If a company notifies you that calls may be recorded, can you record the call? Assuming a two-party consent state. If a company notifies you that all calls are (or may be) being recorded, can you then record your conversation with the customer service representative without notification? Rationale: notification has already been served and there can be no assumption of privacy on the CSR's part.
It depends on how the law is worded. CA Penal Code 632 says: (a) A person who, intentionally and without the consent of all parties to a confidential communication, uses an electronic amplifying or recording device to eavesdrop upon or record the confidential communication, whether the communication is carried on among the parties in the presence of one another or by means of a telegraph, telephone, or other device, except a radio, shall be punished by a fine not exceeding two thousand five hundred dollars ($2,500) per violation, or imprisonment in a county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment. If the person has previously been convicted of a violation of this section or Section 631, 632.5, 632.6, 632.7, or 636, the person shall be punished by a fine not exceeding ten thousand dollars ($10,000) per violation, by imprisonment in a county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment. [...] (c) For the purposes of this section, “confidential communication” means any communication carried on in circumstances as may reasonably indicate that any party to the communication desires it to be confined to the parties thereto, but excludes [...] any other circumstance in which the parties to the communication may reasonably expect that the communication may be overheard or recorded. [emphasis added] If you're told that a conversation may be recorded, then you can reasonably expect that the conversation may be recorded, so the California law would not apply to it. A further issue is interpretation of "may". It is ambiguous as to whether it means "might" or "can". If the other party says "This call may be recorded", and "may" is interpreted as "can", then the other party has consented to the call being recorded. A case where the passive voice could have significant consequences; if they were instead to say "We may record this phone call", then, depending on the state law, things might be different.
They likely can. This information would likely fall under an NDA (Non-Disclosure Agreement) clause in the contract with the contracting company. The other clients of the contracting company could be considered confidential information, e.g., a client list, which can be covered by an NDA. An NDA will usually have a term for duration and a term for breach consequences. However, it is unlikely that an NDA would apply to prevent disclosure of other companies if the contracting company posts [all? | some?] of their clients publicly, such as in advertisements or blog posts online. For some more information, you may check out this post from LegalTemplates.
As far as I can tell, there is no exception under the MA wiretapping law to allow for businesses to record phone calls without both parties' consent. The one possible exception is for financial institutions, and even then, notice has to be provided regularly. B. Definitions. As used in this section: ... The term ''interception'' means to secretly hear, secretly record, or aid another to secretly hear or secretly record the contents of any wire or oral communication through the use of any intercepting device by any person other than a person given prior authority by all parties to such communication; ... The term ''person'' means any individual, partnership, association, joint stock company, trust, or corporation, whether or not any of the foregoing is an officer, agent or employee of the United States, a state, or a political subdivision of a state. ... The term ''financial institution'' shall mean a bank, as defined in section 1 of chapter 167, and an investment bank, securities broker, securities dealer, investment adviser, mutual fund, investment company or securities custodian as defined in section 1.165-12(c)(1) of the United States Treasury regulations. C. Offenses. Interception, oral communications prohibited. Except as otherwise specifically provided in this section any person who willfully commits an interception, attempts to commit an interception, or procures any other person to commit an interception or to attempt to commit an interception of any wire or oral communication shall be fined not more than ten thousand dollars, or imprisoned in the state prison for not more than five years, or imprisoned in a jail or house of correction for not more than two and one half years, or both so fined and given one such imprisonment. .. D. Exceptions. Permitted interception of wire or oral communications. It shall not be a violation of this section: ... f. for a financial institution to record telephone communications with its corporate or institutional trading partners in the ordinary course of its business; provided, however, that such financial institution shall establish and maintain a procedure to provide semi-annual written notice to its corporate and institutional trading partners that telephone communications over designated lines will be recorded. Given the complicated nature of interstate wiretapping laws, it would be well worth your while to consult with legal counsel before you start recording callers from Massachusetts (or, indeed, anywhere out of your own state.) The most important quote in that article is, I think, this one: [O]ur research led us to conclude that the law is still developing in this area and that much uncertainty remains.
