Transcription assistants in meetings
Having a meeting transcribed automatically touches three areas of law at once: criminal law, employee data protection and works council participation. Agreement in the chat window satisfies none of them.
Note-taking assistants are one click away in most conferencing systems. That click turns into a recording of the spoken word, an attribution of statements to individuals and a searchable text that outlives what was said. Which is exactly why introducing one is a decision and not a setting.
Three questions to answer at the same time
Criminal law
- The non-public spoken word is protected under German criminal law
- Recording without the consent of everyone involved can be a criminal offence
- Whether a tool records or only transcribes live makes a difference and has to be settled case by case
- Where professional secrets are involved, the protection of private secrets is added
Data protection
- Voice, content and attribution are personal data
- Consent in an employment relationship is precarious because of voluntariness
- Purpose, retention, deletion and access to transcripts have to be settled
- Processing agreements and possible third-country transfers are added
Works council
- A tool attributing contributions to individuals is capable of monitoring conduct
- Participation applies regardless of intention
- A works agreement can supply the legal basis at the same time
- Without involvement, ongoing use can be prohibited
Speaker recognition: where Art. 9 GDPR comes in
Whether special categories of personal data are processed does not turn on a voice being audible, but on where the attribution to a person comes from.
Usually no Art. 9
- The tool only separates voices and labels them speaker one and two
- Names come from the conferencing accounts, not from the voice
- No voice profile is created that serves to recognise people beyond the meeting
- Art. 6 GDPR applies, the requirements are demanding but can be met
Art. 9 applies
- The tool builds voice profiles and recognises people by them
- The attribution therefore comes from the biometric characteristic itself
- Biometric data is processed for the purpose of unique identification
- On top of a legal basis, an exception under Art. 9(2) GDPR is required
The difference matters. Where Art. 9 GDPR applies, legitimate interests will not carry the processing. What remains in practice is explicit consent, and in an employment relationship that is the weakest of all bases because of voluntariness. The employment law exception does not help here, because transcribing does not discharge any obligation under employment law.
That makes one plain question worth asking any provider before selection: are voices merely separated, or are people recognised? The answer determines everything that follows.
Which legal basis applies
For the standard case without voice profiles three routes come into consideration, and they are not equally robust.
Legitimate interests is the obvious route for minutes kept in the company own interest. The balancing is demanding, however, because a searchable verbatim record carries considerable monitoring potential. Anyone taking this route should document the balancing in writing and set out the limits within it.
A works agreement is the cleanest route where a works council exists. As a collective agreement it can carry the data protection basis and settles participation at the same time. That presupposes it genuinely reflects the substantive requirements of the GDPR rather than merely permitting the tool.
Consent is the weakest basis, because its voluntariness in an employment relationship is doubtful. It remains indispensable nonetheless, because the criminal law side requires the agreement of everyone involved. The two are not the same thing, however, and should not be collapsed into a single click.
On top of that, anyone deploying a system that interacts with people or generates content may be subject to transparency obligations. So if an assistant does not merely transcribe but evaluates mood, speaking time or engagement, the legal position changes fundamentally.
What the information process should look like
Informing people is not a single announcement but a chain. It begins before the meeting and does not end when the meeting starts.
Step 1: In the invitation
The notice belongs where it still leaves a choice. Anyone who only learns in the room that notes are being taken can hardly object. External participants are only reachable here in any case.
Step 2: At the start of the meeting
A further notice and a visible indicator for as long as transcription runs. The indicator matters more than the announcement, because it works throughout.
Step 3: Enable and record objections
There has to be a way to object without losing the meeting. The objection and the response to it belong in the record.
Step 4: On the output
The transcript is labelled as machine-generated, with a note on errors and misattributions. Whoever reads it later has to know it is not a verbatim record with evidential value.
Step 5: In the privacy notice
Permanently available and carrying what an announcement cannot: purposes, legal basis, recipients, retention periods and the rights of data subjects.
What belongs in the usage policy
- When transcription is permitted and when it is expressly not
- How and when everyone involved is informed, external participants already in the invitation
- How to object without losing the meeting
- Who may access transcripts and who may not
- How long transcripts and audio files are retained
- Whether inputs are reused by the provider for training
- Which meetings are excluded, such as personnel discussions and conversations with professionals bound by secrecy
- That transcripts are not used to evaluate performance and conduct
How we support you
We review the specific tool and its configuration, settle the criminal law side before the data protection side, draft the usage policy and accompany the discussion with the works council. Where a works agreement is drawn up, we frame it so that it also carries the data protection basis.
An assistant already in use?
We check whether the deployment is lawful and draft the policy for it.
Request an assessmentFrequently asked questions
Is it enough to ask at the start of the meeting?
Asking is right as a minimum, but it rarely suffices as a legal basis. Anyone asked once the meeting is under way is under pressure, and in an employment relationship the voluntariness of consent is precarious in any case. It only holds up with a policy known in advance, setting out when transcription happens, who can object and what becomes of the result.
What applies to external participants?
No internal policy reaches them. They have to know before the meeting starts that it will be transcribed, and to be able to decline without losing the meeting. In practice that means a notice in the invitation, not in the room.
Does the works council have to be involved?
As a rule yes. A tool that attributes contributions to individuals is technical equipment capable of monitoring conduct and performance. Works council participation therefore applies, regardless of whether monitoring is intended.
The tool recognises who is speaking. Is that a special category of data?
It depends on where the attribution comes from. Where the tool merely separates voices and labels them speaker one and two, there is no unique identification. Where it takes the names from the conferencing accounts, the attribution again does not come from the voice. Where it builds voice profiles and recognises people by them, biometric data is processed for the purpose of unique identification. Art. 9 GDPR then applies and the available legal bases narrow considerably.