On 11 August 2016, the Hungarian Data Protection and Freedom of Information Agency (DPA) released a Recommendation on voice recordings and related access rights of the data subject. The DPA supervises and enforces data protection rights and, in this context, may issue recommendations on matters which it deems to be of significant practical importance. The Recommendation refers to and further evolves the guidance issued by the DPA on 9 May 2016 concerning voice recordings. The Recommendation signals that the DPA sees the need to develop an uniform practice concerning voice recordings by Hungarian call center operators to enable data subjects’ rights to access those recordings upon request.

In the Recommendation, the DPA established the following requirements for complying with data subjects’ access requests to call center voice recordings:

• The controller must make it possible for the data subject to listen to the voice recording which was made, either at the controller’s premises or by receiving a copy of the voice recording from the controller;
• The data subject has the right to obtain a copy of the voice recording, including the voice and statements of the other party of the call. The call center operator must provide the voice recording copy and is not itself permitted to decide whether the data subject has a legitimate interest in obtaining a copy;
• When providing a copy of the voice recording to the data subject, the call center operator may not impose any additional conditions or requirements on the data subject (other than those prescribed by specific legislation, if any). In particular, the call center operator may not: (i) ask the data subject personally to appear to obtaining the voice recording copy; (ii) impose disproportionately high costs on the data subject in exchange for providing a copy of the recording; and (iii) charge any attorney fee to the data subject.

The Recommendation also addresses the situation that results when a data subject records the call. The Recommendation confirms that the data subject is also authorized to record the call if the call center operator makes voice recordings of the call. In that case, the following requirements apply:

• The data subject may use the recording only for the resolution of a dispute with the data controller. The data subject is not authorized to publish the voice recording. The data subject must inform the call center representative that the data subject is recording the call. If the data subject publishes the voice recording or misuses it in any way (for purposes which are other than personal / household), then the data subject will qualify as a controller and be liable for the illegal processing of the recording;
• The call center operator must inform the call center employees about the access rights of call center customers, including the right of customers to make voice recordings of the conversation and that the employee cannot rely on his/her privacy rights in connection with the call or such recordings;
• If the data subject wants to record the call, the call center operator may not object to it based on arguments concerning the protection of business secrecy or on the confidential nature of the call.

The DPA has requested that call center operators review and revise their practices in line with the Recommendation. The DPA did not set a specific deadline for compliance with the Recommendation, meaning that controllers should review recording practices within a reasonable time of the issuance of the Recommendation.