GDPR-Compliant Meeting Transcription

This article is not legal advice.

Automatic transcripts and summaries are among the AI applications whose benefit is felt immediately. Nobody has to take minutes in parallel any more, decisions and tasks are documented after the meeting, and anyone who was absent can catch up. At the same time, a recording interferes with the rights of all participants. Anyone recording meetings should know the legal framework before clicking "Record".

Criminal law: Section 201 StGB and the confidentiality of the spoken word

The most important starting point lies not in data protection but in German criminal law. Under Section 201(1) of the German Criminal Code (StGB), anyone who without authorisation records another person's non-public spoken words on a sound carrier, or uses such a recording or makes it accessible to a third party, is liable to punishment. The penalty is imprisonment of up to three years or a fine.

Internal meetings, customer appointments and video conferences are, as a rule, non-public. A covert recording is therefore not a formality but a serious risk. In practice this leads to a clear rule: only record when all participants know about it and agree. This applies even if the recording is "only" intended for a transcript.

Data protection: legal basis under Art. 6 GDPR

Voices, names and conversation content are personal data. You therefore need a legal basis under Art. 6(1) of the GDPR for recording and transcription. The main options are:

• Consent (point a): This is the obvious route when external guests take part. Consent must be freely given, informed and unambiguous and, under Art. 7(3) GDPR, can be withdrawn at any time. In an employment relationship, voluntariness must be examined particularly carefully because of the relationship of dependence.
• Legitimate interest (point f): A legitimate interest may exist for documenting internal meetings. It must be balanced against the interests of the participants; you should document this assessment.
• Collective agreements: For employees, a works agreement under Art. 88 GDPR can govern the processing and provide legal certainty.

Regardless of the legal basis, Section 201 StGB must still be observed. The criminal-law question of whether a recording is "authorised" is usually resolved in practice through the consent of those involved.

Information duties under Art. 13 GDPR

Anyone collecting personal data must inform the data subjects under Art. 13 GDPR – at the time of collection. For meeting recordings, this means participants should know before the start who is responsible, for what purpose the meeting is recorded and transcribed, on what legal basis, who will have access, which service providers are involved, how long the data will be stored and what rights they have.

Three elements have proven useful in practice:

1. a short note in the invitation that the meeting is to be recorded and transcribed,
2. a verbal announcement at the start with the opportunity to object,
3. a link to a detailed privacy notice.

If someone objects, you should not record. Have a simple alternative ready for this case, such as conventional minutes.

Meetings with external guests, such as customers or applicants, require particular care. They do not know your internal rules and have no access to the privacy notices on your intranet. Ask explicitly before the recording starts, and keep a traceable record of their agreement.

Works council: co-determination under Section 87(1) No. 6 BetrVG

If your company has a works council, under Section 87(1) No. 6 of the German Works Constitution Act (BetrVG) it has a right of co-determination regarding the introduction and use of technical devices designed to monitor the behaviour or performance of employees. According to the case law of the Federal Labour Court, it is sufficient that a device is objectively suitable for monitoring. Software that records conversations and assigns them to speakers will as a rule meet this criterion.

Involve the works council early. A works agreement can define in which meetings recording is permitted, who may see transcripts, that no performance or behaviour monitoring takes place and when recordings are deleted.

Storage, access and deletion

Under the principle of storage limitation (Art. 5(1)(e) GDPR), data may only be stored for as long as necessary for the purpose. For meeting recordings this means:

• Define the purpose: If the goal is a record of the meeting, a transcript and summary are often enough. Check whether the original recording is still needed afterwards.
• Set deletion periods: Define when recordings and transcripts are deleted, and implement this technically.
• Restrict access: Transcripts should by default only be visible to authorised persons. Sharing with others should be a deliberate step.
• Enable data subject rights: Access, rectification and erasure under Art. 15 to 17 GDPR must also be possible for transcripts.

Checking the provider

Most companies use an external service for transcription. The provider thus usually becomes a processor. Before use, check:

• whether a data processing agreement under Art. 28 GDPR is in place,
• which sub-processors are involved for storage, speech recognition and summarisation, and at which locations they process data,
• whether there is a sound basis under Art. 44 et seq. GDPR for any transfer to third countries,
• whether recordings or transcripts are used to train models,
• which roles and sharing options the tool offers and how deletion works.

For extensive or systematic recording, you should also check whether a data protection impact assessment under Art. 35 GDPR is required. Find more fundamentals in our guide to GDPR and AI.

Checklist before the first recording

1. Define and document purpose and legal basis.
2. Involve the works council, where one exists.
3. Prepare a privacy notice and link it in invitations.
4. Obtain the agreement of all participants at the start.
5. Check the provider's DPA, sub-processors and processing locations.
6. Define access rights and deletion periods.
7. Add the meeting procedure to your records of processing activities.

Meeting recording with AIPE

With meeting recording in AIPE, you record meetings in AIPE Desktop or in compatible desktop browsers. The microphone and the shared computer audio are captured, so the voices from the video conference also end up in the transcript. Directly beside the record button, AIPE displays a notice on participant consent; by clicking "Record" you confirm it. Informing the participants remains your responsibility.

After the meeting you receive a transcript with speakers, whose names you can edit, and an automatic summary with topics, decisions, tasks and open questions. Transcript and summary can be downloaded as Markdown. New recordings start with restricted access; using permission management, you share them deliberately with people or groups in your organisation.

The service providers involved in processing are described in the data processing agreement with its list of sub-processors. Check the providers and locations there – as with any vendor – before introducing recording. If you have questions about use in your company, book an appointment.