Hungary Recording Laws: Consent, Penalties, and 2025 AI Rules

Quick Answer: Is Hungary One-Party or All-Party Consent?

Hungary is one-party consent at the criminal level. Btk. § 422 (Act C of 2012, "tiltott adatszerzés," illegal data acquisition) criminalizes only covert third-party intrusion: secretly searching another person's dwelling, observing or recording what happens inside another's dwelling using a technical device, intercepting another's mail, or covertly accessing network communications. The Kúria (Hungary's Supreme Court) has held, in a decision reported as BH 2014.5.134, that a participant who secretly records a conversation they are taking part in does not commit this offense. A 2017 Kúria ruling narrowed the offense further, holding it applies only to a dwelling or attached enclosed premises, so it does not reach even a workplace office, regardless of who does the recording.

That is not the end of the analysis. Civil Code Art. 2:48 (Act V of 2013, Polgári Törvénykönyv, or Ptk.) requires the consent of the person concerned before making a recording of their voice or image, and separate consent before using or distributing it. This is a civil personality-rights rule, not a criminal one. It carries express exceptions for mass recordings and for public figures at public events, and Hungarian commentary and practice further allow unconsented use as evidence of wrongdoing, or where a legitimate interest applies, particularly in legal proceedings. On top of both, the EU General Data Protection Regulation, enforced in Hungary by the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH), treats voice recordings as personal data requiring a lawful processing basis, pursued through complaints or administrative fines rather than criminal charges.

These frameworks are independent, but they are not all triggered by the same conduct. Btk. § 422 is a narrow criminal offense aimed at covert third-party dwelling or communications intrusion, not a general all-party consent-to-record rule. Civil Code Art. 2:48 is the genuine general consent requirement in Hungarian law, but it is civil, not criminal, and it has real exceptions. GDPR adds an administrative layer on top of both, enforced by NAIH.

Btk. § 422 and § 219: The Criminal Framework

Hungary's Criminal Code contains two provisions relevant to unauthorized recording, but § 422 is narrower than the "unauthorized recording" label suggests. Two sections are relevant: § 422 on illegal data acquisition and § 219 on misuse of personal data.

Section 422: Tiltott Adatszerzés (Illegal Data Acquisition)

Btk. § 422(1) makes it a criminal offense to unlawfully acquire personal data, private secrets, business secrets, or trade secrets through any of the following methods:

• Secretly searching another person's home or premises
• Observing or recording activities using technical devices inside another person's residence
• Opening sealed correspondence and recording its contents
• Intercepting data transmitted via electronic communications networks or information systems

The core concept is a non-participant covertly intruding into a dwelling or into a communication they were not a party to, not a participant recording their own conversation. The Kúria has held, in a decision reported as BH 2014.5.134, that a participant who secretly records a conversation they are taking part in does not commit this offense. A 2017 Kúria ruling narrowed the offense further, limiting it to a dwelling or attached enclosed premises, so it does not reach even a workplace office. A voice-over-IP call intercepted at the network level by someone outside the call fits the fourth bullet above; a participant's own smartphone or dictaphone recording a conversation they are attending does not fit any of the four, regardless of the room it happens in.

Basic penalty: Up to 3 years imprisonment.

Btk. § 422(4) raises the penalty to 1 to 5 years imprisonment when the offense is committed:

• While impersonating an official or under the pretext of official authority
• On a commercial or business scale (üzletszerűen)
• Through criminal conspiracy
• In a manner that causes significant harm to the victim

The aggravated form is classified as a felony (bűntett) under the Hungarian system. A felony conviction creates a permanent criminal record and can result in loss of professional licenses, disqualification from public office, and bars on certain employment categories.

Btk. § 422(3) separately criminalizes disclosing or using data obtained through illegal recording. Passing along a recording you know was illegally made carries the same criminal exposure as making the recording yourself. This provision reaches recipients who share unlawfully obtained recordings on social media or submit them to journalists.

Section 219: Személyes Adattal Visszaélés (Misuse of Personal Data)

Btk. § 219 addresses unauthorized processing of personal data in violation of data protection law. The offense requires either a profit-seeking motive or conduct that causes significant harm, and it demands intentional conduct throughout.

The penalties scale with the type of data:

• Ordinary personal data processed without authorization or contrary to its stated purpose: up to 1 year imprisonment
• Special categories of personal data (which include biometric data; voice patterns qualify as biometric data under GDPR Art. 9 when processed for identification purposes): up to 2 years imprisonment
• Official abusing public authority in the commission of the offense: up to 3 years imprisonment, classified as a felony

Btk. §§ 219 and 422 are not mutually exclusive where the facts genuinely satisfy both, though § 422's narrow scope (covert third-party dwelling or communications intrusion) means it will rarely reach a participant's own recording. A call center employee who secretly records customer calls for personal financial gain and processes that data without authorization can still face charges under § 219 for misuse of personal data, independent of whether § 422 applies.

