Hungarian Data Protection Authority issued a record fine of €670,000.00 (HUF 250 million) for the illegal use of artificial intelligence.
The case concerned the processing of personal data by a bank as a data controller, which automatically analyzed the recorded audio of customer service calls.
The analysis results were used by software to determine which customers should be contacted again. Specifically, this involved voice signal processing software that automatically analyzed the call based on a list of keywords and the caller’s emotional state. This data is used to establish a ranking of customers to be called back in order of priority.
The bank defined the processing activity’s goal as quality control based on changeable factors, preventing complaints and customer migration, and improving the efficiency of its customer care.
In the Authority’s view, the bank’s privacy notice referred to these processing activities only in general terms, and no material information was available regarding the voice analysis itself. The privacy notice only indicated quality control and complaint prevention for data processing purposes.
The processing was based on the bank’s legitimate interests in retaining customers and improving the efficiency of its internal operations. However, they were unclear because the data processing activities associated with these interests were not separated in the privacy notice and the legitimate interests tests.
The bank had failed to provide the data subjects proper notice and the right to object for years because it had determined that it could not do so. The Authority emphasized that the only legitimate legal basis for the processing activity of emotions-based voice analysis can be the data subjects’ freely provided, informed consent.
The Authority has stated that the legitimate interest legal basis cannot be used as a “last resort” when all other legal grounds are inapplicable and that data controllers cannot rely on it at any time or for any purpose. As a result, the Authority, in addition to imposing a record punishment, ordered the bank to stop analyzing emotions during speech analysis.
