NAIH’s decision in relation to applying of Artificial Intelligence to the analysis of customer service voice recordings has resulted in a record fine.
2022. February 8.This was the first case that Hungarian National Authority for Data Protection and Freedom of Information imposed a penalty for the illegal use of artificial intelligence.
According to the NAIH report, a financial institution (bank) used an artificial intelligence-driven software solution in the course of its personal data processing to automate the processing of customer’s emotional states. The AI-based speech-signal processing technology automatically analysed a list of keywords and the emotional state of the speaker. The bank used the results to monitor the quality of calls, prevent complaints and customer migration, rate the quality of work and enhance the efficiency of its call-handling staff.
According to the Authority the bank’s privacy notice referred on the Bank’s website to these processing activities related to telephone customer service in general terms only, and no material information was made available regarding the voice analysis itself. The bank based the processing on its legitimate interests. However, the data processing activities in connection with these – very different – interests was not separated in the privacy notice and in the legitimate interests’ tests, they became blurred.
According to the NAIH, the bank did not actually examine the proportionality of the data processing and its effects on data subjects and trivialised the significant risks to fundamental rights. It expressly failed to take into account the right of data subjects to adequate information and their right to object. The Authority emphasised that the only lawful legal basis for the processing activity of emotions-based voice analysis can only be the freely given, informed consent of the data subjects.
While the NAIH did not rule the AI analysis of recorded customer service calls unlawful, in relation to the above shortcomings, obliged the Bank
- to amend its data management
- to cease the analysis emotions during a voice analysis
- adequately ensure the rights of data subjects in relation to data processing, in particular, but not limited to, the right to adequate information and protest.
In addition, the Authority imposed a record amount of HUF 250 million data protection fine on the bank as a sanction.