OOF-AII-098060

Budapest Bank's AI Call Analysis Was Found to Have Violated Callers' and Employees' Privacy Rights in Hungary

Hungary's data-protection authority found Budapest Bank's AI analysis of recorded customer-service calls violated callers' and employees' privacy rights. The system analyzed emotions and helped select callbacks and assess staff without a lawful basis or adequate notice and objection safeguards. The authority ordered an end to emotion analysis and imposed a HUF 250 million fine.

Event date
2017-05-26
Country
Hungary
Severity
Low
Evidence status
Source-Reported

Assessment status

Generated from available public incident evidence using OOF® governance methodology. It is not an official investigation, legal determination, regulatory finding, certification, or OOF® Approved Assessment.

OOF® has not independently verified this account. The description preserves source attribution and separates reported facts from the automated governance analysis below.

OOF® Analytical Context

OOF® provides a preliminary governance interpretation of the incident account catalogued by AI Incident Database (Responsible AI Collaborative) (2017-05-26, Hungary). The source account and the automated interpretation are distinct; the interpretation does not establish a technical cause, fault, or liability.

Original incident source: AI Incident Database (Responsible AI Collaborative)

OOF® has not independently verified this account. The description preserves source attribution and separates reported facts from the automated governance analysis below.

Evidence and sources

Evidence status: Source-Reported

Source-reported incident overview

Hungary's data-protection authority found Budapest Bank's AI analysis of recorded customer-service calls violated callers' and employees' privacy rights. The system analyzed emotions and helped select callbacks and assess staff without a lawful basis or adequate notice and objection safeguards. The authority ordered an end to emotion analysis and imposed a HUF 250 million fine.

AI involvement

System: Ai Assisted Call Center Software, Emotion Recognition Systems, Enterprise Ai Systems

Technology: Not established

Assessment confidence dimensions

Source corroboration
Single-source

Measures source-group corroboration only; it does not establish factual truth.

Extraction completeness
Moderate

Measures populated source fields after deterministic normalization; it does not measure correctness.

Methodological assignment confidence
Moderate

Measures automated assignment support; substantive correctness requires authorized human review.

Known facts from the incident record

  • The incident record identifies the event date as 2017-05-26.
  • The incident record identifies the location as Hungary.

Reported claims

  • Hungary's data-protection authority found Budapest Bank's AI analysis of recorded customer-service calls violated callers' and employees' privacy rights. The system analyzed emotions and helped select callbacks and assess staff without a lawful basis or adequate notice and objection safeguards. The authority ordered an end to emotion analysis and imposed a HUF 250 million fine.

Material unknowns

  • Independent corroboration is not established in the available incident record.

Primary governance problem

The incident appears to expose a governance problem involving the reported system and activity. Available reporting supports preliminary methodological interpretation, not a finding of fault or non-compliance.

Architecture intelligence

LIGA™ — Liability Governance Architecture

Primary architecture

The reported the reported system and activity concern falls within the governed questions represented by LIGA™ — Liability Governance Architecture.

Governance focus: Which questions from LIGA™ — Liability Governance Architecture, if any, are relevant to the reported system and activity?

Deeper methodology is withheld because the available evidence does not justify a Parent Standard or Core Module.

INTEGROS® — Integrity Governance Architecture

Contributing architecture

The reported the reported system and activity concern falls within the governed questions represented by INTEGROS® — Integrity Governance Architecture.

Governance focus: Which questions from INTEGROS® — Integrity Governance Architecture, if any, are relevant to the reported system and activity?

Deeper methodology is withheld because the available evidence does not justify a Parent Standard or Core Module.

SLGA™ — Software Lifecycle Governance Architecture

Contributing architecture

The reported the reported system and activity concern falls within the governed questions represented by SLGA™ — Software Lifecycle Governance Architecture.

Governance focus: Which questions from SLGA™ — Software Lifecycle Governance Architecture, if any, are relevant to the reported system and activity?

Deeper methodology is withheld because the available evidence does not justify a Parent Standard or Core Module.

