Kajtár Takács Hegymegi-Barakonyi Baker & McKenzie Ügyvédi Iroda is a member of Baker & McKenzie International, a Swiss
Hungarian DPA issues Guidance on Voice Recordings and Call Centre Operations
On 9 May 2016, the Hungarian Data Protection and Freedom of Information Agency (Hungarian DPA)
published comprehensive new guidance (only available in Hungarian), summarizing its practice on
voice recordings and call centres.
The guidance makes clear that voice recordings - such as a speech or a conversation - constitute
personal data, and the data controller must comply with data protection obligations in order to process
that data. The use and processing of voice recording requires a legal basis, such as the consent of the
data subject, unless a statutory legal provision permits the data processing. Consistent with the
provisions of the Hungarian Civil Code, crowd recordings and recordings relating to appearances at
public events do not require data subjects’ consent.
The Hungarian DPA noted that a notice on the terms of the data processing must be given to the data
subject in connection with voice recordings. Also, as a precondition of data processing based on said
consent, the consent must be well informed. Therefore, the notice to the data subject must include all
relevant facts of the data processing, including the purpose of making the voice recording. If a third
party wishes to access recordings of conversations involving several data subjects, then each data
subject must grant consent to the disclosure of the recording, because the voice recording is the
personal data of each data subject concerned. Importantly, the data subject must be informed at the
beginning of the call that the call is being recorded.
In relation to access rights, the data controller must give the data subject easy-to-understand
information about the voice recordings. The Hungarian DPA recommends that data controllers should
enable the data subject to listen to the voice recording because this secures the highest level of
comprehensive information to the data subject. The Hungarian DPA also believes that the data subject
must be able to obtain a copy of the voice recording involving a conversation with him / her, based on
the access rights.
The Hungarian DPA’s guidance also covers voice recordings made by a data subject. The Hungarian
DPA stated that if a data controller makes a voice recording of a conversation, then - based on the
civil law principle of mutual cooperation - the data subject must also have the right to record that
conversation. However, the data subject may not publish / disclose such recording and must limit
his/her use of that recording to the enforcement / defence of a legal claim in a potential legal dispute
with the data controller. In each case, the data controller who is an employer must ensure that all of its
employees working in a call centre were duly notified about the data processing relating to recordings
of their voices which are made in connection with their conduct of their work-related tasks.
The guidance includes sector-specific recommendations regarding call centre operation and data
retention issues which are relevant to Hungarian banks, insurance companies, telecom service
providers, and public utility providers, as well as concerning the legal remedies available when data
subject rights are infringed.