The purposes accepted by the CNIL
In its guidance sheet on listening to and recording calls in the workplace, the CNIL accepts occasional recordings to train employees, assess them, improve service quality and, in certain limited cases provided for by law, prove that a contract or transaction was concluded. Reports or assessment grids may be drawn up from the recordings for these same purposes.
At the top of this sheet, published in 2009, the CNIL states that it is “obsolete” and being updated. Its more recent 2022 sheet on proving a contract repeats several of the same rules: no permanent or systematic recording unless required by law, information given in two stages, restricted and logged access. Check the version in force before drafting your procedures.
What is not permitted
Unless a legal text provides for it, as for emergency services, an employer may not set up permanent or systematic recording of its employees’ conversations. Nor may it record everything to combat abusive behaviour: according to the CNIL, it must choose a less intrusive method, for example a recording the employee triggers themselves when a problem arises.
Combining call recording with screenshots of the employee’s workstation is considered disproportionate. Employees must have unrecorded lines, or a way of switching recording off, for their personal calls and for calls related to their duties as staff representatives.
Informing the caller: a spoken notice, then full information
The CNIL describes information given in two stages. First, a spoken notice at the start of the conversation about the existence of the recording, its purpose and the right to object. Then, a pointer to full information, for example the legal notice on the website or a “legal notice” key on the phone menu.
The full information covers the identity of the data controller, the purpose, the legal basis, the recipients, the retention period, the right to object on legitimate grounds, the rights of access and rectification, and the option of lodging a complaint with the CNIL. Callers must know about their right to object before the end of the conversation, so that they can exercise it.
Retention, access and security
Unless a text requires a different period or there is a specific justification, the CNIL states that recordings should be kept for six months at most and assessment documents for one year. It recommends “buffer” recordings: they are listened to within the following days, the assessment is written up, and the audio is then deleted promptly.
Access must be restricted to the people concerned by the purpose, with access rights and logging of who consulted what. As for formalities, the system is entered in the record of processing activities, the data protection officer is involved if there is one, and staff representatives are informed and consulted before it is introduced.
The special case of proving a contract
In a 2022 sheet, the CNIL specifies that recording to prove a contract was concluded is only allowed if the business has no other means of proof. It points out that in telephone selling, the consumer is only bound after signing the offer on a durable medium (Article L. 221-16 of the French Consumer Code), so recording is not necessary in that case.
For contracts that can be concluded orally, only the part of the conversation covering the conclusion of the contract may be recorded, not every call in full; manual triggering is given as an example. If a customer reads out their bank details, the CNIL recommends being able to pause or quickly delete the recording at that point. Conversely, French law requires recording in certain cases cited by the CNIL: investment service providers and telephone selling of insurance.
What the French Criminal Code says
Article 226-1 of the French Criminal Code, which the CNIL lists among the reference texts in both its sheets on call recording, punishes with one year’s imprisonment and a €45,000 fine wilfully invading another person’s privacy by capturing, recording or transmitting, without the speaker’s consent, words spoken in a private or confidential capacity. Consent is presumed when the recording takes place in the person’s sight and knowledge without them objecting, although they were able to do so.
Whether a recording can be used as evidence in court depends on the jurisdiction and the circumstances; that is a question for a lawyer, not for a general guide.
Frequently asked questions
Can a customer service team record all its calls?
For employees’ conversations, the CNIL sets the opposite principle: unless a legal text requires it, recording must be neither permanent nor systematic, and it must serve a specific purpose such as training or assessment. The sheets cited here don’t specifically address the case where an AI agent answers instead of an employee: define the purpose first, the scope of recording follows from it, and have the analysis approved by your DPO or legal adviser.
How long should call recordings be kept?
According to the CNIL’s 2009 sheet (flagged as outdated and under revision), six months at most for recordings and one year for assessment documents, unless a text requires a different period or there is a specific justification. A shorter period, with the audio deleted after assessment, is better still.
Does an AI voice agent that records calls have to say so?
Yes: according to the CNIL’s 2009 sheet, the spoken notice at the start of the conversation covers the existence of the recording, its purpose and the right to object, then points to full information. Alyas announces at the start of the call that it is an AI and that the call is recorded, and its data is hosted in the European Union. That announcement isn’t enough on its own: the business using the agent must make sure the purpose and the right to object are stated, and publish the detailed information, for example in its legal notice.
