Recording Customer Calls and Saying So

Calls recorded without anyone saying so

A business starts recording calls for a good reason: training new staff, settling disagreements about what was agreed, or seeing which ads make the phone ring.

Often the recording starts quietly. A phone system has the option switched on, or a call tracking service is set up with recording enabled, and nobody adds a message.

A recorded call collects personal information: a voice, a name, an address, sometimes a card number. Collecting it in the course of business comes with obligations.

What follows is general information about those obligations, not legal advice.

One-party consent answers a different question

Many owners have heard that recording a call is legal as long as one person on it agrees.

That comes from criminal law, which generally allows a person to record a conversation they are part of. It does not settle what a business may do with recordings of its customers.

For a business, the question is privacy law. Federally that means PIPEDA, which applies to commercial activity in most provinces and to information that crosses provincial or national borders.

Some provinces also have their own private-sector privacy legislation; which law applies depends on a business's location and its handling of personal information.

These laws differ in detail but agree on the essentials: tell people what you collect and why, use it only for that, protect it, and do not keep it forever.

What callers need to hear

• That the call is recorded, said before the conversation starts.
• Why, naming every purpose the recording will serve.
• That they can object, and what happens if they do.
• The same notice on outgoing calls your staff make.
• No vague catch-alls covering uses you have not mentioned.

The second is where most messages fall short. The federal Privacy Commissioner's guidance on recorded calls asks for every purpose to be stated.

A message mentioning only quality and training does not cover recordings later used to judge which ads work, or for marketing.

A short message that works

The message can be short: this call is recorded for staff training and to keep an accurate record of your booking. If you would rather not be recorded, tell us and we will help you another way.

Callers who carry on after hearing that have generally given implied consent, which is how the guidance treats ordinary calls.

The other way has to exist. Staff should know how to stop the recording, take the booking by email or web form, or call back on a line that does not record.

Keep the message to a sentence or two, so callers are not left waiting before anyone answers.

Call tracking numbers

Call tracking gives each ad or listing its own phone number, which forwards to your real line and counts the calls each one brings.

Many tracking services can also record those calls, and some accounts are set up with recording on. The business, not the tracking company, is the one collecting the information.

Check the setting. If recording is on, the greeting must say so, and if the recordings are stored outside Canada, your privacy policy should mention it.

If all you need is a count of calls, switch recording off.

Card numbers read aloud

The riskiest thing a recording can hold is a customer reading out a credit card number.

Card industry security rules do not allow the security code on a card to be kept after the payment is authorised, and a recording of someone saying it can count as keeping it.

The usual answers are to pause recording while card details are taken, or to take payment through a secure link instead of over the phone.

A worked example

A laser tag business with two arenas set up call tracking last year to see which of its ads produced calls.

Recording was switched on in the account, and nobody added a greeting. The recordings were downloaded each month to the shared office computer, where they stayed.

When the manager listened to a few for training, the problem was obvious: several parents had read out their card numbers and security codes to book a party.

The fix took an afternoon. A short greeting now says calls are recorded for training and to confirm bookings, and offers online booking instead.

Staff pause the recording before taking card details, or send a payment link. Recordings stay in the tracking account, behind individual logins, and are deleted automatically after ninety days.

The downloaded files were securely deleted from the office computer and its backups.

Keeping recordings secure

Treat recordings like any other customer records. Give access only to the people who need it, each with their own login, never a shared one.

Do not download them to shared computers or personal phones. Every copy is another place they can be lost.

Staff are recorded too. Tell them in writing which calls are recorded, why, and who listens.

Starting November 1, organisations under PIPEDA have to report any breach posing a real risk of significant harm, and log every breach. A lost archive of recorded calls could easily qualify.

How long to keep them

Decide a period for each purpose and write it down. Training needs a few weeks of examples; a disagreement about a quote needs the recording until that job is finished and paid.

If a recording is used to make a decision about a customer, such as refusing a refund, keep it long enough for them to ask to hear it.

Customers can ask for access to their own recordings, so you need to be able to find a call by date and number.

Then delete on schedule, automatically where the system allows.

The counter-case

Not every business needs to record anything.

If recording was switched on by default and nobody listens, the simplest step is to turn it off. An office that never reviews calls gains nothing from storing them.

A business that records only for occasional training can keep a very short retention period, which shrinks every other obligation along with it.

Where you do record, the advice holds: say so at the start, say why, protect the recordings, and delete them on schedule.

Setting it up properly

1. Find every system that records calls.
2. Switch off recording nobody uses.
3. Write a greeting naming every purpose.
4. Give staff an alternative to offer.
5. Pause recording for card details.
6. Set a retention period and automate it.
7. Limit access to named logins.

Step one is where most surprises turn up. Phone systems, tracking numbers and voicemail services all store recordings in different places, and a business often finds one it had forgotten.

What to do if any of it is ever lost is covered in breach reporting now has a start date.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.