Datatilsynet (Denmark) — IDA Forsikring

Decided by

Datatilsynet

Parties

Datatilsynet v. IDA Forsikring Forsikringsformidling F.M.B.A.

Decision date

June 27, 2024

Remedy

Datatilsynet ordered IDA Forsikring to bring its process for obtaining consent for recording and analyzing telephone calls into compliance with data protection rules going forward.

Appeal

Appeal status not stated

Key holdings

1. Datatilsynet determined that recording and analyzing customer service calls using artificial intelligence for quality assurance is permissible under data protection law.

   “Datatilsynet finder, at IDA Forsikring inden for rammerne af databeskyttelsesreglerne kan optage og analysere indkomne telefonsamtaler.” — 1. Afgørelse

2. Obtaining a single bundled consent for both documentation and quality assurance purposes violates GDPR requirements because consent must be granular to be freely given.

   “Datatilsynet kan konstatere, at der i forbindelse med, at en person ringer til IDA forsikring, alene indhentes ét samlet samtykke til både dokumentations- og kvalitetssikringsformål (uddannelse).” — 3.3.1

3. Transcribing and analyzing call recordings via speech recognition without tone or biometric evaluation does not fall under the prohibition against processing special categories of sensitive personal data.

   “Datatilsynet bemærker i den forbindelse, at analyserne af de optagne telefonopkald ikke i sig selv ses at være omfattet af forbuddet i databeskyttelsesforordningens artikel 9, stk. 1.” — 3.4

In plain English

In March 2023, the Danish Data Protection Authority, Datatilsynet, launched an own-initiative investigation into how IDA Forsikring used artificial intelligence to analyze recorded customer service phone calls. IDA Forsikring recorded incoming calls and used a speech-recognition model developed by a data processor to transcribe audio into text for quality assurance, employee support, standard service scoring, and cause analysis based on call topics. The system did not analyze tone of voice, gender, or dialects, nor did it build personal profiles. Datatilsynet found that using artificial intelligence to analyze telephone conversations for quality assurance is generally permissible under data protection rules. Furthermore, the authority determined that the text transcription did not violate rules on sensitive personal data because the processing was not intended to uniquely identify individuals. However, Datatilsynet ruled that IDA Forsikring failed to obtain valid consent from callers. The company obtained only a single combined consent covering both documentation and quality assurance purposes, preventing callers from choosing one purpose over the other. Because consent was not sufficiently granular, it could not be considered freely given or valid. As Datatilsynet had not previously issued guidance on phone consent for multiple purposes, it did not criticize the company but ordered IDA Forsikring to adjust its consent procedure going forward, such as by offering separate choices during the call.