NAIH (Hungary) - NAIH-4495-1/2021
| NAIH (Hungary) - NAIH-4495-1/2021 | |
|---|---|
 | |
| Authority: | NAIH (Hungary) |
| Jurisdiction: | Hungary |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(2) GDPR Article 6 GDPR Article 13(1) GDPR Article 13(2) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 27.04.2021 |
| Published: | |
| Fine: | 700.000 HUF |
| Parties: | n/a |
| National Case Number/Name: | NAIH-4495-1/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Hungarian |
| Original Source: | NAIH's webpage (in HU) |
| Initial Contributor: | n/a |
NAIH held that the data processing was undertaken without a valid legal basis and without providing information on data processing to the complainant. It was also highlighted in the decision that in case of recording telephone conversations of employees, it must be assessed, whether other measures could be undertaken to control the employees, which have less impact on their personal data.
English Summary
Facts
Company 1 recorded a conversation between its main dispatcher and the complainant based on which his employment relationship with Company 2 was terminated. The recording took place without the consent of the complainant and without providing prior information on data processing.
Dispute
The main dispatcher for Company 1 called the complainant as employee of Company 2 and recorded their conversation, which was then forwarded to Company 2, which terminated his employment, since the communication of the complainant failed to meet the professional standards required by Company 2. The complainant through its legal representative required information on the processing of his data from Company 1, which did not dispute that the recording took place without the consent of complainant and without providing prior information to him, but held that the processing was in accordance with the GDPR and the service control technology agreement concluded by and between Company 1 and Company 2. The Company 1 also provided additional information on data processing at the complainant's request and handed over the copy of the recording to him. The complainant, however, still held that the companies failed to comply with the GDPR and submitted a complaint at NAIH, arguing that the data processing violated the principles of the GDPR and took place without his consent and without providing adequate and prior information on the data processing.
Holding
NAIH held that the data processing was undertaken by Company 1 to control Company 2's service and Company 2 examined the recordings and took measures based on employment law against the breaching employee. NAIH held that the purpose of processing is legitimate in case of both companies, while the correct legal basis for processing could be performance of a task carried out in the public interest (Art. 6(1)(e) of the GDPR) in case of Company 1 and legitimate interest of the employer (Art. 6(1)(f) of the GDPR) in case of Company 2. NAIH also held however that it was not assessed in this case, whether other measures could be undertaken to control the employee, which have less impact on his personal data. It was highlighted in the decision that Company 2 wrongfully decided that it was not a controller in this case and failed to specify a legal basis for its own processing. It was underpinned by NAIH as well that the complainant as an employee could have only received vague and general information on the possibility of telephone conversation recordings, however, no specific information on the data processing was given.
A data protection fine of HUF 500,000 was imposed on Company 1 and a data protection fine of HUF 200,000 on Company 2 by NAIH.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.
