GDPR Issue around call recordings

[Ryzo]

Hi - i have been contacted by a third party acting on behalf of Vodafone. They called me and informed me that calls were recorded.  At the end of the call i asked for a copy of the call recording and also what the legal reason they had for recording calls.

They informed me that i would have to direct my request for call recording to Vodafone as they are the controller of the data, even though new call data is recorded by them and not Vodafone itself.

The conpany informed me that as the processor they are not obliged to provide a legal reason for processing the data and instead Vodafoen do that.  If this is the case - i would like to know what the legal justification Vodafone uses to record my calls at a data processor.

This appears to be a major breach of the GDPR!

[beightonguru]

All vodafone calls are recorded due to 'training and monitoring purposes' as they are with every network. I would ring and speak to Vodafone though as it may not actually be someone related the Vodafone that called you by the sounds of what they were saying, all advisors entering your account will leave a trace so they can see if a member of Vodafone have called you or not, Its very difficult to say these days and vodafone will only handle call recordings directly to and from their contact centres and not from ANY third parties despite what the caller said. What number was it that called you? Please check it against this list - https://support.vodafone.co.uk/Using-our-network/Calling-and-messaging/Calling/38912113/Is-it-Vodafo.... Vodafone can't deny you that information but I do believe you have to do a 'subject access request' to receive a copy. Hope this helps

[Ryzo]

Thank you for your reply.

My issue is more to do with the legal reason (as set out under GDPR) for Vodafone and their sub processors for processing my personla data by recording calls.  I am really looking for a specific; consent, legal, contract; legitimate interest; public task or vital interests.

Knowing which legal justification Vodafone adn their sub processors rely on will let me know what my options are with the processing of data.

[jeffkinn]

Understandably, there is a lot of confusion about people's rights under GDPR. Companies are allowed to legitimately record calls for a variety of reasons including protecting their interests as well as yours. If a dispute arises afterwards a recording of a call is a vital piece of evidence in determining the facts. Are you a Vodafone customer?

Also I assume you were informed at the outset of the call that it was being recorded. If that is the case by continuing the call you have consented to the recording.

GDPR is all about being able to stop companies from keeping personal data about you. But if you are a Vodafone customer and have a valid contract with them you cannot ask then to forget you even after that contract is terminated. The company has a legal obligation to maintain records for a number of years that overrides anything you might want to do.

If you aren't a Vodafone customer then you could ask them to remove your information from their databases including any call recordings.

[Ryzo]

Thanks Jeffkin, i appreciate your view on legitimate interests of a business, however if Vodafone are relying on legitimate interests to process every piece of personal data about me then the rights i have are different than if they were using the lawful basis of performance of a contract or fulfilling legal obligations. I agree that call recordings are a vital piece of evidence when settling disputes, i am looking to know what lawful basis they are using to justify recording my phone calls - and whether this lawful basis transfers to their sub processors of my data.

Furthermore, under the GDPR, consent must now be an unambiguous affirmative action. Just because i was told 'calls are recorded' does not mean i consented to them being recorded. Pre-GDPR call centres were allowed to use a no reply or lack of response as consentual agreement.  This has now changed.

[jeffkinn]

Indeed it has and you should be asked for a positive assent to the call recording. Were you?

[Ryzo]

No i wasn't.

I would imaging the legal reason fro processing would be either the fulfilment of a contract or legitimate interests - my confusion is whether the lawful basis which Vodafone chooses, filters down to their third party data processor or whether they need theyre own lawful basis.  

I believe that if they have their own basis then they would be the controller or the data and not Vodafone? Am i correct?

[jeffkinn]

I would have thought so yes

[Mark]

As @jeffkinn advised @Ryzo, we record all our calls so we can protect both you and ourselves in the event of a dispute. If you’d like to view all the information we hold, you’d need to submit a Subject Access Request. If you’d like us to investigate why you were called and if the information regarding this call is held by Vodafone, please reply to my private message.