On 9 May 2016, the Hungarian Data Protection and Freedom of Information Agency (Hungarian DPA) published comprehensive new guidance (only available in Hungarian), summarizing its practice on voice recordings and call centres.
The guidance makes clear that voice recordings – such as a speech or a conversation – constitute personal data, and the data controller must comply with data protection obligations in order to process that data. The use and processing of voice recording requires a legal basis, such as the consent of the data subject, unless a statutory legal provision permits the data processing. Consistent with the provisions of the Hungarian Civil Code, crowd recordings and recordings relating to appearances at public events do not require data subjects’ consent.
The Hungarian DPA noted that a notice on the terms of the data processing must be given to the data subject in connection with voice recordings. Also, as a precondition of data processing based on said consent, the consent must be well informed. Therefore, the notice to the data subject must include all relevant facts of the data processing, including the purpose of making the voice recording. If a third party wishes to access recordings of conversations involving several data subjects, then each data subject must grant consent to the disclosure of the recording, because the voice recording is the personal data of each data subject concerned. Importantly, the data subject must be informed at the beginning of the call that the call is being recorded.
In relation to access rights, the data controller must give the data subject easy-to-understand information about the voice recordings. The Hungarian DPA recommends that data controllers should enable the data subject to listen to the voice recording because this secures the highest level of comprehensive information to the data subject. The Hungarian DPA also believes that the data subject must be able to obtain a copy of the voice recording involving a conversation with him / her, based on the access rights.
The Hungarian DPA’s guidance also covers voice recordings made by a data subject. The Hungarian DPA stated that if a data controller makes a voice recording of a conversation, then – based on the civil law principle of mutual cooperation – the data subject must also have the right to record that conversation. However, the data subject may not publish / disclose such recording and must limit his/her use of that recording to the enforcement / defence of a legal claim in a potential legal dispute with the data controller. In each case, the data controller who is an employer must ensure that all of its employees working in a call centre were duly notified about the data processing relating to recordings of their voices which are made in connection with their conduct of their work-related tasks.
The guidance includes sector-specific recommendations regarding call centre operation and data retention issues which are relevant to Hungarian banks, insurance companies, telecom service providers, and public utility providers, as well as concerning the legal remedies available when data subject rights are infringed.
