Why isn't a company's "legitimate interest" enough to justify recording customer-service calls under GDPR?

Because a person's voice is personal data, and recording is only lawful if it is genuinely "necessary" — but milder means exist (silent monitoring, test calls), so it fails the proportionality test. Explicit consent is required instead.

Two areas of law combine to block automatic recording without active agreement:

• Criminal law (§201 StGB in Germany): secretly or without authorization recording the non-public spoken word is a criminal offense. "Without authorization" means without the express permission of the conversation partner.
• Data protection (GDPR Art. 6 & 7): the voice is personal data, so recording it is "processing" that needs a valid legal basis. The "legitimate interest" basis (Art. 6(1)(f)) requires the processing to be necessary for that interest.

The proportionality argument: for goals like quality assurance or training, regulators point out there are milder means — silently listening in, or making test calls — that achieve the same purpose without recording everyone. Because a less intrusive option exists, recording is not "necessary," so legitimate interest fails and you fall back to explicit consent (Art. 6(1)(a)).

Tip: "Necessity" in data-protection law is a high bar — if a less privacy-invasive method would also work, the more invasive one is by definition not necessary.