Recently, I had the following "conversation" with a call centre of one unnamed corporation:

"In order to improve our services, we would like to record this phone call based on your consent...

  • If you agree with the recording of this phone call, please press 1 and you will be connected to one of our operators;
  • If you do not agree with the recording of this phone call, please press 3 and your call will be terminated. You may use another way to contact our company, for example, you can personally visit one of our branches, or use our online contact form."

If I have given my consent to the recording, would such consent be valid from the perspective of the GDPR?

According to Article 7 (4) of the GDPR: "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract."

The wording of this Article is clear, but the line between valid and invalid consent might be very thin.

The new guidelines on consent under GDPR issued by the European Data Protection Board (“EDPB”) on 4 May 2020 should shed a little more light on this issue.

The EDPB guidelines highlight genuine choice as one of the main conditions of validity of the consent. According to the guidelines, the genuine choice of the data subject to provide consent is preserved, when both, services provided with the consent and services provided without the consent are genuinely equivalent.

Did I have a genuine choice to give my consent with the recording of my phone call? I don’t think so.

Maybe I would expect the conversation to go like this:

  • "If you agree with the recording of this phone call, please press 1 and you will be connected to our operator;
  • If you do not agree with the recording of this phone call, please press 3 and you will be connected to our operator."

What do you think?

In any case, we recommend the controllers to review the way how they collect the consents in light of the new EDPB guidelines.