Informing clients
HUF 250 million fine for AI emotion analysis of calls
A Hungarian bank used artificial intelligence to analyse callers' emotional state in recorded customer service calls, without properly informing its customers. The Hungarian data protection authority fined it HUF 250 million.
The annual report of Hungary's data protection authority, the NAIH, published in March 2022, described the case of a financial institution without naming it. The fines tracker of the law firm CMS names it as Budapest Bank and dates the decision 8 February 2022.
The bank analysed recordings of its customer service calls automatically. AI-based speech-processing software looked for listed keywords and assessed the speaker's emotional state and mood. The results were stored with each call, and the recordings could be replayed in the software for 45 days. The program suggested who should be called back first, with managers making the final decision; the analysis was also used to assess staff. The aims were preventing complaints and customer loss, quality control and staff efficiency.
The bank's privacy notice contained no meaningful information about the voice analysis. Its own impact assessment found the processing high-risk, suitable for profiling and capable of legal effects on customers, yet neither it nor the balancing of interests offered any real way to handle those risks. The bank's statements confirmed that for years it had knowingly failed to provide proper information or the right to object, having decided this was not feasible. In the NAIH's view, only freely given, informed consent could have served as a legal basis, and that option was never even considered.
The authority ordered the bank to stop analysing emotions, to provide information and the right to object, and imposed a fine of HUF 250 million. At the time it was the highest data protection fine in Hungary.
What can we learn from it?
The NAIH did not object to the use of AI as such, but to customers not knowing about it and being unable to object. AI-based analysis can therefore be used lawfully, if the people concerned know in advance what happens to their words and there is a legal basis. In Confiella the recording does not leave the computer and the transcript is made locally; informing clients still rests with the professional. Good practice is a short, plain-language notice before the first session and, where an impact assessment is made, actually dealing with the risks it identifies.
Sources
- NAIH: A Nemzeti Adatvédelmi és Információszabadság Hatóság beszámolója a 2021. évi tevékenységéről
- Telex: Szoftverrel figyelte az ügyfelek érzelmeit a hangjuk alapján egy magyar bank, 250 milliós bírságot kapott
- CMS: GDPR Enforcement Tracker Report 2024 – Hungary
This article is based on the public sources listed. If you find a mistake, write to us: [email protected]