Governance interpretation

The source-reported case Budapest Bank's AI Call Analysis Was Found to Have Violated Callers' and Employees' Privacy Rights in Hungary, involving Ai Assisted Call Center Software, Emotion Recognition Systems, Enterprise Ai Systems, raises a preliminary question for LIGA™ — Liability Governance Architecture: Which questions from LIGA™ — Liability Governance Architecture, if any, are relevant to the reported system and activity? This automated interpretation does not establish fault, control failure, or legal responsibility.

Relevant system components and failure mechanisms

Classification state: UNRESOLVED

System domains: Not established

No system component is sufficiently indicated by the available record.

Candidate mechanisms

No candidate mechanism is supported by the available source language.

These candidates are not confirmed causes and require evidence review.

Component labels are deterministic relevance signals from the available source record. They do not establish a defect, attack path, root cause, or responsibility.

External technical mappings

No external technical identifier is asserted for this incident.

No verified OWASP, MITRE ATLAS, or AVID identifier is asserted for this record. External mappings are published only after exact identifier, version, URL, rationale, and supporting evidence are verified.

Prevention guidance

Guidance state: EVIDENCE_LIMITED

Could This Happen to Your System?

Applicability: The available record does not establish a sufficiently specific system component or operational configuration for case-specific applicability.

Known versus inferred: Only the source-catalogued incident description is known here; no technical mechanism is inferred.

What Should Be Implemented?

Control objective: Establish the system, authority, evidence, and operating context before selecting a protective control.

Governance boundary: Identity, authorization, operational scope, and evidence boundaries must be explicit.

Protective mechanism: Use attributable event records and a documented review owner before changing production controls.

Expected protective behavior: Unknown or incomplete reports remain clearly labelled and are not converted into confirmed causes.

How Can Protection Be Verified?

Test objective: Verify that the organization can identify missing facts before approving a case-specific control claim.

Prerequisite: An attributable system inventory and evidence log are available.

Test action: Compare the report with retained system, authority, and outcome records.

Expected safe behavior: The review records uncertainty and withholds unsupported technical conclusions.

Evidence to retain: Source links, reviewer decision, system context, and unresolved-question log.

Failure condition: A root cause, control failure, or prevention blueprint is asserted without supporting evidence.

Relevant OOF® methodology: Methodology depth is not yet justified by the evidence.

Only one independent source group is represented; corroboration is not established.

Need a Complete Prevention Architecture?

OOF® Architecture & Prevention Engineering provides system-specific depth beyond this public, evidence-bounded guidance.

  • System-specific risk and architecture assessment
  • Architecture blueprint and implementation framework
  • Verification and acceptance-testing framework
  • Governance integration and documentation

This service does not certify compliance or eliminate all risk.

Discuss Architecture & Prevention Engineering

Preliminary governance questions

  • Which questions from LIGA™ — Liability Governance Architecture, if any, are relevant to the reported system and activity?
  • Which questions from INTEGROS® — Integrity Governance Architecture, if any, are relevant to the reported system and activity?
  • Which questions from SLGA™ — Software Lifecycle Governance Architecture, if any, are relevant to the reported system and activity?
  • What operational authority and controls applied to Budapest Bank, Banks at the relevant time?
  • What evidence would establish how Ai Assisted Call Center Software, Emotion Recognition Systems, Enterprise Ai Systems produced or enabled the reported outcome?

Evidence gaps and limitations

  • Only one independent source group is represented; corroboration is not established.
  • AI technology is not specified in the source record.
  • industry is not specified in the source record.
  • AI system type is not specified in the source record.

Verification and correction

Submit attributable evidence or a correction for review. Submission does not imply acceptance, publication, or an OOF® Approved Assessment.

Help verify this incidentReport another AI incident

Assessment history

  • Version 3 · 3.4.5 · 2026-11-03T20:35:58Z · Material analysis engine change
  • Version 2 · 3.4.2 · 2026-11-03T19:23:44Z · New or changed OOF knowledge may affect this incident
  • Version 1 · 3.4.2 · 2026-10-29T19:55:03Z · Initial automated analysis

Return to the public incident index