A comment submitted to the California Attorney General’s final California Consumer Privacy Act regulations asked if audio recordings are personal information under CCPA and should they be included in the specific pieces produced as part of an access request?

California Attorney General: Yes, and Yes.

• As a category, there is nothing that exempts audio data from the definition of personal information and so it should be included in the response.
• If another exception under the regs applies (e.g. inability to verify or inability to search subject to the conditions of 999.313(c)) then the recording may be excluded from the response.

The AG does not address the question of how the recording is produced — should it be the recording itself or a transcript?

Under the EU’s General Data Protection Regulation (GDPR) the approach is that an audio recording itself needs to be be produced if possible.

See UK ICO guidance on this, and and Ireland DPC guidance on this.