Call Centers are responsible institutions where legal interactions take place every day. There is a high volume exchange of sensitive data that can lead to escalation or any litigation. Hence, call centers are also bound by laws that are set by the vendor and by the country where it’s operating from. Businesses rely on call centers to run their operations smoothly. However, all the processes are bound by SLAs and other compliance rules. Failing to adhere to these rules, results in hefty fines or other mandates by the call center.
What is Call Center Compliance?
Call Center compliance is the strict obedience to the rules and regulations set by the organization or the governing body. Sometimes the rules are set by the vendors who outsource their marketing or support operations to the call centers. On the other hand, the laws set by the governing bodies can vary for different countries.
Why is Call Center Compliance Important?
Compliance issues don’t only affect the call center, but also the customers they serve. Loss of customer data can lead to identity theft, hacked social accounts, hacked bank accounts and other unfortunate scenarios. Compliance hiccups can leave the contact center high and dry with a financial and reputational setback.
Data breaches are usually caused by fraudulent agents or by external attacks. According to IBM, the global average cost of a data breach is $3.86 million. One can state that ignorance and lack of sufficient security can lead to it. Many yesteryear employees do not understand the protocol of safe-surfing through the internet as opposed to the new-age agents. Hence, multiple loopholes can lead to the loss of essential data from the call center.
Call centers are hubs for information on thousands of employees, businesses and customers. Here’s how they are always vulnerable:
- External attacks by hackers or blackmailers.
- Internal hacker or a fraudulent employee, who has a personal agenda.
- Under-informed older employees, who are not tech-savvy and end up clicking on suspicious links on the internet.
- Temporary employees, who are less compliant but are exposed to crucial data.
To protect your call center from such threats, you must invest in your data security protocol. To prevent any internal attack or threats, assign unique IDs to all your employees. In case of any illegal act, it will be easier to track them down and hold these employees accountable.
What are the compliance practices that must be followed?
With every transaction and interaction getting digitized, contact centers are more prone to cyberattacks. It is important to secure customers’ bank data and social security details, regardless of anything. Customers can also choose to sue a business if their information is being stored or sold, without their knowledge. So, the contact center must maintain complete transparency about call recordings and screen recordings. Let’s discuss what are the necessary call center compliance practices, that must be adhered to.
1. PCI-DSS- Call Centers Cannot Record Sensitive Payment Details:
The Payment Card Industry Data Security Standard aka PCI-DSS, states that every call center is strictly forbidden from recording CVV numbers, full magnetic stripe data and PINs. The revelation of such private details might lead to any fraudulent activity, which put the bank, the contact center and the enterprise liable for it.
To prevent this from happening, the contact center must deploy any redaction software that identifies and deletes this information after any transaction or interaction. Usually, the payment card data is captured over IVR and PCI-DSS ensures that the data captured by IVR is securely transmitted to the payment gateway and no data is stored in the call center.
2. Call Centers Must Monitor Agents Who Have Access To Crucial Data:
Call center agents who engage with user sensitive data must be monitored thoroughly. Agents are after all humans and might engage in illegal acts of data leak, information tampering or stealth. Hence, agents must be assigned unique IDs so their activities can be traced. This is extremely important especially now when agents are working remotely and are not monitored at the office.
3. Call Centers Must Inform Customers That Calls/Screens Are Being Recorded:
Privacy laws are different in different countries. However, in the majority countries, it is required to inform the agent and the customer that the calls are being recorded for quality or training purposes before proceeding. This is so that the customer has full control to decide whether to have the call recorded or not. If the customer chooses to not be recorded, they can disconnect and seek self-service.
4. FDCPA or Fair Debt Collection Practice Act:
According to this US Act, contact center agents cannot threaten, harass or oppress the customers to make them pay a debt they owe. Instead, contact center agents must deploy technology and well-trained agents to collect debts from non-paying customers. They, however, must not resort to violent or primitive methods to recover the money.
Chatbots and voicebots are a smart solution for debt collection. These automated bots will never resort to anything unethical or even feel intimidated before a fraudulent customer. Instead, Chatbots and voicebots can periodically remind the debtor to pay their bills, without making it a compliance issue.
5. GDPR or General Data Protection Regulation:
This regulation on data privacy was implemented by the European government. This law was intended to protect European customers who are involved in international business transactions. The GDPR has extensive rules on data protection, international data transfer, and relevant liabilities. It doesn’t matter whether the business is located in Europe or not. As long as the customers are in Europe mainland, they must adhere to this government regulation. Failure to do so, the company might get sued and lose revenue and reputation.
6. Call Centers Cannot Share A Customer’s Health Information:
This is one of the volatile yet crucial compliances. Data breach in the healthcare industry is a rising concern. According to Verizon, data breaches in the healthcare industry have increased by 58% in the year 2021. That being said, the Healthcare Insurance Portability and Accountability Act aka HIPAA, was implemented by the US government to protect health related information of all patients.
It might be confusing as what does health related information might refer to. It usually comprises of the following:
- Medical Test Results
- Treatment Information or Diagnoses
- Prescription Information
- Social Security Number
- Demographic Information Like Birth Date, Gender or Ethnicity
- Contact Number.
In a state of emergency, customers or patients share crucial information with hospitals without thinking twice. It is their responsibility by this federal law to protect that information and prevent any possible breaches. Contact centers must train and educate their agents on such regulations, so they can preserve the interest of their customers and their respective customers. To make this possible, contact centers must invest in robust CRM systems and relevant cloud solutions that are capable of preserving user information and are HIPAA compliant.
7. Call Centers Must Restrict Solicitations Through Phone Or Automated Dialers:
Another US-only state regulation is the TCPA aka the Telephone Consumer Protection Act. It prohibits the call center to engage in any solicitations via the phone or any other automated phone system. The rule extends to robocalls as well.
Here are the regulations set under TCPA:
- The DND registry must be honoured for five years before recalling the numbers.
- Robocalls and Prerecorded calls are barred.
- Agents must always disclose their call intent and their identity.
- Customers have complete authority over whether they should be called or not. Customer’s consent is retained when the user changes their device.
Conclusion:
Call centers are required to follow these regulations as instructed by the state and the industry. Failing to meet these requirements can land any contact center and its partnering businesses in legal trouble. It is a huge blow to the contact center and its accomplices.
The ideal way to avoid compliance escalations - be informed and keep informed. Ensure that your agents are regularly trained on all the relevant compliances. Also it is very important to use the software and tools that are compliant to the aforementioned regulations.
