Óbuda Family Counselling and Child Protection Centre – Complaint Upheld (Hungary, 2022)

On 7 June 2021, the data subject filed a complaint with the DPA, as they became aware that the data controller – the Family Counselling and Child Protection Centre of Budapest, District III (Óbuda) – forwarded an audio recording of domestic violence (abuse) to the competent Child Welfare Centre, and this recording also contained the voice of the data subject. The recording was originally made and sent by the data subject’s estranged wife. On 14 June 2021, the data subject exercised their right of access with the controller in person. As the audio material was not made available during the visit, the data subject requested it to be sent via e-mail. The controller refused to provide the file despite multiple further requests by the data subject. However, in a letter dated 1 July 2021, the controller informed the data subject that the audio material requested by him was not physically part of the file, but it was available in file format. The audio material was then sent electronically to the competent Child Welfare Centre and subsequently deleted. The data subject therefore requested the DPA to declare that the controller unlawfully processed and transmitted their personal data to the Child Welfare Centre and that it unlawfully refused him request for access. In its reply to the DPA, the controller stated that it stored the audio recording. Allegedly, the complete file was transferred to the Child Welfare Centre pursuant to Article 6(1)(e) GDPR. The controller also stated that it subsequently considered the storage and transmission of the audio recording to be an error, and therefore took immediate action to delete the e-mail containing the audio recording. In relation to the data subject's requests for a copy of the audio recording, the controller stated that on 17 and 18 June 2021, it wrongly refused to disclose the audio recording. The controller contemplated at first that it was not competent to process the information of the data subject and because if that, it was transferred to the Child Welfare Centre. As for the audio recording, the controller instead found that it was not entitled to process the audio recording is and therefore deleted it based on Article 5(1)(b) GDPR. The DPA stated that an audio recording containing the voice of the estranged wife and the voice of the data subject is considered to be personal data shared between the data subject and the estranged wife. The DPA further stated that the controller, as a family and child welfare centre, performs a public task related to the protection of children. Therefore, it is entitled to process the data of parents in relation to the upbringing of children. As the audio recording submitted as evidence by one of the parents in the guardianship proceedings is part of the file, the DPA considered that the data controller's processing was lawful. Therefore, the DPA rejected the part of the complaint seeking a redress for the unlawful transfer. However, in the DPA's view, following the transfer of the file on 17 June 2021, the further processing of this audio recording by the controller became unnecessary due to lack of competence. By failing to take action after the transfer, the controller unlawfully processed the audio recording in the period between the transfer of the file and the deletion of the audio recording on 2 July 2021. The controller thereby infringed Articles 5(1)(b) GDPR and 6(1) GDPR. The DPA further emphasised that the controller wrongly claimed that the audio recording was not part of the file, i.e. that it had not acted fairly, thus infringing Article 5(1)(a) GDPR on transparent and fair processing. The DPA considered the non-disclosure of personal data to be such a serious infringement that it was justified to publish the present decision with the name of the controller included. However, the DPA also took into consideration several mitigating factors, such as that the controller provides social and child welfare services for persons in need. It also took into account that the controller itself admitted that it had wrongly claimed that the audio recording was not part of the file. For these reasons, the DPA decided not to impose a fine and to issue a warning.