Section 224: Levéltitok Megsértése (Breach of Correspondence Secrecy)

Btk. § 224 criminalizes destroying, opening, or intercepting sealed communications, including electronic messages and private correspondence. The base offense is a misdemeanor.

Penalties escalate based on circumstances:

• Use of official position or public authority: up to 1 year imprisonment
• Conduct causing significant harm: up to 2 years imprisonment
• Official causing significant harm through abuse of position: up to 3 years imprisonment

Section 224 offenses are prosecuted through private complaint (magánindítványra büntethető). The victim must file a complaint within 30 days of identifying the offender. When the offense is already connected to a state prosecution, public prosecutors may proceed without a private complaint.

Section 223: Magántitok Megsértése (Breach of Private Secrets)

Btk. § 223 targets professionals who disclose confidential information obtained through their work: doctors, lawyers, psychologists, public notaries, and public officials who reveal private information without justification.

Base penalty: short-term detention. When significant harm results, the maximum rises to 1 year imprisonment. Prosecution requires a private complaint.

Btk. § 226: Image-Based Offenses and False Recordings

Btk. §§ 226/A and 226/B target a distinct but related category: the creation and distribution of manipulated recordings intended to damage reputation. These provisions have become increasingly relevant as AI-generated synthetic media has proliferated.

Section 226/A: Creating False Recordings

Btk. § 226/A makes it a criminal offense to create a false or falsified audio or video recording of a person with the purpose of damaging their reputation. The provision covers any manipulated recording, not just digitally generated content.

Penalty: Up to 2 years imprisonment (misdemeanor classification).

Section 226/B: Distributing False Recordings

Btk. § 226/B covers making a false or manipulated recording accessible to the public.

Basic penalty: Up to 2 years imprisonment. When the offense is committed with great publicity or causes significant harm, the penalty rises to up to 3 years imprisonment, reclassified as a felony.

The great publicity aggravation captures distribution via social media platforms, television broadcasts, or viral sharing. A manipulated audio clip shared to tens of thousands of followers would typically qualify.

These provisions operate independently of Btk. § 422. You can violate § 226/B by distributing a deepfake of someone even if you never personally recorded that person. The crime is in the fabrication and circulation of false content, not in any underlying surveillance act.

Civil Code Art. 2:48: Personality Rights and Voice

Hungary's Civil Code provides a parallel civil law remedy that operates entirely independently of criminal prosecution. Under the Ptk., voice and image recordings are classified as personality rights, placed in the same protected category as life, bodily integrity, reputation, and personal freedom.

Article 2:42: General Personality Rights Framework

Art. 2:42 establishes that every person has the right to exercise their personality rights freely. The enumerated protected interests include private life, family life, good reputation, and the right to one's own voice and image. This baseline provision means that an unauthorized recording is not merely a data protection issue. It is an attack on a fundamental civil right.

Article 2:48: Right to Voice and Image Recordings

Art. 2:48 sets out a two-step consent process that governs all recordings in Hungary:

Step 1: The consent of the person concerned is required before making any recording of their voice or image.

Step 2: Separate consent is required before using or distributing that recording in any context.

Permission to record does not automatically grant permission to use. A participant who agrees to be recorded in a business meeting retains full rights to refuse consent for that recording to be shared with third parties, uploaded online, or used in legal proceedings. Both steps require independent, informed consent.

Consent under Art. 2:48 can be given orally, in writing, or through conduct that clearly indicates agreement. Implied consent is interpreted narrowly by Hungarian courts. The circumstances must make it objectively apparent that the person understood they were being recorded and affirmatively accepted it.

Art. 2:48 also contains the public event exception. Recordings of crowds, or of public figures appearing at public events, do not require the individual consent of each person captured. This covers general documentation of demonstrations, parades, concerts, and political rallies. The exception applies to the event as a whole; singling out a specific individual for targeted recording at a public event brings that recording back within the consent framework.

Hungarian commentary and practice recognize a further limit on the consent requirement: unconsented use of a recording as evidence of wrongdoing, or use grounded in a legitimate interest, particularly in the context of legal proceedings. This sits alongside the mass-recording and public-event exceptions and is a separate point from general courtroom admissibility, addressed later in this article.

Article 2:52: Grievance Awards (Sérelemdíj)

When a personality rights violation is established, Art. 2:52 provides for sérelemdíj: non-pecuniary compensation with a critical feature. The claimant does not need to prove actual financial harm. The establishment of the violation itself triggers the right to compensation.

Courts set the amount based on the severity of the infringement, whether the conduct was repeated, the degree of fault, and the broader impact on the claimant's social relationships and standing. A person whose private phone call was secretly recorded and shared has a viable civil claim even if no financial loss followed.

GDPR, the Info Act, and NAIH Enforcement

As an EU member state, Hungary applies the General Data Protection Regulation to voice recordings. Any recording of a private conversation captures personal data. Any system that processes, stores, analyzes, or transmits those recordings is subject to the full GDPR framework.

Info Act: Act CXII of 2011

Hungary's domestic data protection law, Act CXII of 2011 on Informational Self-Determination and Freedom of Information, implemented EU data protection principles before GDPR and remains in force alongside it. When GDPR and the Info Act conflict, GDPR takes precedence. The Info Act fills gaps in areas where GDPR grants member state discretion.

