Frequently asked questions about phone calls
Citizens have the right to record telephone calls in which they are the caller or receiver. Finland’s Constitution gives the right to record your own communications, and neither has it been criminalised in the Criminal Code's provisions on the protection of communications.
The further use of such recordings is a different matter, however. If you play the recordings to others, you should make sure that you are not guilty of, for example, defamation, dissemination of information violating personal privacy or disclosing confidential information (e.g. information concerning the person's state of health). In this regard, legality cannot be evaluated without knowing the contents of the recording, its intended purpose and the persons to whom it will be played.
Companies and authorities need an approved legal basis for processing in order to record telephone calls and thus collect personal data. For example, personal data can be collected and stored if there is a customer relationship between the parties or the processing is required for the performance of a statutory duty. Certain sectors, such as Emergency Response Centres, are subject to regulations that require them to record their telephone calls.
Companies have the right to record telephone conversations with customers in order to verify the transaction (e.g. recording an order placed by a consumer). Authorities can also record calls if they have a legal basis for processing the personal data. Recordings made in connection with the activities of authorities are also official documents as referred to in the Act on the Openness of Government Activities. Official documents are public unless otherwise required by the processing phase of the case, grounds for confidentiality or another Act.
The conversation partner must always be informed of the collection of personal data (incl. recording the call). The manner of this notification is left to the discretion of the controller. The controller must inform the conversation partner of the recording, i.e. the collection of data, at the start of the call. A simple mention on the website will not suffice, as the information may not reach everyone.
A voice recorded in a recording of a telephone call is personal data, and recording a telephone call constitutes processing of personal data.
The controller must always inform the conversation partner of the call being recorded, meaning the collection of personal data, before starting to record the call. Controller refers to the organisation recording telephone calls, such as a company or an authority.
A simple mention of calls being recorded on the website of the controller is not sufficient, because data subjects must be informed when the personal data is collected.
Read more:
Inform data subjects about processing
An individual's right to access their data also applies to recorded calls, since a person's voice constitutes personal data when recorded on tape if the indvidual can be identified by it.
Practically every recorded call also contains personal data related to the other person. This does not prevent the realisation of the data subject's right of access, however.
Please note that a written confirmation procedure has been adopted for telephone sales from 1 January 2023 to improve consumer protection. This means that, after making the sales call, the salesperson must send the offer to the consumer in writing or in another permanent form, and the contract is only concluded after the telephone call.
The controller is obliged to deliver a copy of the personal data being processed to the data subject. According to the current policy of the Office of the Data Protection Ombudsman, the data does not always have to be delivered in its original format if it can be delivered in another appropriate form. It is the controller's duty to assess which format is appropriate in any given case.
Depending on the circumstances, copies of recorded calls can be delivered in writing, e.g as a transcript, or electronically, e.g. as a recording. The transcript must be an accurate reflection of the content on the recording.
In addition, the controller can also offer the data subject the opportunity to listen to the recording, for example at the controller's office. However, the opportunity to listen to the recording may not be the only way by which the right to access the recorded call is realised.
A private entrepreneur has the right to access a recorded call concerning them by virtue of the right of access provided for in the General Data Protection Regulation, since a recorded voice constitutes personal data related to a natural person.