NAIH (Hungary) - NAIH-4495-1/2021
| NAIH (Hungary) - NAIH-4495-1/2021 | |
|---|---|
 | |
| Authority: | NAIH (Hungary) |
| Jurisdiction: | Hungary |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(2) GDPR Article 6 GDPR Article 13(1) GDPR Article 13(2) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 27.04.2021 |
| Published: | |
| Fine: | 700.000 HUF |
| Parties: | n/a |
| National Case Number/Name: | NAIH-4495-1/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Hungarian |
| Original Source: | NAIH's webpage (in HU) |
| Initial Contributor: | n/a |
The Hungarian DPA (NAIH) held that data processing was undertaken without a valid legal basis and without providing information on data processing to the complainant. When a company records the telephone conversations of employees, the DPA also highlighted that it must be assessed whether other measures having less impact on personal data could be taken.
English Summary
Facts
The main dispatcher for Company 1 called the complainant and recorded the conversation. The recording took place without the consent of the complainant and without providing prior information on data processing. Company 1 then forwarded the recording to Company 2, where the complainant was an employee. In turn, Company 2 terminated the employment of the complainant, since the communication of the complainant during the call failed to meet the professional standards required by Company 2.
The complainant, through its legal representative, requested information on the processing of his data from Company 1, which did not dispute that the recording took place without the consent of complainant and without providing prior information to him. Company 1 nevertheless held that the processing was in accordance with the GDPR and the service control technology agreement between Company 1 and Company 2. Company 1 also provided additional information on data processing at the complainant's request and handed over the copy of the recording to him. The complainant, however, still held that the companies failed to comply with the GDPR and submitted a complaint at NAIH, arguing that the data processing violated the principles of the GDPR and took place without his consent and without providing adequate and prior information on the data processing.
Holding
The Hungarian DPA (NAIH) held that the data processing was undertaken by Company 1 to control Company 2's service and that Company 2 examined the recordings and took measures based on employment law against the breaching employee. NAIH held that the purpose of processing is legitimate in the case of both companies; The correct legal basis for processing could be performance of a task carried out in the public interest (Art. 6(1)(e) GDPR) in the case of Company 1 and legitimate interest of the employer (Art. 6(1)(f) GDPR) in the case of Company 2.
NAIH also held, however, that the companies failed to assess whether other, less invasive measures could have been undertaken to control the services of the employee. It was highlighted in the decision that Company 2 wrongfully decided that it was not a controller and that Company 2 failed to specify a legal basis for its own processing. The NAIH also held that the companies had failed to inform the complainant about the relevant data processing. It stressed that the complainant a received, at most, vague and general information on the possibility of telephone conversation recordings, but no specific information on the data processing.
A data protection fine of HUF 500,000 was imposed on Company 1 and a data protection fine of HUF 200,000 on Company 2 by NAIH.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.
