of the conversation. This is to allow the person to end the call or ask to be transferred to another line where monitoring or recording does not take place.
The severity of the law also varies from state to state. For instance, it is currently strictly illegal to record private phone conversations without consent in Victoria, Queensland or the Northern Territory. While in the Australian Capital Territory, New South Wales, Tasmania, and Western Australia, the rules are much stricter – it is prohibited to use a security camera to secretly record conversations in NSW. Because of the extensiveness of Australia’s privacy laws, it is worth taking a look at the guidelines available through the Australian Communications and Media Authority.
At TeleMessage, we offer our Mobile Archiver that can help companies to efficiently manage data and content including enterprise telephone calls, SMS, emails, and web and social media content, concerning compliance. Our archiving solution is equipped with versioning, and robust governance capabilities that ensure content across all digital channels is compliant and meets global regulatory requirements.
Contact us today to learn more about mobile archiving solutions.
