On August 26, 2024, the Danish data protection authority (Datatilsynet) announced the publication of its decision, dated June 27, 2024, where it found that IDA Forsikring is allowed to record and analyze incoming telephone calls within the framework of data protection rules following an investigation.

Background to the decision

The Datatilsynet noted that it started the investigation on IDA Forsikring and its use of artificial intelligence (AI) to analyze customer service calls on March 1, 2023. IDA Forsikring clarified that incoming telephone calls were recorded, the audio files sent for analysis, and converted to text using self-developed speech recognition. The purpose of this, according to IDA Forsikring was to improve IDA Forsikring’s customer service.

Findings of Datatilsynet

In the decision, the Datatilsynet emphasized that the case concerns IDA Forskring recording telephone conversations and using AI for documentation and quality assurance purposes and the information they provide with regard to this.

The Datatilsynet held that the way in which IDA Forsikring obtains consent is not sufficiently granular, as only one overall consent is obtained for both documentation and quality assurance purposes and does not allow the caller to choose to consent to only one of those purposes. The Datatilsynet noted that due to it not having dealt with the collection of consent by telephone in the case of multiple purposes, it did not find a concrete reason to express criticism.

Additionally, the Datatilsynet held that when employees participate in conversations in a work-related context, the processing is valid as employee training is a legitimate purpose.

Lastly, the Datatilsynet held that the use of AI to analyze telephone call recordings is valid and is in compliance with data protection rules, as it is not covered by the prohibition under Article 9(1) of the General Data Protection Regulation (GDPR). The Datatilsynet also outlined that IDA Forsikring draws attention to the recording and transcribing of conversations, with reference to its personal data policy, in line with Article 13 of the GDPR.  

Outcomes

Following the investigation, the Datatilsynet stated that IDA Forsikring's use of AI to analyze telephone conversations must comply with data protection rules, particularly with regard to obtaining consent and the information it gives to callers. The Datatilsynet recommended that IDA Forsikring ensures that their processes are in accordance with the relevant rules.

You can read the press release here and the decision here, both only available in Danish.