Image above: Regulations detailed for countries in orange, in article below
Regulations regarding consent for call recording and the storage of personal data are in force across the globe. However, regulations vary and require international organisations to be aware of national and regional differences. Nevertheless, regulations are being introduced in various jurisdictions, Consentec’s Mitch Dawson, explained.
US
CCPA regulation covers the state of California and requires that residents of California must be given information relating to how their data will be processed, kept, sold and deleted at the point of collection.
Canada
The PIPEDA regulations mandate that an organisation can only record a call for purposes that a reasonable person would consider appropriate under the circumstances. The organisation must inform the customer that they are recording a call, clearly state the purpose of the recording and ask for their consent.
“It’s important to get the customer’s consent in several ways to ensure that their consent is meaningful,” said Dawson. “If the caller objects to the recording, they can ask that the company not record the call or use an alternative approach such as visiting a retail outlet, writing a letter or completing the transaction online.”
Hong Kong
The PDPO regulation states that where personal data is collected from the data subject, all practicable steps shall be taken to ensure that the data subject is informed of the purposes for which the data are to be used and the classes of persons to whom the data may be transferred. The data subject must also be informed of their rights to request access to the data and the correction of incorrect data.
European Union
The GDPR, which covers the EU27 countries, requires that the data subject has given consent to the processing of their personal data for one or more specific purposes. Processing must be necessary for the performance of contract to which the data subject is party, for compliance to a legal obligation on the data controller, to protect the vital interests of the data subject, to perform a task carried out in the public interest or to pursue the legitimate interests of the controller except where these are overridden by the interests or fundamental rights and freedoms of the data subject.
GDPR defines consent of the data subject as any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.
India
The PDP bill, which is now in force applies to both government and private entities, even those not present within the territory but which conduct business in India, offer goods or services in the country or conduct activities such as profiling of data subjects in India.
