0

If an audio recording was made between two consenting parties, would that recording be considered "data" and subject to GDPR, (like a photograph) or would it depend on the subject and contents of the conversation?

For example, would a casual chat about football between friends be considered legally equivalent to a recording of a contractual agreement in which detailed personal information is disclosed?

1
  • 2
    While the recording itself is likely to qualify as personal data (it is "information", the data subjects are "identifiable", and the recording "relates" to those data subjects), this doesn't necessarily mean that GDPR applies. There is the "household exemption" for activities of a purely private or household nature.
    – amon
    Jan 13 at 20:09

1 Answer 1

5

What is considered personal data under the EU GDPR?

GDPR Article 4, the GDPR gives the following definition for “personal data”:

‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

The voice and speech patterns of someone are formed by a conjunction of physical, physiological, genetic, mental, cultural, and social factors of a natural person. As a result, the voice (and its transcription, which identifies speech patterns!) are Persona Data under EU GDPR. They can be considered biometric data, which has the highest level of protection under GDPR.

This is also elaborated on by the International Association of Privacy Professionals in 2018, when GDPR was coming:

Audio recording under the GDPR

The bar for valid consent has been raised much higher under the GDPR. Consents must be freely given, specific, informed, and unambiguous; tacit consent would no longer be enough.

And if my word isn't enough: LinkedIn paid a lawyer to analyze the problem, and they wrote:

Conclusion

To conclude, voice recordings (combined, if necessary, with other elements) enable, in almost all circumstances, the inference of one’s identity and therefore constitute personal data requiring appropriate protection.

1
  • 1
    It is not even necessary that the recording itself is identifying. The data subject just has to be identifiable, possibly in combination with additional information or with the help of third parties.
    – amon
    Jan 13 at 20:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .