Many companies record their daily VoIP phone calls for several important reasons. These call recordings are used to train staff members through real-life customer interactions. It further enables managers to review customer care quality and handle disputes more effectively.
However, VoIP call recordings often include personal details such as full names, ID numbers, email addresses, and so forth. For this reason, companies must adhere to strict guidelines when handling these audio files.
Is It Legal to Record Business Phone Calls in the UK?
It is legal to record phone calls in the UK, provided you follow the proper legal procedures. The Regulation of Investigatory Powers Act 2000 (RIPA) outlines that an individual can record a conversation for personal use without telling the other person.
However, the rules are completely different for businesses. If a company wishes to record customer conversations, it must establish a lawful basis for doing so and inform the caller upfront. For this reason, businesses cannot record calls without the other person’s knowledge without facing serious consequences.
What Is GDPR?
The General Data Protection Regulation (GDPR) is a comprehensive set of privacy laws created with the intention to protect the personal information of citizens. Because audio files often contain sensitive details, this law dictates how you must handle those files.
The reality is that if your company processes data from EU citizens, you are required to follow these strict privacy guidelines regardless of your physical location.
What Happens if Businesses Are Non-Compliant With GDPR in Call Recordings?
Laws around the protection of personal information are rarely taken lightly. Businesses that fail to comply with GDPR will be held liable and face various consequences. Companies are discouraged from non-compliance in the following ways:
- Businesses can face significant fines, reaching up to 4% of their global annual turnover.
- The court can order companies to stop call recordings completely.
- Individuals whose privacy has been breached have the right to file legal claims against a company, which will result in expensive court battles.
- Companies can be forced to compensate individuals for distress if that person has been affected by non-compliance.
Other than obvious legal implications, non-compliance will also lead to damaged client trust, which is extremely negative for business. Additionally, when there is an allegation of a data breach, legal investigations cause operational disruptions, which also prevents companies from earning more revenue.
How Can Businesses Use VoIP Call Recordings Legally in the UK?
Unfortunately, courts don’t excuse business owners if they didn’t comply with GDPR because they simply didn’t know all the rules, as ignorance of the law is not a valid legal defence. To prevent yourself from even ending up in such a situation, it’s important to understand the principles of this law.
Establish a Lawful Basis
Before you even start recording calls, you must identify a valid legal reason for recording audio under the regulations. Every industry is different, but for most companies, this falls under “legitimate interests” for things like staff training, quality assurance, or “contractual necessity” when verifying a telephone order.
Gain Explicit Consent
In the past, assuming someone agreed to being recorded just because they stayed on the line was perfectly fine. This form of consent is referred to as implied consent and is no longer acceptable when it comes to call recordings.
If you want to record VoIP calls, you must clearly tell the caller that they are being recorded and explain the exact reason why. Often, this is handled through an automated greeting before the conversation even begins.
Securely Store Your Data
Hackers are constantly searching for system vulnerabilities so that they can take advantage of them. That’s why organisations must use proper security measures to keep their digital files in their VoIP system safe from unauthorised access.
This could include measures like encrypting your files, using complex passwords, and only allowing access to employees who need certain data for the purpose of doing their job and no one else.
Delete Files After Prescribed Period
According to law, businesses can’t hold onto personal details for as long as they wish to. Once a file has served its initial purpose, you must permanently and securely delete it from your servers. The timelines do, however, vary depending on which industry you’re working in.
For example, financial industries are required to hold onto data for about 5 years. Whereas a standard general practitioner must keep data for 8 years after the last entry or completing a treatment. Additionally, customers have the right to ask you for a copy of their file or request that you erase their information completely, and you must comply within thirty days after the request.
Consider Specific Industry Rules
Some sectors have additional obligations on top of standard privacy laws. For example, the Financial Conduct Authority (FCA) requires certain financial firms to retain specific audio files for several years.
Furthermore, if you take card payments over the phone, you must follow strict Payment Card Industry (PCI) rules to ensure credit card numbers are never stored in your audio files. That’s why it is advisable to search data protection laws specifically aimed at your industry.
Protecting Your Customers and Your Business
Recording VoIP calls can be incredibly beneficial for businesses, but it could also cause legal nightmares if done incorrectly. As a business owner, it’s vital that you look up the data protection laws related to the industry in which you operate.
Additionally, clearly asking for permission to press record, having a legitimate reason, respecting deletion requests, and keeping all digital files encrypted allows you to record calls on your VoIP system without ending up on the bad side of the law.
