Managing privacy risks in call centres

Posted by Veronica Scott ● Partner: Charles Alexander

The work of call centres involves collect, processing and disclosing a large range of personal information, including sensitive and financial information. Staff working at the centres have direct access to this information. Organisations that run or use call centres need to identify and manage risks to minimise privacy breaches.

Weaknesses range from high staff turnover and lack of privacy training to human error and lax security processes. Threats include for example third party middlemen who use staff to gain access to data which they then sell to create new false identities. They may for example engage staff in a social setting, find out what they do and who they work for and then offer cash for receiving details about customers' identities.

Robust and regular privacy training and risk management processes, together with good record keeping, are crucial to managing these issues and for enabling potential issues to be identified early and escalated. It is important to conduct regular audits and spot checks to identify and track unusual activity and for early detection of privacy breaches. Conducting regular Privacy Impact Assessments will support these processes.