Voice recording and the law

Two specific aspects to the recording of calls are covered by different Acts:

• Recording a call
• Storing and handling the call

Recording a call

Recording is the physical act of making a recording; monitoring is the listening to a call when being made or later. Operating a PABX is covered by the Class Licence for the provision of Branch Systems to provide Telecommunications Systems (TSL) or the Class Licence for Self Provided Telecommunications (SPL), either of which can apply depending upon the status of the organisation making the recording.

However, the relevant privacy condition requires that:

“Every reasonable effort is made to inform parties that recording or monitoring is taking place.”

The Regulation of Investigatory Powers Act (RIPA) came into force in July 2000 and created laws that cover, recording and monitoring of telephone calls, amongst other things. This requires that tacit consent is sought by sender and recipient and is operated in compliance with the Lawful Business Practice Regulations.

The Lawful Business Practice Regulations (LBPR) came into force in October 2000 and outlines circumstances when a business may record conversations. An example of such is to provide evidence of a business transaction, to meet quality standards or to measure against targets.

OFTEL’s guidance for recording telephone conversation on private networks, (Press Release 47/99) updates guidelines regarding the rights of employees to privacy in the workplace. In short, it seems that recording and monitoring (for passive listening or active intervention) is subject to the same rules:

“You have to take reasonable steps to ensure both parties are aware that the call may be monitored or recorded and be able to demonstrate if required that you have done so.”

What constitutes as reasonable steps is not defined by OFCOM or by any legislation. It is each individual organisation that must decide what is reasonable. To this end it would be wise for organisations to have a policy that covers:

• Definitions of what is recorded and why (the reason for recording/circumstances)
• Process & policies on how all parties are informed
• Process and policies on managing and enforcing the policies, including fall back measures

Storing and handling the call

Once a call has been recorded its storage, use and transmission, are covered by the Data Protection Act 1998 Voice Recordings are no different from any other form of private data stored electronically) and the Lawful Business Practice Regulations (LBPR).

The Data Protection Act 1998 defines eight principles regarding data that must be adhered to. It defines data subjects, data classes and the data controller.

Unless a particular use of data is exempt, (which is dependent on the individual organisation’s use – ref section 9 Data Protection Notification Handbook), which would need to be registered. The LBPR rules apply to the use of a recording, including its onward transmission. Whether registration is necessary, or the data use is exempt, the Data Principles still apply. To this end it would be wise for organisations to have a policy that covers:

• Registration and use 1, 2, 3 & 4
• Security (such as access and availability) 7 & 8
• Retention (such as storage and disposal) 5
• Subject access by those recorded 6
• How the policy is managed and enforced