Callers to IDA Forsikring, a Danish insurer, heard that their call would be recorded to improve member service and for documentation. Then they were asked to press 1 to approve, or wait.
That one key press covered two purposes. In June 2024, Denmark’s data protection agency, Datatilsynet, ruled on the set-up (journal 2023-431-0018). It treated the AI analysis as part of quality assurance. It found the consent invalid, because a caller couldn’t accept one purpose and refuse the other.
What IDA did
A processor transcribed incoming calls with speech recognition it had developed itself. The analysis checked each call against a service standard: a welcome, positive wording, a polite close. It produced an indicative quality score based on whether the standard was followed. IDA said the calls were not used to train the speech recognizer.
If you are evaluating AI call scoring, that is close to what you are looking at.
The analysis sat inside the quality purpose
IDA’s stated purpose was “improving IDA Forsikring’s member service, quality assurance”. The agency said the analysis should not be regarded as a separate purpose. It was part of the quality purpose.
So adding AI analysis to calls recorded for quality assurance did not create a new purpose. That only holds because quality assurance was named in the first place. Reusing calls for something callers were never told about is a question this decision doesn’t answer.
IDA told the agency its system doesn’t analyse tone of voice, gender or dialect. The agency noted that a system which can’t pick up tone, including sarcasm and irony, will mainly produce false positives. Where those gaps could harm people, measures must be taken against that risk.
The consent failed
The one key press covered two purposes: documenting the call, and quality assurance. The agency found the consent not granular enough to be valid: “Samtykket er derfor ikke gyldigt, og kan derfor ikke udgøre grundlag for behandling” (the consent is therefore not valid, and cannot be the basis for processing).
The agency issued no criticism. It said it had not before ruled on how to obtain consent by phone when several purposes are involved. IDA was told to fix the process: either find another lawful basis, or redesign the consent, for example with two key presses.
The two groups on a call had different bases. For callers, IDA relied on consent under Article 6(1)(a) of the GDPR. For its own employees, it relied on legitimate interests under Article 6(1)(f). The agency found no reason to override that assessment.
The agency did not assess keeping calls for up to five years, or the way to withdraw, which is to call back and ask for the call to be deleted. Don’t read approval into either.
What carries over to Norway
A Danish decision doesn’t bind Norwegian or Swedish companies. Norway’s Datatilsynet, a separate agency, says there are no separate rules for audio recordings. The general privacy rules apply, and secretly recording other people’s conversations is prohibited under Penal Code §205.
The GDPR applies in Norway and Sweden too, so the same logic holds. Name each purpose, choose the lawful basis for each, and where consent is the basis, ask for it once per purpose.
A checklist before you score calls with AI
- Name every purpose the recording serves: documentation, quality assurance, coaching, statistics. Write down whether AI scoring falls under quality assurance, and why.
- Pick a lawful basis per purpose and per group. IDA used consent for callers and legitimate interests for employees. Datatilsynet pointed it to other bases as well as to better consent.
- If you rely on consent, ask for it once per purpose. A caller must be able to say yes to documentation and no to quality assurance.
- Describe what the system analyses in one sentence a caller would understand, and say what it leaves out.
- Plan for scores that are wrong. Decide who checks a score, what evidence they see, and how an agent challenges it.
- Set a retention period for each purpose, and write down how deletion works.
- Test withdrawal before launch. Call in, ask to be deleted, and check that the recording and the transcript are both gone.
Then play your own recorded greeting and count the purposes. If it names two or more and asks for one key press, it has the problem Datatilsynet found.
Where Conversational Intelligence fits
Conversational Intelligence scores the transcript. Language models see text, never audio, and nothing is used for training. Tone and empathy criteria on a scorecard are judged from what was said. Every score links to the sentence, timestamp and speaker behind it, so a reviewer can check the evidence, and an agent can dispute a score for a person to decide.
The consent wording and the purposes it covers are yours to set. We’ll help you check them against your own rules.
