Recording External Telephone Calls and GDPR

[10101010]

Morning All

 

Our phone system has the potential to record and store external calls which we can set to delete after a period of time which is set to 30 days at present

 

I've been looking for some guidance on whether is something that schools are permitted or should do, but have found little documented guidance. If anyone has any DFE guidance please link it here.

 

These are the things I have considered so far :

 

• Standard message when ringing on the main switchboard number 'this call will be recorded blah blah blah',
  
• If we need that message for every inbound call to a direct dial then there will be a charge for setup - so at present it's not being done.
  
• Letter home at start of academic year informing parents
  
• Placing a notice on Contact Us website - 'Your calls will be recorded for blah blah blah'
  
• An what about staff ringing out to parents - should we expect staff to inform the parents that the call is being recorded ?
  

 

 

Is anyone else doing this and what else do you do to make sure you are GDPR compliant?

 

Or don't bother it's not worth the hassle : )

 

All advice welcome

[mavhc]

Why are you recording calls? What's the reason, according to that reason how long should they be kept? How do people opt in/out?

[10101010]

There is no opt out we either use it or turn it off completely.

 

For mutual protection for both staff and parents in the event of disputes.

 

Staff training - if for example the staff member did not handle the call so well and maybe how they could handle the situation differently.

 

Only SLT are able to request access to recordings via the administrator which is me. The system will also identify if I have played back a recording for any reason.

[Ditto]

I wouldn't normally expect too much guidance on DfE sites for this and would suggest visiting the ICO site for this. However, having had a quick look at ICO for guidance, nothing really came up that hit the mark. So I think you are left with the general guidance about data processing requirements. For starters you might like to start here: https://ico.org.uk/for-organisations/gdpr-resources/lawful-basis-interactive-guidance-tool/

 

Also, you could ask your DPO for advice - and then I'd be very interested to hear from @GrumbleDook on this one as it's an interesting case study and is likely to be one that sits in a grey area!

[10101010]

Yeah waiting for response from dpo, discussing it with a few of her colleagues. I will post when they get back to me.

[DrBeaker]

Seeing as all big companies use the "for training and quality assurance" excuses when recording their calls, I can't see any issue with schools doing it?

[dapaulio]

It’s complicated and not sure how relevant it is now but at my last place We were informed (before GDPR mind) that you must state that conversations are being recorded and if the caller were to opt out you should delete the recording immediately unless the caller became abusive and the call were to be used as evidence into legal enquiry.

 

I do believe they still have this if prerecording still in place today but that doesn’t mean it is right under new law

 

I would consult gdpr specialists and/or your dpo

 

Let us know how you get on as I would be interested to know

Thanks

[Ditto]

Seeing as all big companies use the "for training and quality assurance" excuses when recording their calls, I can't see any issue with schools doing it?

Initially I thought the same, but as most schools count as 'public authorities', there might be some nuances as a result. Additionally, I think there is more likelihood of special category data being recorded so I think whilst the same might be true of some big companies, being a school I want to be extra cautious.

[enjay]

[*]Letter home at start of academic year informing parents

[*]Placing a notice on Contact Us website - 'Your calls will be recorded for blah blah blah'

 

A message in your parent newsletter will not suffice, as not everyone who phones your call will have received the parent newsletter because they're not all parents. I don't think your website is sufficient either, as I believe the caller needs to be informed at the time (why else do all these companies tell you on their hold message, if they could just bung it on their website?).

 

if the caller were to opt out you should delete the recording immediately

 

So, if I didn't give consent, you would record the call anyway and then delete it? I'm not sure about that.

 

if the caller were to opt out you should delete the recording immediately unless the caller became abusive and the call were to be used as evidence into legal enquiry.

 

So, even though I've not consented, you might keep the recording anyway? That can't be right, surely...

[dapaulio]

 

So, if I didn't give consent, you would record the call anyway and then delete it? I'm not sure about that.

 

I think The point was by continuing with the phone call you consented.

 

So, even though I've not consented, you might keep the recording anyway? That can't be right, surely...

 

I think the point of this is if you were verbally abusive over the phone, threatening even where police was involved that situation would warrant the recording being sent to police for evidence before being deleted from the system.

 

Like I said this was many years ago before gdpr and May no longer be relevant with new laws.

 

My contribution to this meeting and the whole process was to later facilitate once the policies and politics had been ironed out

[enjay]

that situation would warrant the recording being sent to police for evidence before being deleted from the system.

 

Not if the recording had been taken without my knowledge or consent. I don't think the Police could use it in that instance.

[mavhc]

You can't be denied a service because you opted out of being recorded.

 

That's the whole reason GDPR exists, to stop default mass data gathering just because your software is inflexible

Edited February 12, 2020 by mavhc

[10101010]

A message in your parent newsletter will not suffice, as not everyone who phones your call will have received the parent newsletter because they're not all parents. I don't think your website is sufficient either, as I believe the caller needs to be informed at the time (why else do all these companies tell you on their hold message, if they could just bung it on their website?).

 

So at present we do the following which is being reviewed by our DPO

 

Standard message when ringing on the main switchboard number 'this call will be recorded blah blah blah',

Letter home (email and instant notifcation app) at start of academic year informing parents (should have said nominated contacts sorry)

Placing a notice on Contact Us website - 'Your calls will be recorded for blah blah blah'

Delete recorded messages after 30 days (thinking this could be reduced) - If we were to get a Subject Access Request then this content would need to be searched so the less data stored the better.

