The recording of conversations that call-centre employees have with customers leads to the processing of personal data of the employees by the employer in their role as a personal data controller. Depending on the technical solutions used, this data will include the content of the words spoken by the employee and their interlocutor as well as metadata related to the recorded call (such as duration or start/end time).

The fact that the recording of conversations leads to such data processing by the employer (in their role as the controller of such data) results in the employer having a number of obligations under the General Data Protection Regulation (GDPR, known as RODO in Polish).

Purpose of recording

From the point of view of the data protection legislation, it is crucial for the employer to determine the purpose of recording the call because the purpose of the recording significantly affects the possibility, scope and manner of processing of the data obtained through the recordings.

There are different implications for data processing when the purpose of the recording is to obtain a recording of the customer (such as a conversation with a customer via a call centre) with whom the conversation is being conducted (and the recording of the employee is of secondary importance or is only conducted because it is not possible to record the customer without simultaneously recording the employee), and different when the main purpose of the recording is to evaluate the employee.

When deciding to record employees' conversations, employers should think carefully about the purpose for which they are introducing such a solution.

The purpose of recording employees' conversations must comply with the law, in particular employment law. As a general rule, recording employees’ conversations of a private or non-work-related nature, and without the employees being clearly informed in advance of the recording, is prohibited.

Importantly, as the recording of conversations leads to substantial processing of employees' personal data, the employer should consider in each case whether such processing is justified and necessary in view of the purpose for which it is to be carried out and whether there are no other, less intrusive ways from the data processing perspective for the employer to achieve the same purpose.

Basis for processing personal data

In order to be lawful, any processing of personal data (other than ‘special categories’ of data), must be carried out on the basis of one of the grounds for processing set out in Article 6(1) GDPR. The same applies to personal data obtained from call centre employee call recordings.

Most often, the basis for the processing of personal data in call-centre recordings will be legitimate interest. In such a case, it is advisable for the employer to carry out and document (in particular in the event of an audit) the ‘balancing test’, which will set out the rationale as to why the employer believes it can record the calls on this basis.

Restriction of access to recordings

In view of the principle of minimisation of processing under GDPR, the employer should take care to limit the number of persons who will have access to the recordings. It should only be available to those members of the employer's staff for whom such access is necessary from the perspective of them fulfilling their duties. Such persons should also have appropriate authorisation to process personal data granted by the employer.

Retention of recordings

Under GDPR, personal data may be kept in a form which permits the identification of the data subject for no longer than is necessary for the purposes for which the data is processed.

Thus, an employer should not keep recordings for longer than is necessary for the purpose for which they are made. A different retention period will be justified if the purpose of the recordings is to record a customer with whom the employee is speaking and a different one if the purpose of the recordings is solely to evaluate the employee. The retention period should be determined with particular care – keeping recordings for longer than is reasonable in view of the purpose of the recording may constitute a breach of the GDPR.

Recording conversations and the obligation to provide information

As a controller of employee data, the employer is obliged to provide employees with information about the processing of their personal data that meets the requirements of Articles 13 and 14 of the GDPR.

The fact that personal data is being processed in connection with call recordings should, therefore, be adequately addressed in the information clauses (privacy policies, etc.) regarding the processing of personal data provided to employees by the employer.

A separate issue will be the requirement to inform other persons whose voices are captured on the recordings about the processing as well.

External call recording service providers

Call-centre recording services are sometimes provided by external providers. These providers, to a greater or lesser extent, usually have access to the data processed by the systems they provide.

If the providers are to have access to personal data processed in connection with recordings, it is necessary that the employer (as data controller) has:

• Verified (such as through a survey) that the provider offers sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of the GDPR and protects the rights of data subjects,
• Entered into a data-processing entrustment agreement with the provider (as the so-called processor) that meets the requirements of Article 28 of the GDPR.

Call recordings versus employee monitoring

Employers may and often use recordings of call centre employees' conversations to conduct other forms of employee monitoring as defined in Article 22³ § 4 of the Labour Code.

If the employer intends to use the recordings for this purpose, it is necessary for it to adequately regulate this issue in its internal employee monitoring documents in accordance with Labour Code requirements and inform employees about the monitoring. The Labour Code restricts the purposes of using employee monitoring. Due to the nature of monitoring related to call recordings, it is advisable for recorded employees to receive constant or frequently repeated information about the recording of their calls and the related monitoring.

Karolina Romanowska

Łukasz Rutkowski