Is there any way I can defend myself against penalties when mistakes are made in my favor? Another option, in a similar vein to your suggestions, is to make a contemporaneous record of the conversations. Then send an email* to the public official detailing what was said and agreed, along with a request that they reply with any observations or amendments within a certain time frame. That way you have a date-stamped document properly addressed to the other party to use as evidence or leverage. *or a recorded delivery letter etc
It is absolutely not the case that Providers are not allowed to keep PII without consent. Article 6 of the GDPR identifies six possible lawful bases for processing personal information. These are: (a) the data subject has given consent ... (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks. If a person requests services from an online service provider, basis (b) will apply, at least to some information. If there is evidence of criminal activity, basis (c) may well apply, as it also will for much routine record keeping. Any in many such cases, basis (e) or (f) will also apply. In short, article 6 does not create a &quot;haven for online criminals/hackers&quot;. In a comment on another answer the OP writes: The offender has the right to not be identifiable and he can't be denied this right That is simply not correct. Nothing in the GDPR says anything of the sort. It is true that consent may not be forced, but if a user requests a service that service may require the user to identify him- or herself. For example, one cannot order physical goods without giving a name and a shipping address. And the provider may retain PI and even PII when it has a &quot;legitimate interest&quot; in doing so, although if challenged it must justify that legitimate interest.
The question is rendered moot because Cal. Civ. §1798.100 declares that Any provision of a contract or agreement of any kind, including a representative action waiver, that purports to waive or limit in any way rights under this title, including, but not limited to, any right to a remedy or means of enforcement, shall be deemed contrary to public policy and shall be void and unenforceable. This section shall not prevent a consumer from declining to request information from a business, declining to opt out of a business’s sale of the consumer’s personal information, or authorizing a business to sell or share the consumer’s personal information after previously opting out. You can fail to request such information, and you can tell a business that you don't plan to ever exercise that right, but you cannot be bound by such promises, which is to say, this is an un-waivable right. For another right, you might be able to waive that right. Your 5th amendment rights can be waived, but we would have to know more of the circumstances to know if that was a knowing and intelligent waiver.
The GDPR does not outlaw such processing of personal data. It merely regulates how and for what purposes you can process personal data. In general, you can conduct any processing activity as long as it has a clear purpose and a legal basis. Here, the purpose would likely be something like “conducting business with my clients” and the legal basis would be a “legitimate interest”. A legitimate interest always requires a balancing test that weighs your interests against the interests and rights of the affected persons. For example, can the affected persons reasonably expect such processing activities? In a professional setting, it can probably expected that business partners keep notes about contact persons so your intended processing could be fine. The GDPR does impose some general constraints. There are general principles like data minimization and storage limitation – you should only collect data that is necessary for your purpose, and shouldn't store it for longer than necessary. You should think about appropriate technical and organizational measures (TOMs) to protect the processing activity, for example about how your CRM is hosted, how backups are made and how security updates are installed, who has access to the personal data, and how the people with access to the personal data can be trained. For example, such training might inform your employees that they can only use the data in the CRM for business purposes, but absolutely not for personal purposes like asking Gina from reception out for a date.
You asked the rep about how to change some details on your account, and asked him about the cost. It is clear from the recording that you are not changing anything right now. I can't see anything where you state that you want to enter a contract right now, I can not see anything where the rep indicates they want to enter a contract right now. In other words, no contract has been formed. The rep did tell you that a name change will not increase the phone plan price. That was a promise. It was a verbal promise, and you have evidence that the promise was made. Your contract will determine whether the company is bound by such a verbal promise. If you change the name on the contract, with nobody mentioning a price increase, and the price increases, you can surely complain that you were misled and wouldn't have changed the name if you had known about the price increase. However, if you get told that the price will increase before the name change, and you quote the previous promise, I don't think that will force the company to allow a name change without price increase, because your phone conversation didn't create a contract.