How to navigate video conference recording privacy
Video conferences are convenient for companies whose employees are working remotely due to COVID-19, but now they must determine how to deal with recording and privacy concerns.
As the world shifted to remote work due to COVID-19, many companies quickly adopted video conference platforms -- such as Microsoft Teams, Zoom, Skype for Business and Cisco Webex -- out of necessity to keep in touch with team members, but without thinking about the potential legal implications.
When the host of a meeting records a video conference, the organization must decide where the recording should live, who should have access to it and how long it should be kept.
"All of those [decisions] shouldn't be [made and placed in] a black box where the recording goes in and no one knows anything about how long it's kept, or who has access to it," said Nick Barber, senior analyst at Forrester Research. "There needs to be guardrails and communication in place of the people who are being recorded."
Options to store video conferencing content
There are many options to choose from in terms of video conferencing software; however, Microsoft Teams is the primary video conferencing platform that Biz Technology Solutions, a North Carolina-based consulting firm, uses daily.
"[In] the last six months I've traveled one time, and the rest of the meetings have been completely virtual with video systems or video in Teams," said Reda Chouffani, consultant and co-founder of the firm.
Nick Barber
Microsoft Teams has built-in recording functionality for these meetings. After the recording is complete, Teams posts the video recording to Microsoft Stream, which is the video hosting platform -- much like Vimeo or Brightcove -- that Microsoft 365 offers.
Through Microsoft Stream, users can like videos, track the views and share them with other users. The video recordings have short links that are only accessible to users that subscribe to the Microsoft 365 platform, and specifically to the employees within the organization itself, Chouffani said.
At the Ignite 2020 conference, Microsoft announced that SharePoint would host all Microsoft Stream content. By moving all videos to SharePoint, users have improved permission management and control over content.
Zoom users can record video conferences and save them to their desktops or a cloud platform -- Zoom uses a mixture of Oracle and AWS cloud infrastructure, as well as its own in-house servers -- by choosing either "Record on this computer" or "Record to the cloud" at the bottom of the video conferencing screen. Users can also save a recording to their computer, then upload it to a third-party cloud storage option, a video streaming service such as Google Drive, YouTube or Vimeo or a content management system. However, users cannot upload a local recording to Zoom's cloud -- they must use cloud recording.
Reda Chouffani
If a user records a Zoom meeting locally, the recording is saved on the user's desktop in its own folder. If a user records a Zoom meeting to the cloud, he or she can access it by signing into the Zoom web portal.
Zoom integrates with a video platform, Panopto, which enables users to upload Zoom recordings to the Panopto video cloud and access them within a video library. Panopto provides administrators with various options to share content and enforce retention policies. The platform also makes video recordings searchable through automatic transcription of every recording.
Determine what to record in a video conference
It may be difficult for businesses to determine the criteria for which video conferences to record. If a meeting is short, with the sole purpose of touching base quickly, a recording might not be necessary. However, it may be more valuable to record a collaborative planning session with many stakeholders.
"Having that [conference] recorded could provide value," Barber said. "[The business] can create an automated transcription of the content so that it's a searchable conversation."
Some archiving vendors, such as Smarsh, Global Relay and Proofpoint, integrate with video platforms to capture and transcribe voice recordings.
Other meetings and conversations that may be important to record include:
Interactions with clients. Recording interactions with clients can help keep track of discussions about changes to projects. If a client changes their mind, or says they didn't say something, the business can go back into the recording and correct the client.
Brainstorming sessions. When many people share ideas at once, the video conference recording could be useful to review later and use as a reference.
Kickoffs for major projects or financials. Video conference recordings can provide proof that the two parties discussed certain topics verbally.
How to deal with security and privacy when recording
After the recording is complete, you must then decide what to do with it and how long to keep it. Some Zoom offerings, such as Zoom for Healthcare, don't let people record sessions, so the business must be aware of a platform's capabilities before determining whether to record.
"I would treat [video recordings] the same as we would treat any other content," Chouffani said.
Any content within healthcare that relates to a patient and their condition must be stored anywhere from seven to 12 years depending on if the patient is female or male, Chouffani said, who works with healthcare clients in his consulting role.
Depending on the company and industry, retention policies may differ. Although the file is in a video format, the same retention rules of the organization still apply.
Cheryl McKinnon
In regulated industries, such as banking and insurance, determining what to record is challenging due to legal requirements and minimization of risks that may arise with capturing information.
"If you are a broker-dealer or you're advising on investments, there may be a requirement that your organization needs to supervise what you say," said Cheryl McKinnon, principal analyst at Forrester. "[The organization] may be watching and making sure you're not making false claims or overly aggressive promises in terms of ROI."
If the organization captures and records these conversations, the business will need to decide whether to keep them or not in case they're required for a lawsuit somewhere down the line.
When users record a video conference, they must receive consent from the other participants to record the session.
When users record a video conference, they must receive consent from the other participants to record the session. Depending on state laws, the user recording the meeting must either ask the others for permission to record or announce that they are recording. It is important for the host of the meeting to be mindful of which states other participants are in before pressing record.
Along with consent to record, businesses must also be aware of GDPR and CCPA regulation concerns. If a business records a video conference that contains sensitive information -- such as personally identifiable information, company financial information or patent information -- there may be a legal regulatory requirement to delete that information at the end of a customer engagement, McKinnon said.
"These are critical platforms to help us get through this new way of working, but some of these information governance, records retention and risk management conversations definitely need to be happening so [businesses] can make the right choices," McKinnon said.
Dig Deeper on Information management and governance
Nick Barber
Reda Chouffani
Cheryl McKinnon
