The Denmark Data Protection Authority (DPA) ruled on April 11, 2019, that affirmative consent is required when companies record customer telephone calls. Because voice recordings constitute personal data under the European Union’s (EU) General Data Protection Regulation (GDPR), international companies that communicate via telephone with EU customers will need to take steps to ensure GDPR compliance. 

In this case, Denmark’s largest telecommunications company, TDC A/S, provided disclosures to its customers that calls may be recorded for training purposes, but the company offered no mechanism for customers to opt-in or opt-out of the recording. During one such call, the customer requested that the call not be recorded, but the service agent said there was no way to turn off the recording. The Denmark DPA rejected the company's arguments that its recording practices served a legitimate interest, such as the improvement of its customer service, and concluded that the company's telephone recording practices violated the GDPR.

The Denmark DPA's ruling could open the door to more legal challenges to customer service call recordings. A company must obtain the customer's consent to the recording unless the company is able to demonstrate that the recording is necessary to fulfill a contract requirement or legal obligation, is in the vital interest of the customer, or there is some other GDPR purpose for the recording.

This ruling makes clear that training purposes are not a lawful basis to process these recordings. Under the GDPR, consent must be freely given, specific, informed, and unambiguous. Tacit consent no longer will be enough. Companies should re-evaluate their internal practices with regard to call recordings, update any policies and procedures as needed, and train customer service agents on these new legal requirements under the GDPR.