Belgian Water Utility Fined €86,000 for Unlawful Call Recording Practices

SWDE violated fundamental GDPR principles by systematically recording calls without proper transparency or consent mechanisms. The utility failed to inform data subjects before recording commenced and didn't provide adequate means for objection. Additionally, they lacked proper data processor agreements, demonstrating poor data governance. This case highlights how operational practices like call recording can become major compliance violations when privacy requirements are ignored.

Tactical Insight

Immediate actions

Implement clear audio notifications before any call recording begins
Establish opt-out mechanisms allowing callers to refuse recording
Execute formal data processing agreements with all third-party processors

Policy improvements

Develop comprehensive privacy notices explaining call recording purposes and legal basis
Create data subject rights procedures including access, deletion, and objection processes
Establish regular GDPR compliance audits for all data processing activities

Governance measures

Assign dedicated data protection officers to oversee compliance programs
Implement privacy-by-design principles in all customer-facing systems
Maintain detailed records of processing activities as required by GDPR Article 30