System in use

Recording meetings automatically

Recording the non-publicly spoken word is a criminal offence under section 201(1) no. 1 of the German Criminal Code where it is unauthorised, and that is a question alongside the legal basis. The processing itself can rest on Art. 6(1)(f) GDPR, but then the right to object has to be pointed out expressly and separately under Art. 21(4) GDPR. The route that notice takes differs from group to group.

The assistant records, outside voices too

An assistant takes minutes of meetings, attributes contributions to speakers and produces a summary with action items. Around the table sit employees, two people from a service provider and a job applicant. Customers’ names come up in conversation. Consent was obtained from everyone present.

The recording and the processing are two questions

Why the consent of everyone is not the starting point has two reasons, and the first does not sit in data protection law. Recording the non-publicly spoken word is an offence under section 201(1) no. 1 of the Criminal Code where it is unauthorised.

Two operations, two yardsticks

The audio recording	Merkmal	The further processing
Section 201(1) StGBWhat is an offence is unauthorised recording and, under no. 2, also the use of a recording so made.	Yardstick	Art. 6(1) GDPRPoint (f) comes into consideration, and for employees a collective agreement under Art. 88 GDPR alongside it.
AuthorisationIt removes the criminal exposure for the recording, so far as it extends.	Effect of consent	RevocableAt any time under Art. 7(3) GDPR, and after that the basis for the processing is gone.
Everyone speaking	Who is covered	Those mentioned tooAnyone named in conversation is a data subject without sitting at the table.
Criminal exposure	Consequence of absence	Unlawful processingWith claims by the data subject and powers of the supervisory authority.

The third row shows why consent from everyone present does not cover the processing. It does not reach those merely mentioned, and for them it would come too late in any event.

The notice of the right to object stands separately

How the information process works where legitimate interests are relied on is decided by a provision that regularly disappears into privacy notices. Art. 21(4) GDPR requires the notice of the right to object to be express, at the latest at the time of the first communication, and separate from other information.

Three groups, three routes

Employees

Collection from the data subject, so Art. 13 GDPR. The route is the internal notice, and the notice under Art. 21(4) GDPR belongs with it separately, not inside the general statement.

External participants

Art. 13 GDPR again, but without an internal channel. The notice has to reach them, so in the invitation or in an announcement at the start, and the notice of the right to object has to be set off from it.

People mentioned in conversation

No collection from them, so Art. 14 GDPR. The information has to be given under paragraph 3 within one month at the latest, and the exceptions in paragraph 5 have to be examined and reasoned.

The third group is the one projects founder on, and it can be made smaller. Where the summary does not need the names of third parties, removing them is a measure under Art. 5(1)(c) GDPR and saves the information.

The audio has a shorter period than the result

What happens to the recording is rarely settled, because technically it looks like an intermediate step. In legal terms it is the item carrying the highest risk, because it holds the wording and the tone.

Three periods, and the first is the shortest

The audio recording
It is no longer needed once the transcript exists. Art. 5(1)(e) GDPR then requires erasure, and section 201(1) no. 2 StGB makes further use of a recording made without authorisation an offence.
The transcript
It serves to check the summary and is needed for a short, named period.
The summary
It follows the period of the records it belongs with, that is, of the matter or the file.

3 von 3

How we support you with the transcription assistant

At the outset there is a list of use cases, not an assessment of the tool. For each use case it sets out the groups taking part, the legal basis, the route of the information and the three periods. The same list shows for which cases the tool is approved and for which it is not, and that is a more usable answer than an approval with reservations.

Frequently asked questions

Do we need the consent of everyone taking part?

Not necessarily for the processing, because Art. 6(1)(f) GDPR comes into consideration. For the audio recording, section 201(1) no. 1 of the Criminal Code applies, which makes unauthorised recording of the non-publicly spoken word an offence. Authorisation can follow from consent, and that is why consent remains the obvious means for that part.

Is a line in the invitation enough?

For Art. 13 GDPR often yes, for Art. 21(4) GDPR only where it is express and separate from other information. A sentence in the footer of an invitation does not achieve that separation. With external participants there is the further point that the information has to reach them and not merely be made available.

What applies to people who are merely mentioned?

For them Art. 14 GDPR applies, because the data were not collected from them. The information has to be given under paragraph 3 within one month at the latest. The exceptions in paragraph 5 have to be examined, in particular disproportionate effort, and their application has to be reasoned.

Is the introduction subject to co-determination?

As a rule yes. An assistant that attributes contributions to individual people is objectively capable of collecting information on conduct, and attributability is precisely its purpose. Section 87(1) no. 6 BetrVG is therefore engaged.

Get in touch!

Have we sparked your interest? Do you have questions? Would you like a quote without obligation? We look forward to hearing from you!

Alternatively you can request a call back.