Not a phone problem – a consent problem

A consultant recently told me he wanted to jump ship to Android from iOS for one reason: so he could record and transcribe his business calls, shovelling them into an app like Granola. It’s definitely being normalised, a recent WSJ piece notes that people are now doing this on dates! We have arrived, once again, at the point where a convenience feature for one party is a surveillance feature for everyone else.

But, the question isn’t which phone lets you record more easily. It’s whether the person on the other end knows you’ve turned them into training data.

The rules vary across Europe. In Belgium, where I’m based, if you’re taking part in the call, recording it as such isn’t a crime. Eavesdrop on a conversation you’re not part of, on the other hand, and the law gets much less relaxed. So our consultant's in the clear, criminally, for the recording itself.

Hop the border into Germany or France, for example, and that evaporates: recording someone without their consent is a criminal offence there.

But here's where it gets interesting. GDPR sits on top of all of this like a second, stricter landlord who doesn't care what the first landlord told you. The moment you capture someone's voice, their words, their opinions – that's their personal data, and it became their personal data the instant your app started listening.

Them not knowing about it isn't a technicality you can route around. "Legitimate interest”, the GDPR's favourite fig leaf, the one everybody reaches for when they'd rather not ask permission, doesn't cover you here either.

The moment that recording starts, our consultant legally is the data controller. Him – not Granola (there are differences in a personal vs business context, we’re assuming business here. No hiding behind "it's just for me.").

This means he’s exposed twice: the data protection authority can fine him directly and the other person can sue him separately under plain old tort law (Article 1382 – I looked it up), no regulator involved.

Granola, meanwhile, is nowhere to be found in either of those fights. He ticked a checkbox confirming he had all necessary consents, and that checkbox is doing exactly what it was designed to do: moving the liability off the platform's balance sheet and onto his.

So, switching phones doesn’t get him out of anything. It’s not a hardware problem. We just come back to the same old question: does the other person know, and did they actually, clearly, explicitly say yes?

Colin