NAIH (Hungary) - NAIH-4495-1/2021: Difference between revisions

Revision as of 10:45, 27 July 2021

NAIH (Hungary) - NAIH-4495-1/2021

Authority:	NAIH (Hungary)
Jurisdiction:	Hungary
Relevant Law:	Article 5(1)(a) GDPR Article 5(2) GDPR Article 6 GDPR Article 13(1) GDPR Article 13(2) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	27.04.2021
Published:
Fine:	700.000 HUF
Parties:	n/a
National Case Number/Name:	NAIH-4495-1/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Hungarian
Original Source:	NAIH's webpage (in HU)
Initial Contributor:	n/a

The Hungarian DPA (NAIH) held that data processing was undertaken without a valid legal basis and without providing information on data processing to the complainant. When a company records the telephone conversations of employees, the DPA also highlighted that it must be assessed whether other measures having less impact on personal data could be taken.

English Summary

Facts

The main dispatcher for Company 1 called the complainant and recorded the conversation. The recording took place without the consent of the complainant and without providing prior information on data processing. Company 1 then forwarded the recording to Company 2, where the complainant was an employee. In turn, Company 2 terminated the employment of the complainant, since the communication of the complainant during the call failed to meet the professional standards required by Company 2.

The complainant, through its legal representative, requested information on the processing of his data from Company 1, which did not dispute that the recording took place without the consent of complainant and without providing prior information to him. Company 1 nevertheless held that the processing was in accordance with the GDPR and the service control technology agreement between Company 1 and Company 2. Company 1 also provided additional information on data processing at the complainant's request and handed over the copy of the recording to him. The complainant, however, still held that the companies failed to comply with the GDPR and submitted a complaint at NAIH, arguing that the data processing violated the principles of the GDPR and took place without his consent and without providing adequate and prior information on the data processing.

Holding

The Hungarian DPA (NAIH) held that the data processing was undertaken by Company 1 to control Company 2's service and that Company 2 examined the recordings and took measures based on employment law against the breaching employee. NAIH held that the purpose of processing is legitimate in the case of both companies; The correct legal basis for processing could be performance of a task carried out in the public interest (Art. 6(1)(e) GDPR) in the case of Company 1 and legitimate interest of the employer (Art. 6(1)(f) GDPR) in the case of Company 2.

NAIH also held, however, that the companies failed to assess whether other, less invasive measures could have been undertaken to control the services of the employee. It was highlighted in the decision that Company 2 wrongfully decided that it was not a controller and that Company 2 failed to specify a legal basis for its own processing. The NAIH also held that the companies had failed to inform the complainant about the relevant data processing. It stressed that the complainant a received, at most, vague and general information on the possibility of telephone conversation recordings, but no specific information on the data processing.

A data protection fine of HUF 500,000 was imposed on Company 1 and a data protection fine of HUF 200,000 on Company 2 by NAIH.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.

@@ Line 56: / Line 56: @@
 }}
-NAIH held that the data processing was undertaken without a valid legal basis and without providing information on data processing to the complainant. It was also highlighted in the decision that in case of recording telephone conversations of employees, it must be assessed, whether other measures could be undertaken to control the employees, which have less impact on their personal data.
+The Hungarian DPA (NAIH) held that data processing was undertaken without a valid legal basis and without providing information on data processing to the complainant. When a company records the telephone conversations of employees, the DPA also highlighted that it must be assessed whether other measures having less impact on personal data could be taken.
 == English Summary ==
 === Facts ===
-Company 1 recorded a conversation between its main dispatcher and the complainant based on which his employment relationship with Company 2 was terminated. The recording took place without the consent of the complainant and without providing prior information on data processing.
+The main dispatcher for Company 1 called the complainant and recorded the conversation. The recording took place without the consent of the complainant and without providing prior information on data processing.  Company 1 then forwarded the recording to Company 2, where the complainant was an employee. In turn, Company 2 terminated the employment of the complainant, since the communication of the complainant during the call failed to meet the professional standards required by Company 2.
-=== Dispute ===
+The complainant, through its legal representative, requested information on the processing of his data from Company 1, which did not dispute that the recording took place without the consent of complainant and without providing prior information to him. Company 1 nevertheless held that the processing was in accordance with the GDPR and the service control technology agreement between Company 1 and Company 2. Company 1 also provided additional information on data processing at the complainant's request and handed over the copy of the recording to him. The complainant, however, still held that the companies failed to comply with the GDPR and submitted a complaint at NAIH, arguing that the data processing violated the principles of the GDPR and took place without his consent and without providing adequate and prior information on the data processing.
-The main dispatcher for Company 1 called the complainant as employee of Company 2 and recorded their conversation, which was then forwarded to Company 2, which terminated his employment, since the communication of the complainant failed to meet the professional standards required by Company 2. The complainant through its legal representative required information on the processing of his data from Company 1, which did not dispute that the recording took place without the consent of complainant and without providing prior information to him, but held that the processing was in accordance with the GDPR and the service control technology agreement concluded by and between Company 1 and Company 2. The Company 1 also provided additional information on data processing at the complainant's request and handed over the copy of the recording to him. The complainant, however, still held that the companies failed to comply with the GDPR and submitted a complaint at NAIH, arguing that the data processing violated the principles of the GDPR and took place without his consent and without providing adequate and prior information on the data processing.
 === Holding ===
-NAIH held that the data processing was undertaken by Company 1 to control Company 2's service and Company 2 examined the recordings and took measures based on employment law against the breaching employee. NAIH held that the purpose of processing is legitimate in case of both companies, while the correct legal basis for processing could be performance of a task carried out in the public interest (Art. 6(1)(e) of the GDPR) in case of Company 1 and legitimate interest of the employer (Art. 6(1)(f) of the GDPR) in case of Company 2. NAIH also held however that it was not assessed in this case, whether other measures could be undertaken to control the employee, which have less impact on his personal data. It was highlighted in the decision that Company 2 wrongfully decided that it was not a controller in this case and failed to specify a legal basis for its own processing. It was underpinned by NAIH as well that the complainant as an employee could have only received vague and general information on the possibility of telephone conversation recordings, however, no specific information on the data processing was given.
+The Hungarian DPA (NAIH) held that the data processing was undertaken by Company 1 to control Company 2's service and that Company 2 examined the recordings and took measures based on employment law against the breaching employee. NAIH held that the purpose of processing is legitimate in the case of both companies; The correct legal basis for processing could be performance of a task carried out in the public interest (Art. 6(1)(e) GDPR) in the case of Company 1 and legitimate interest of the employer (Art. 6(1)(f) GDPR) in the case of Company 2.
+NAIH also held, however, that the companies failed to assess whether other, less invasive measures could have been undertaken to control the services of the employee. It was highlighted in the decision that Company 2 wrongfully decided that it was not a controller and that Company 2 failed to specify a legal basis for its own processing. The NAIH also held that the companies had failed to inform the complainant about the relevant data processing. It stressed that the complainant a received, at most, vague and general information on the possibility of telephone conversation recordings, but no specific information on the data processing.
 A data protection fine of HUF 500,000 was imposed on Company 1 and a data protection fine of HUF 200,000 on Company 2 by NAIH.