Call Center Solutions Compliance and Data Security 1 — Questions and Answers
Question 1: What does TCPA stand for and what does it regulate?
- Telecom Consumer Privacy Act — regulates data storage for call centers
- Telephone Consumer Protection Act — restricts autodialed calls, prerecorded messages, and fax marketing to consumers (Correct answer)
- Total Call Performance Assessment — a quality scoring standard
- Telephony Compliance and Privacy Agreement — a call center industry certification
Correct answer: Telephone Consumer Protection Act — restricts autodialed calls, prerecorded messages, and fax marketing to consumers
The TCPA (1991) restricts unsolicited autodialed calls, robocalls, and text messages to US consumers and requires prior express written consent for marketing calls to mobile phones.
Question 2: What is the FTC's 'Do Not Call Registry' and what does it require of call centers?
- A list of customers who want priority service, not to be confused with a suppression list
- A federal list of US phone numbers where telemarketers are prohibited from making unsolicited sales calls (Correct answer)
- A registry of call centers that have been penalized for violations
- A database of phone numbers that have opted in to receive marketing calls
Correct answer: A federal list of US phone numbers where telemarketers are prohibited from making unsolicited sales calls
The National Do Not Call Registry allows US consumers to register their numbers to block unsolicited telemarketing calls; call centers must scrub their call lists against this registry every 31 days.
Question 3: What does HIPAA require of call centers that handle healthcare information?
- All agents must be licensed healthcare professionals
- Strict protection of patients' Protected Health Information (PHI) through access controls, encryption, and audit trails (Correct answer)
- Healthcare calls must be completed in under 5 minutes
- Agents must record all healthcare calls for physician review
Correct answer: Strict protection of patients' Protected Health Information (PHI) through access controls, encryption, and audit trails
HIPAA (Health Insurance Portability and Accountability Act) requires call centers handling PHI to implement physical, technical, and administrative safeguards to protect patient data privacy.
Question 4: What is 'call recording consent' and why is it required in many US states?
- Customer permission to use their call feedback in marketing materials
- Legal requirement in some US states for all parties on a call to be informed and consent before the call is recorded (Correct answer)
- Agent agreement to have their performance calls reviewed by QA
- FCC requirement to retain call records for seven years
Correct answer: Legal requirement in some US states for all parties on a call to be informed and consent before the call is recorded
Under 'two-party consent' (or 'all-party consent') laws in states like California (CIPA), all parties must be notified and consent to call recording — hence the standard disclaimer at the start of calls.
Question 5: What does GDPR compliance require for US call centers that handle data of EU residents?
- Only calls to EU numbers must be recorded
- Protection of EU residents' personal data with rights including access, deletion, and explicit consent for data processing (Correct answer)
- EU customer data must be stored on servers located in the EU only
- All agents handling EU calls must be located in Europe
Correct answer: Protection of EU residents' personal data with rights including access, deletion, and explicit consent for data processing
Even US-based call centers must comply with GDPR when handling personal data of EU residents, including providing lawful basis for processing, honoring data subject rights, and reporting breaches within 72 hours.
Question 6: What is a 'data breach' notification requirement under US state laws for call centers?
- Notifying the FCC within 24 hours of any system outage
- The obligation to inform affected individuals and state authorities when customer personal data is improperly accessed or exposed (Correct answer)
- Reporting to the FTC when more than 1,000 calls are dropped in a single day
- Notifying customers when their accounts are flagged for fraud review
Correct answer: The obligation to inform affected individuals and state authorities when customer personal data is improperly accessed or exposed
All 50 US states have data breach notification laws requiring organizations to notify affected individuals (and in some states, regulators) within a specified timeframe when their personal information is compromised.
