The Hungarian Data Protection Authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) has recently published its annual report in which it presented a case where the Authority imposed the highest fine to date of ca. EUR 670,000 (HUF 250 million).
The case involved the personal data processing of a bank (acting as a data controller) which automatically analysed the recorded audio of customer service calls. The bank used the results of the analysis to determine which customers should be called back by analysing the emotional state of the caller using an artificial intelligence-based speech signal processing software that automatically analysed the call based on a list of keywords and the emotional state of the caller. The software then established a ranking of the calls serving as a recommendation as to which caller should be called back as a priority.
The purposes of the processing activity was determined by the bank as quality control based on variable parameters, the prevention of complaints and customer migration, and the development of its customer support’s efficiency. However, according to the Authority, the bank’s privacy notice referred to these processing activities in general terms only, and no material information was made available regarding the voice analysis itself. Furthermore, the privacy notice only indicated quality control and complaint prevention as purposes of the data processing.
The bank based the processing on its legitimate interests to retain its clients and to enhance the efficiency of its internal operations. The data processing activities in connection with these interests, however, were not separated in the privacy notice and in the legitimate interests tests, they became blurred.
In the course of the procedure before the Authority it became evident from the statements of the bank that for years it had failed to provide to the data subjects proper notice and the right to object, because it had determined that it is not able to do so. The Authority emphasised that the only lawful legal basis for the processing activity of emotions-based voice analysis can only be the freely given, informed consent of the data subjects.
Additionally, the Authority highlighted that although the bank had carried out a data protection impact assessment (DPIA) and identified that the processing is of high risk to the data subjects, capable of profiling and scoring, the DPIA had failed to present substantial solutions to address these risks. Furthermore, the legitimate interest test performed by the bank had failed to take into account proportionality, the interests of the data subjects, it merely established that the data processing is necessary to achieve the purposes it pursues. The Authority further emphasised that the legitimate interest legal basis cannot serve as a ‘last resort’ when all other legal bases are inapplicable, and as such data controllers cannot refer to this legal basis at any time and for any reason. Consequently, the Authority, in addition to imposing a record fine, obliged the bank to cease the analysis of emotions in the course of voice analysis.
In conclusion, the Authority highlighted that “artificial intelligence is generally difficult to understand and monitor due to the way it works, and even new technologies pose particular privacy risks. This is one of the reasons why the use of artificial intelligence in data management requires special attention, not only on paper but also in practice.”
Authors:
![Kozma Zoltán Kozma Zoltán](https://blogs.dlapiper.com/advocatus/files/elementor/thumbs/Nevtelen-terv-15-pf2v34p5mn8f9vdzqbejj0v13u7lp16lh27vary4c0.png)
Kozma Zoltán
Szellemi Alkotások és Technológiai csoportvezető
Kozma Zoltán
Kérdése van? Keressen minket bizalommal!
Kövesse LinkedIn oldalunkat!
Legfrissebb tartalmaink
![CS3D](https://blogs.dlapiper.com/advocatus/files/2024/07/CS3D-300x75.png)
Új mérföldkő az ESG területén: hatályba lépett a fenntarthatósággal kapcsolatos vállalati átvilágításról szóló uniós irányelv, vagyis a CS3D
2024. július 25-én hatályba lépett a korábban sokat vitatott és számos alkalommal újratárgyalt, fenntarthatósággal kapcsolatos vállalati átvilágításról szóló irányelv (Corporate Sustainability Due Diligence Directive (CS3D)), miután az Európai Parlament és a Tanács is zöld utat adott az javaslatnak.
![](https://blogs.dlapiper.com/advocatus/files/2024/07/12730-1-1-300x75.jpg)
Új szabályok a forgalomba kerülő termékek fenntarthatóságának növeléséért
Július 18-án hatályba lépett az Ecodesign Keretrendelet , amely lehetővé teszi azon kötelező környezetvédelmi szempontok előírását, amelyeket az uniós piacra kerülő termékek tervezésekor figyelembe kell venni.
![logisztikai park](https://blogs.dlapiper.com/advocatus/files/2024/06/1924-1-1-300x75.jpg)
New classification required for logistics activities from 2025
A new concept has been added to the regulation on the network of regulated parks: from 1 January 2025, certain companies will only be able to carry out logistics activities on the site if they have obtained the title of “Logistics Park”.