Recording video meetings: a good or bad idea?

Working from home

One of our subscribers has many employees who are working from home. It uses apps such as Zoom and Skype to hold staff meetings and training which would ordinarily be face-to-face.

Our subscriber is considering automatically recording all of these video calls, but is this a sensible idea?

A tempting risk

At first glance, this looks OK. Not only would our subscriber have an accurate record of its staff meetings, it could potentially share recordings with staff who are unable to attend.

However, there is a significant risk here. Where a video meeting is recorded, it will automatically amount to personal data for all the attendees and any third parties who are identified, e.g. clients, prospective employees or former employees.

Sensitive personal data

If certain topics are discussed, e.g. an employee’s sickness absence/health, criminal convictions, sexual orientation or trade union membership, the video recording will also comprise sensitive personal data.

The same is true if certain protected characteristics can be seen on or assumed from the video recording. An example might be that an employee has a visible physical impairment (which discloses a disability) or wears clothing or jewellery which indicates they follow a particular religion or faith.

Less intrusive

Wherever there is personal data and sensitive personal data, you will find the GDPR . It states that personal data must only be processed where this is justified. Plus, any processing of personal data must be limited to what is necessary. Much stricter rules and obligations apply to the processing of sensitive personal data.

Tip. In practical terms this means that if our subscriber wouldn’t have ordinarily recorded a face-to-face meeting (which is unlikely), its video calls shouldn’t be recorded either.

Consent not sufficient

But what if all the meeting attendees agree to being recorded and give their written consent in advance - would that make any difference? Due to the nature of the employer/employee relationship, employee consent in this instance is likely to be deemed invalid, meaning our subscriber would breach the GDPR .

Still co nsidering?

There are two other dangers; if a recording was made a copy could be requested by any data subject in it via a subject access request. Once released, the recording could potentially be used as evidence in a court or tribunal. Equally, it could find its way into the wrong hands, e.g. given to a competitor or posted online.