Recording of Customer Telephone Calls

Organizations record customer telephone calls for a variety of reasons, such as ensuring quality of customer service, dispute resolution, fraud prevention, or training/development of staff.

These recordings involve the collection of personal information and therefore must be handled appropriately – from collection through to disposal.

Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), sets the ground rules for how businesses handle personal information in the course of commercial activities.

Businesses subject to PIPEDA must comply with the Act when recording calls – whether the customer or the organization initiates the call. Businesses contracting out call centre, telemarketing and similar services must ensure that these third parties also follow the rules.

When it comes to recording customer telephone calls, this page outlines what individuals can expect and how businesses subject to PIPEDA can comply. For those not subject to PIPEDA, the guidelines below are best practices.

Customer calls and personal information

Businesses generally record calls with the intention of capturing the content of their conversations with customers. However, these recordings can also collect personal information beyond the intended purpose of a call. For example, a recording can capture:

• voice characteristics, such as tone or presence of a vocal disability;
• speech characteristics, such as an accent or presence of a speech disability; and
• incidental personal information offered by the caller not relevant to the call.

Some businesses use recordings of customers’ voices as a means of verifying their identity during future calls. When used for this purpose, voice recordings usually involve the collection of uniquely identifying voice characteristics (called “voiceprints”) from customers, which are a form of sensitive biometric information.

The collection and use of sensitive biometric information can pose significant privacy risks. For more information about the considerations of using a biometric technology such as voiceprints for authentication purposes, please refer to our Guidelines for identification and authentication and Guidance for processing biometrics – for businesses.

How to record a customer call while respecting privacy law

The following guidelines provide customers and organizations with more detailed information about their rights and obligations under PIPEDA when recording customer telephone calls:

• The organization can only record a call for purposes that a reasonable person would consider appropriate under the circumstances.
• The organization must inform the customer that they are recording a call, clearly state the purpose of the recording and obtain consent.
• The purpose for recording the call should be stated to the customer as clearly and narrowly as possible and should inform the customer of all purposes for which the recording may be used. Avoid stating overly broad purposes where a narrower purpose can be provided.
• An organization should not state that it is recording the conversation for security or quality assurance purposes if the recording will be used for marketing, customer profiling, or authentication.
• In most cases, if the customer proceeds with the call knowing that the conversation is being recorded and why, their consent is implied. However, if the recording involves biometric voiceprints or other sensitive personal information, express consent may be required. For more information about obtaining meaningful consent, see our Guidelines for obtaining meaningful consent and Guidance for processing biometrics – for businesses.
• Organizations should consider obtaining consent in multiple ways to help ensure that consent is meaningful. For example:
• verbally;
• by the customer pressing a number on the keypad (in the case of automated messages); and
• with clear messages on monthly statements. (For example: If you have any questions about your bill, please call 1-800-XXX-XXXX. Please note your call will be recorded for XX purposes.)
• Customers must be given a choice about whether their voice is recorded during the call. If the recording is not integral to the product or service being provided, then the organization must provide customers with alternatives, unless an exception to consent applies under PIPEDA.^{Footnote 1} Alternatives to voice recording could include:
• continuing the call without recording;
• visiting a retail outlet;
• writing an email or letter; and
• completing the transaction online.

• Customers have a right to request access to the recording at a later date. The length of time that an organization keeps the recording will vary depending on several factors, including the purpose for having collected it, whether it was used to make a decision about an individual, and any legal requirements to retain it.
• An organization may only use the information collected for the purposes specified.

If a customer has concerns about privacy practices with respect to recording customer calls, they should bring it to the attention of the business. We have Tips for raising your privacy concern with a business that may help.

If a customer is not satisfied with the response to their privacy concerns, they may be able to file a formal privacy complaint with the Office of the Privacy Commissioner of Canada.