Recording calls: the SWDE case and what the CNPD expects in Luxembourg

At a glance — On 12 May 2026, Belgium’s DPA (APD) fined SWDE €86,000 for non-compliant call recordings/listening (notice, legal basis, retention). In Luxembourg, the CNPD strictly frames recordings of meetings/calls: upfront notice, precise legal basis, limited retention.

The case

On 12 May 2026, the Belgian DPA’s Litigation Chamber issued decision 102/2026 against Société wallonne des eaux (SWDE). It imposed two fines totalling €86,000 and an order to comply, concerning the recording and monitoring of inbound calls to the call center (2018–2022). Findings include: lack of transparency for callers and employees, absence of an Article 28 GDPR processor agreement, “test” recordings without a legal basis, and procedures failing to ensure deletion within one month required by Belgium’s “call center” e-communications exception. The APD also sanctioned an unsuitable legal basis (public task) and the lack of an effective right to object. An appeal is pending before the Market Court, but the decision details the applicable requirements. See the APD press release and decision 102/2026: autoriteprotectiondonnees.be and decision 102/2026 (PDF).

Why does this matter in Luxembourg? Because the same GDPR provisions (Articles 5, 6, 12, 13, 21, 28, 30, 32) apply, and because the CNPD has issued practical guidance on recording meetings and professional conversations, along with reminders on Luxembourg’s ePrivacy regime: cnpd.public.lu.

Legal reasoning

1) GDPR legal basis (Article 6) and local ePrivacy

Recording calls/meetings is processing (voice, sometimes opinions, incidentally sensitive data). It requires an Article 6 GDPR basis. The APD rejected broad reliance on Article 6(1)(e) (public task) for quality/training and strictly framed use of legitimate interest (Article 6(1)(f)), in line with EDPB Guidelines 1/2024: a real and present interest, necessity, and a documented balancing test. See decision 102/2026 and EDPB 1/2024.

In Luxembourg, the CNPD recalls that for electronic communications, Article 4(3)(d) of the amended law of 30 May 2005 (ePrivacy LU) allows recording only (i) with prior consent, or (ii) for lawful business uses to prove a transaction or other commercial communication — subject to clear prior notice. For quality/training, legitimate interest may be considered if necessity is demonstrated and safeguards are effective (disablement, alternative channels, minimisation). See CNPD guidance (PDF).

2) Transparency and participant notice (Articles 12 and 13 GDPR)

In SWDE, the APD sanctioned deficient and hard-to-access information (internet-dependent), breaching Articles 12 and 13 GDPR. In Luxembourg, the CNPD requires explicit notice before and at the start of each recorded call/meeting: audio/visual prompt, purposes (evidence, quality/training), legal basis, recipients, retention, rights, and DPO contact. For meetings, the CNPD explains how to ensure free consent (ability not to be recorded, pause recording when a person speaks, alternatives). See the APD decision and the CNPD file on meeting audio recording.

3) Right to object (Article 21 GDPR)

The APD noted the absence of effective modalities allowing callers to object in due time to recordings for quality/training. In parallel, the CNPD recommends, when relying on legitimate interest, an easy opt-out (IVR menu, DTMF key, alternative address, switch to a non-recorded flow), unless recording is strictly necessary to evidence a transaction. The EDPB guidelines underline the balancing test and effective safeguards. Ref.: decision 102/2026.

4) Processors and quality monitoring (Article 28 GDPR)

The APD imposed €1,000 for the prolonged absence of signed DPA clauses with a provider performing listening/evaluation. In Luxembourg, an Article 28 contract is mandatory before sharing recordings with any third party (BPO, QA provider, voice analytics SaaS). It must cover documented instructions, confidentiality, security, data subject rights assistance, sub-processing, return/deletion. See the APD decision.

5) Retention periods (Article 5(1)(e) GDPR)

Decision 102/2026 sanctioned procedures that failed to guarantee one-month deletion, a Belgian-specific condition to benefit from the “call center” exception. In Luxembourg, the CNPD expects defined, justified and announced periods; it cites short timelines for quality/training and reminds that evidence-focused recordings must be exceptional and limited. Warning: long default retention for training is rarely proportionate. See CNPD guidance (PDF).

What this changes in practice for leaders in Luxembourg

• Call centers (B2C/B2B), banks/insurers, utilities, IT helpdesks, HR/labour relations: if you record calls or Teams/Zoom meetings, you must evidence:
  • The appropriate legal basis per purpose: evidence of transaction (ePrivacy + GDPR), dispute management, quality/training (often legitimate interest under conditions), or valid consent where required. Use EDPB 1/2024 to document your LIA: edpb.europa.eu.
  • Point-of-contact notice: opening IVR message and in-meeting banner/announcement, pointing to a full privacy notice and accessible offline if the service is universal (SWDE lessons). See the APD decision.
  • An effective opt-out when relying on legitimate interest (key to switch to a non-recorded flow, alternative address, agent takeover). Ref.: decision 102/2026.
  • Purpose-specific retention, short for training (weeks to a few months), and automated, auditable purges. See CNPD references.
  • Signed Article 28 DPAs before any listening/annotation by a provider or ingestion into voice analytics SaaS; proportionate, evidenced security (Article 32). See the APD decision.

To strengthen your setup, consider a DPO mandate and GDPR governance and align with CNPD compliance in Luxembourg for your use cases. If needed, contact us.

Recorded meetings (boards, interviews, labour relations)

The CNPD details how to ensure “free” consent (ability not to be recorded without detriment, clipping/pausing options, non-recorded alternatives). In practice, do not enable recording by default; display the recording indicator and log triggers. CNPD file: recording of meetings.

Common pitfalls seen in audits

1. “We record everything to protect ourselves”: blanket, non-targeted recording for “quality/training” without a solid LIA fails necessity; upon challenge, it becomes indefensible. See EDPB 1/2024: guidelines.
2. Notice only in a web policy: if full information depends on internet access for a public service (e.g., water utility) — as sanctioned by the APD — you miss Articles 12/13. Add in-call/in-meeting prompts and offline materials. See the APD press release.
3. No functional opt-out: announcing a right to object without a button/key/alternative line makes it theoretical and often insufficient. Ref.: APD decision.
4. Weak DPA with the listening/scoring provider: SWDE shows a complete Article 28 contract is non-negotiable, even for “simple” QA. See the decision.
5. “Habit-based” retention: copying generic periods (e.g., 12 months) without purpose linkage or automatic purge risks sanctions. The CNPD expects short, justified timelines for quality/training; if needed, separate “evidence” (short, strictly necessary) from “training” (anonymised examples). See CNPD.

Official sources

• APD (Belgium) — Press release “The Litigation Chamber imposes fines” (12 May 2026) + SWDE 102/2026: autoriteprotectiondonnees.be and decision 102/2026 (PDF).
• CNPD (Luxembourg) — File “Audio recording of meetings”: cnpd.public.lu.
• CNPD (Luxembourg) — Guidance on phone/e-communications recordings and retention: lawful basis & retention and PDF.
• EDPB — Guidelines 1/2024 on legitimate interest: guidelines and announcement.

Bottom line: SWDE shows that “default” recording of calls/meetings without point-of-contact notice, effective objection, and robust DPAs is now high-risk in Europe. Luxembourg organisations should align with CNPD expectations: strict purposes, evidenced legal basis (LIA), in-call/in-meeting notice, short, auditable retention, and locked-down processing agreements.

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.