Staff making external calls should notify the caller about the call being recorded - hard to enforce and I'm sure many don't

 

 

DPO said she would get back to me today hopefully. (Our DPO is a paid service from the London Diocese)

[TechMonkey]

You can't be denied a service because you opted out of being recorded.

 

That's the whole reason GDPR exists, to stop default mass data gathering just because your software is inflexible

 

So how does every bank, insurance company and other major corporation get away with it? You aren't being denied a service, you could still write or email in.

[AndyCrow]

Banks, insurers etc have a legal requirement to record.

[DrBeaker]

Banks, insurers etc have a legal requirement to record.

 

What sort of requirement out of interest?

 

For example CCTV and DBS stuff used within schools for the public safety/safeguarding normally trumps consent doesn't it? As they are claimed to have wider aspects such as the public safety/safeguarding etc?

[AndyCrow]

https://www.handbook.fca.org.uk/handbook/CMCOB/2/3.html

[GrumbleDook]

I think @AndyCrow would probably agree with me on this, but it seems that you want to use this for a range of purposes, not just one, and that all conversations are likely to be about school business, school interests or in the interest of parents/childrens.

 

Legitimate Interests would be a lawful basis that could cover pretty much all areas, but I would recommend a DPIA / LIA to be completed to ensure you know what personal data will be captured, the exacts purposes that will be cover the use of data, the relevant access controls you will have in place, data retention (including where recordings are kept for a longer period due to incidents / disputes), consultation and showing transparency *including* updating your privacy notice.

 

The exact details of the above are things your DPO will help you with, no doubt. If you need examples of DPIAs to look at (not for this but for other things) have a look at Education Data Matters.

[TechMonkey]

Banks, insurers etc have a legal requirement to record.

 

Sorry I was only using them as an example against the claim that having no opt out would exclude you from a service.

[GrumbleDook]

Consent is unlikely to be a suitable lawful basis. If it cannot truly be consent, it is *not* consent!

[PotNoodleTech]

I think the real question is are you intending just to record all calls cart blanche, or are you only going to use it to record calls on an ad hoc basis when something important needs to be retained.

 

The former probably couldn't be justified as reasonable. The latter definitely is and all you should need is a "calls may be recorded" warning and if they do not consent then they can hang up and drive to school?

[Ditto]

Just an additional observation on this topic based on some background research I did. It would suggest it would be good practice to ensure the recordings are encrypted whilst you have them. More on security considerations here.

[mavhc]

I guess I could install FreePBX on a luks drive

[Oakinno]

I've worked in the call recording industry for over 20 years. There's lots of speculation on this thread about what might be the law, so here's a few pointers.

 

1) The UK did havesingle party consent on call recording. Ofcom offered some fuzzy guidance thatrelated to how to inform callers if you wanted to record calls and mostorganisations have adapted that guidance to align with GDPR. When a largecompany calls you there is a very good chance you are being recorded eventhough they haven't told you. There's no illegal about that.

2) You do not haveto inform ALL callers they are being recorded. You should make "reasonableeffort" to inform callers. Try not to separate call recording from otherforms of data processing. For example, do you inform customers BEFORE theyemail you that you'll store those emails? Adding it to you website would beconsidered reasonable effort but you need to consider whether you want toinform as many parents as possible. If you do then there are clearly extralengths you could take.

3) It is not alegal requirement for insurance companies to record calls. Traders and some IFAare really the only sectors that have to do it.

4) Companies usetheir auto-attendant to announce calls are being recorded, not because theyhave to but because disputes tend to be reduced when customers know they arebeing recorded.

5) GrumbleDook iscorrect, if you have "legitimate interest" in recording clients youcan. If you want to tell parents it's required to protect staff and forms acrucial part of your business processes you can. Once that parents child is nolonger attending the school they have a right to ask for ALL their personaldata to be deleted, including emails etc.

6) Ditto iscorrect, GDPR refers to personal data being encrypted. If the recording isbuilt into your phone system it probably creates mp3 or wav files that aren'tencrypted. You may have to consider a bolt on that offers encryption.

 

There's still amisconception that stems back to the 90's that recording calls is somehow unlawfullycapturing personal information. Probably because phone systems never originallyincluded it. Consider how emails are viewed in comparison. You'd never expectan email to be deleted after you've read or sent it, but as you can see in thisthread, some people still don't view a telephone call comparably. GDPR doesn'tdistinguish between forms of personal data captured and stored using differentmethods, whether that be a phone call, email, letter received, online form etc.

[Roberto]

What sort of requirement out of interest?

 

For example CCTV and DBS stuff used within schools for the public safety/safeguarding normally trumps consent doesn't it? As they are claimed to have wider aspects such as the public safety/safeguarding etc?

 

We have a regulatory requirement In some areas to ensure that all interactions between staff and customers are recorded. I don’t get involved with voice stuff especially (other than knowing it exists) but I have to consider potentially bottomless archival capacity for emails due to this.

 

My feelings about turning on recording ‘just because it’s there’ is that this isn’t a good use of time, however having the facility easily available to enable recording if necessary may not be a bad thing. In any case, be clear with yourself and the organisation what problems are solved by doing this and which are not.

Edited February 15, 2020 by Roberto