Enforcement · Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Budapest Bank Zrt.: Insufficient legal basis for data processing

€634,000 Fine
Budapest Bank Zrt.
HUNGARY
Art. 5 GDPR Art. 6 GDPR Art. 12 GDPR Art. 13 GDPR Art. 14 GDPR Art. 21 GDPR Art. 24 GDPR Art. 25 GDPR
Right to Object Legitimate Interest Data Subject Rights Exercise Modalities and Procedures Personal Data Insurance Processing Agreement Processing Artificial Intelligence
Feb 8, 2022 Source

How it connects

Related across sources

Guidance EDPB Annual Report 2021 EDPB Literature HOW GDPR TREATS AUTOMATED DECISION-MAKING Journal Scientific and Applied Research Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Guidance Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 EDPB Case Law GC and Others v CNIL CJEU Case Law Peter Nowak v Data Protection Commissioner CJEU

Full text

The Hungarian DPA (NAIH) has fined Budapest Bank Zrt. EUR 634,000. NAIH reports that the bank used an artificial intelligence-driven software solution to automate the evaluation of customers' emotional state. The speech evaluation system determined which customers needed to be recalled based on the customer's mood. The bank operated the application to prevent complaints and to keep customers. The bank did not inform the data subjects, that the processing of their data serves, among other things, for customer retention purposes, meaning that customers were not in a position to object to the processing. As a result, the rights of the data subjects regarding adequate information and the right to object were not guaranteed. The DPA also found that the bank's legitimate interest as a legal basis for processing the personal data was not sufficiently substantiated as the bank had not sufficiently examined the interests of the data subjects. The bank thus processed the data without a valid legal basis.

Industry: Finance, Insurance and Consulting

Original document at the source naih.hu

Similar Content