Have I broken GDPR

[Muchhelp]

Hello everyone I need some much needed advice please im facing potential gross misconduct in work for breaching gdpr here is what happened.

I work of a night time as security in a student halls and at 2am a girl mentioned a student threatned her and asked me to go up and talk to him now we DO have a company recoeding device but i couldnt find it so i put my phone in my pocket on record to protect my self incase they threatned me or accused me of being violent WHICH they have!. How ever the recording proves my innocence. The footage has no names or personal information mentioned just a conversation how ever i reported that i used my own phone after the complaint and now face gross misconduct i havent put the information anywhere except on my phone. My company gdpr policy states no where i cant use amy personal device to record a conversation i only done it as i couldnt find the one provided incase of me being attacked or accused. I thought i was within right as my policy doeant state i couldnt. Any advice would be hugely appreciated as i dont wish to lose my job thank you.

[Muchhelp]

Sorry for the bad spelling my phone is a nightmare to type on!

[dslippy]

Sorry, but I read your statement twice and came out thinking that your company GDPR policy forbids you using a personal recording device, and only on the third did I consider that you might be saying the opposite!

There may be a requirement to comply with the law generally, which would include a duty to follow GDPR.

[Muchhelp]

yeah my company policy doesnt forbid it specifically or mention it

[ULA]

My understanding of GDPR regulations is that the requirement around recording conversations became much higher and that you need to get consent to a conversation being recorded. That is why when you phone companies these days they warn you that the call/conversation may be recorded at the start.

You may have a defence, in that the company's policy did not clearly set out in any detail about recording conversations with students you interact with and that GDPR is complex and how were you supposed to know this fact.

How long have you been employed there?

[efpom]

If my understanding is correct, the recording on the OP's phone remains on his phone and has not been shared with his employer. What he did was report the incident to his employer and advise it that he was in possession of the recording. That does not seem to me to be any form of data processing of the recording, and thus the GPDR is not in play.

[R0b]

To Ula's point, consent is not required to record a conversation, so long as there is a legal basis for doing so. Just as a sidenote, there are specific regulations that allow businesses to record calls specifically for training and monitoring purposes outside the GDPR.

Also, to Efpom's point, the recording of the conversation is itself a processing activity, so the UK GDPR is in scope. If the call recording is yet to be shared, then the OP may be able to rely on the exemption that the recording has been for personal use. The other option may be to rely on legitimate interest in that someone has allegedly been threatened by another, and it was appropriate to record the conversation to protect all parties involved in the absence of the company recording device.

[efpom]

"Also, to Efpom's point, the recording of the conversation is itself a processing activity"

Gosh - I did not know that!