A Stopped Meeting Recording Restarted After Consent Withdrawal: Quarantine the New Segment

A recording that restarts after someone withdraws consent creates a narrow but important incident: the post-withdrawal segment may have entered storage, transcription, notes or summaries, including their sharing workflows without renewed consent evidence.

Start by preserving the evidence and preventing further use. Do not edit the original recording or guess when consent resumed. Build one incident timeline from system events, meeting chat and participant statements, supported by file metadata.

This is an operational response guide, not legal advice. The lawful basis and retention duty; required notices depend on the organization and jurisdiction. Under Article 7 of the UK GDPR version of Regulation (EU) 2016/679, a controller must be able to demonstrate consent where processing relies on consent, and a person can withdraw it at any time. legislation.gov.uk, April 27, 2016

• Preserve the original recording and related audit material; transcript jobs and access history.
• Restrict access to the restarted segment and derived artifacts.
• Assign one reviewer to maintain the incident timeline and decision record.

What proves that recording restarted after consent withdrawal?

Use timestamps from the recording service as the starting point. Pair them with evidence of withdrawal, the stop-and-restart actions and any renewed-consent event. A meeting participant saying they thought recording had resumed is not the same as evidence that they agreed to it.

Google Meet states that participants receive a notification when recording starts or stops. Its recording help also says recordings are saved to the meeting organizer's Google Drive. That makes the meeting event history and Drive file details useful places to preserve evidence, where Google Meet is the system involved. Google Meet Help

Which intervals lack renewed consent?

Mark the first moment recording restarted. Mark the first later event that clearly records renewed consent, if one exists. The interval between those points is uncovered unless a documented non-consent basis applies.

Do not treat attendance or silence, nor a prior consent as proof of renewed consent after a recorded withdrawal. Article 7 says withdrawal must be as easy as giving consent, and the controller must be able to demonstrate consent when consent is the basis. legislation.gov.uk, April 27, 2016

If no renewed-consent evidence exists, label the whole restarted segment as uncovered. Keep the label attached to every copy and derivative so later reviewers do not mistake a technical restart for permission to use the material.

• Record times in one timezone and retain the source timezone when systems differ.
• Use the earliest reliable event timestamp, then note any clock uncertainty.
• Separate the pre-withdrawal recording from all later intervals, marking any uncovered portion.

Which files and summaries consumed the restarted segment?

Treat the recording as the source artifact. Then trace every system that received the restarted segment, whether automatically or by a person. The inventory should include copies, captions, transcripts, meeting notes, summaries, downloads, shared links, exports, and analytics or AI-generated outputs if they contain material from the segment.

Google Meet says recordings can include the active speaker and presented material, and captions can be saved with a recording. It also states that recordings are saved in the organizer's Google Drive and a recording link is sent to the organizer and the person who started the recording. That means the inventory should cover the recording, related captions, Drive access, and notification recipients when that product was used. Google Meet Help

Record whether each artifact contains the full uncovered interval or only an excerpt; otherwise, no content from it. Do not assume a short summary is outside scope simply because it is not a media file.

• Recording files and alternate exports.
• Transcripts and captions; chat logs and searchable indexes.
• Human notes and automated summaries; task records and follow-up emails.
• Shared links and downloaded copies, with access lists.
• Any system that used the content to create a new artifact.

How should the restarted segment be quarantined?

Apply a reversible hold first. Restrict access, disable sharing where your controls allow it, stop new transcription or summarization jobs, and prevent the segment from being used in routine operations. Preserve enough metadata to establish what happened and who handled the material.

The hold is not the final legal decision. It prevents further spread while the responsible privacy and legal teams, including records staff decide whether renewed consent exists, another basis applies, or deletion, correction, or another response is required. The UK GDPR version of Article 17 describes erasure duties where consent is withdrawn and no other legal ground applies, subject to stated exceptions. legislation.gov.uk, April 27, 2016

NIST's incident-response guidance frames incident response as part of preparing, detecting, responding to, and recovering from incidents. Use that discipline here: preserve evidence and contain the issue; document decisions and verify the outcome. NIST, April 2025

• Set the recording and identified derivatives to restricted access.
• Record the quarantine time and operator; systems affected and reason.
• Pause scheduled sharing, retention changes, transcription, and summary generation for the uncovered material.
• Ask the designated privacy or legal reviewer to decide the remediation path.
• Verify that the decision reached every identified derivative.

Who should close the incident and what proves closure?

Closure needs an evidence-backed decision for the restarted segment and every derived artifact. The reviewer should be able to see the withdrawal, stop, restart, any renewed-consent evidence, the uncovered interval, the downstream inventory, the quarantine action, and the final disposition.

The European Data Protection Board published its Guidelines 05/2020 on consent under Regulation 2016/679 on May 4, 2020. Use the applicable organizational process and jurisdiction-specific advice rather than treating a generic checklist as a complete consent analysis. European Data Protection Board, May 4, 2020

Keep the incident record with the evidence references, not the underlying recording content, wherever possible. The record should let a later reviewer recertify the response without expanding access to the quarantined material.