When a virtual assistant joins a meeting and records the conversation without informing participants, the responsibility is first of all the responsibility for the company. As a “treatment manager” within the meaning of the GDPR, it must guarantee that any data capture is based on a valid legal basis, in practice, the explicit consent of the participants. The faulty employee can be punished, but it is the company that is exposed to regulatory sanctions. The supplier of the tool, considered to be subcontractor, can also be questioned if its system does not include sufficient consent mechanisms.
To do: Impose an advertisement script at the start of the meeting, activate zoom or team recording indicators, and favor notetakers that automatically trigger a request for consent, such as Fellow or Otter.ai.
Legal references: RGPD Articles 6 and 7 (Craftness and consent), French Labor Code (Articles L.1121-1 and L.1222-4), local laws All-Party consents in Germany or California.
Practical solutions: Adopt a clear internal policy, limit the conservation of recordings, and guarantee traceability by logs.
