France - New CNIL Simplified Norm related to the processing of personal data in connection with monitoring and recording employee telephone calls in the workplace
By a Deliberation n°2014-474 on 27 November 2014, and recently published in the Official Journal dated 6 January 2015, the French Data Protection Authority (the "CNIL") adopted a new "Simplified Norm 57" (the "Norme Simplifiée n°57", which allows for a streamlined and simplified self-declaration of compliance, as long as the data processing complies with the conditions set forth in said norm). This relates to the processing of personal data in connection with monitoring and recording of employee telephone calls in the workplace.
The purposes of data processing are strictly limited to employee training, employee performance and improvement in the quality of the service.
The Simplified Norm 57 applies to both public and private institutions, and only allows data processing operations that involve monitoring and recording of employee telephone calls on a periodic basis, to the exclusion of any recording on a permanent or systematic basis. Also excluded are recordings with the purpose of collecting sensitive data, any audiovisual recording, or any record linkage with data capture on employees' computers.
Data from the recording must be deleted no later than 6 months after such recording, while data from the analysis of the recording must not be kept for a period exceeding one year.
Access to recorded data and related analysis must be secured through appropriate technical and organizational measures. Transfers may occur subject to appropriate EU Commission contractual clauses, Safe Harbor Certification or BCRs.
For more information, please contact Denise Lebeau-Marianna or Magalie Dansac