This page is general information, not legal, tax or financial advice. Talk to a qualified professional about your situation.
A call center or BPO can license its own operational records (QA rubrics, training, scheduling, internal communications) more easily than customer interactions it handles for clients. Tickets and transcripts are exactly the conversational data AI developers want, but in most outsourcing contracts they belong to the client, and under California’s privacy law a service provider’s contract must prohibit using personal information for any purpose other than the business purposes in the contract (Cal. Civ. Code 1798.140(ag)(1)(B)). Payment card data is excluded outright: the PCI Security Standards Council says storing card validation codes in audio recordings after authorization violates PCI DSS.
Records and how they are usually treated
| Records | Usually | Why |
|---|---|---|
| Call recordings and chat logs handled for clients | Only with each client’s written permission | Client-owned data; service provider limits |
| Anything with card numbers or security codes | Exclude | PCI DSS; recordings with security codes should not exist |
| Tickets and transcripts from your own in-house support | Possible, after de-identification | Your own customer data, under your privacy policy |
| QA scorecards, coaching notes, scripts, knowledge bases | Often possible | Your work product, once client names are removed |
| Workforce management and scheduling data | Possible | Operations data; employee data needs de-identification |
| Internal email and chat | Possible, after review | Scrub client specifics |
Before you apply
- Sort data by owner: your own operations versus each client’s interactions.
- Read each client contract for data ownership, use restrictions and deletion duties at the end of the engagement.
- Find and purge card data before anything leaves your systems.
- Check how calls were recorded. In California, Penal Code 632 requires the consent of all parties to record a confidential communication; other states have their own rules. Recordings made without proper consent should stay out.
micro1 names customer support tickets among the operational records it licenses; the table below shows who takes the industry and their size rules.
Which buyers take this industry
| Buyer and program | Industry rule | Company minimums | Operating or closed |
|---|---|---|---|
| micro1: Enterprise Data Partnership | No industry limit in the buyer’s published rules | 30+ full-time employees and substantial historical data; several years of records across systems is a stronger fit. No fixed minimum file count or size. | Both. Operating companies apply to the Enterprise Data Partnership; companies no longer operating apply to the Defunct Company Data Partnership. |
| micro1: Defunct Company Data Partnership | No industry limit in the buyer’s published rules | 30+ full-time employees and substantial historical data; several years of records across systems is a stronger fit. No fixed minimum file count or size. | Both. Operating companies apply to the Enterprise Data Partnership; companies no longer operating apply to the Defunct Company Data Partnership. |
| Nyne: Company data licensing | No industry limit in the buyer’s published rules | 20+ full-time US W-2 employees and 3+ years in business, plus a decision maker who can approve the licence | Operating companies only |
| Mode: Company data partnership | No industry limit in the buyer’s published rules | 10+ employees for legal; 15+ for accounting, medical and finance; 50+ for all other businesses. Several years of records you own make a stronger fit. | Not stated. Mode says businesses and nonprofits can qualify. |
| Troveo: Business data licensing | No industry limit in the buyer’s published rules | Not stated | Not stated |
Questions people ask
Whose data is it, ours or our clients'?
In most outsourcing contracts, the customer interactions belong to the client and you process them on its behalf. If you are a service provider under the CCPA, your contract must bar using that personal information outside the contracted business purpose. Your own internal records are a different matter.
Are call recordings with card numbers a problem?
Yes. The PCI Security Standards Council says storing card validation codes in digital audio recordings after authorization violates PCI DSS. Those recordings should not exist, and they must never be part of a licence.
Sources
- PCI Security Standards Council FAQ 1210: Are audio/voice recordings permitted to contain sensitive authentication data?
- PCI SSC Information Supplement: Protecting Telephone-based Payment Card Data (PDF)
- Cal. Civ. Code § 1798.140: CCPA definitions (California Privacy Protection Agency, PDF)
- Supreme Court of California, Smith v. LoanMe (quotes Penal Code § 632) (PDF)
- micro1: Monetize your company's operational data