GDPR Article 6: Lawful Basis for Recording

Every recording of a private conversation requires a lawful basis under GDPR Art. 6. For most private recordings in Hungary, the only viable basis is consent under Art. 6(1)(a). That consent must be freely given, specific to the recording purpose, informed, and unambiguous. Silence or inaction does not count.

Legitimate interest under Art. 6(1)(f) is available for organizational recording, but NAIH applies strict scrutiny. Any organization relying on legitimate interest must prepare a documented balancing test before recording begins. The NAIH has penalized organizations that invoked legitimate interest without conducting this assessment.

For AI-powered voice analysis, including emotion detection, keyword extraction, or sentiment scoring of recorded calls, the NAIH has ruled that only freely given informed consent qualifies as a lawful basis. Legitimate interest is insufficient for secondary AI processing of voice recordings.

NAIH Transparency Requirements for Recorded Calls

At the start of every recorded call, NAIH requires data controllers to disclose:

• That the conversation is being recorded
• The purpose of the recording
• The legal basis for processing
• The identity of the data controller
• How long the recording will be retained
• The data subject's rights, including access and erasure

A generic statement that "this call may be recorded for quality assurance" does not meet the NAIH standard. The disclosure must be substantive enough for the caller to make an informed decision about whether to continue.

NAIH Enforcement: Major Cases and 2025 Priorities

The NAIH has demonstrated consistent willingness to impose substantial penalties in recording-related cases.

Budapest Bank (2022): The NAIH's largest recorded fine, HUF 250 million (approximately EUR 653,000), was imposed on Budapest Bank for using AI to analyze customer service call recordings. The AI system assessed callers' emotional states and extracted keywords. The bank's privacy notice disclosed only "quality assurance and complaint prevention" as processing purposes, with no mention of AI voice analysis. The bank also improperly relied on legitimate interest as the legal basis for the AI processing rather than obtaining separate consent.

House Installation Company: A smaller company was fined HUF 300,000 (approximately EUR 744) for recording a customer phone call without any prior notice, violating transparency, data minimization, and purpose limitation obligations simultaneously.

Employer Surveillance (2024): An employer received a HUF 15 million fine for failing to meet transparency obligations regarding workplace surveillance cameras and for conducting monitoring disproportionate to the stated purpose.

Total 2024 Fines: The NAIH imposed approximately HUF 335 million in total fines across cases involving AI processing, data breaches, and unlawful surveillance during 2024.

2025 Enforcement Priorities: The NAIH is participating in the European Data Protection Board's 2025 coordinated enforcement action focusing on data subjects' right to erasure. CCTV compliance and proportionality in workplace surveillance remain NAIH priorities. The NAIH president has also stated that improper data processing by political organizations will receive continued attention.

The maximum administrative penalty under GDPR: up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious violations.

Data Subject Rights for Recordings

GDPR grants extensive rights to persons whose voices are recorded:

Right of access (Art. 15): Data controllers must enable subjects to listen to their recording and obtain a copy. When a recording involves multiple participants, each person is an independent data subject with their own right of access.

Right to erasure (Art. 17): Data subjects may request deletion of their recordings. Controllers must honor valid erasure requests within 30 days. The NAIH's 2025 enforcement focus specifically covers how organizations handle erasure requests in practice.

Right to restriction (Art. 18): Where accuracy or lawfulness of processing is contested, data subjects may request that processing be suspended pending resolution.

The EU AI Act: Hungary's 2025 Conflict

The EU AI Act entered into force in August 2024, with prohibitions on unacceptable-risk AI systems becoming enforceable in February 2025. Hungary's legislative response has created a significant compliance tension within the EU framework.

What the AI Act Prohibits and Requires

The AI Act prohibits real-time remote biometric identification of individuals in public spaces by law enforcement except in specified narrow circumstances. Post-hoc facial recognition from stored material is classified as high-risk rather than prohibited, with strict requirements applying from August 2026.

The AI Act also requires that AI systems generating synthetic audio, video, or image content disclose that the content is artificially generated. This transparency obligation intersects directly with Hungary's existing Btk. §§ 226/A and 226/B criminal provisions on false recordings.

Hungary's March 2025 Biometric Surveillance Law

In March 2025, the Hungarian Parliament passed three amendments within 24 hours, without public debate. Entering into force on 15 April 2025, the amendments dramatically expanded police authority to use facial recognition technology in infraction procedures.

Before the amendments, facial recognition was permitted only for infractions punishable by custodial sentences. After the amendments, police may use facial recognition for any infraction, including jaywalking and participation in prohibited assemblies such as the Budapest Pride march.

Civil society organizations including the European Center for Not-for-Profit Law (ECNL), the Hungarian Civil Liberties Union (HCLU), and European Digital Rights (EDRi) have published legal analyses concluding that the amendments violate the AI Act's prohibition on real-time biometric surveillance. The European Commission's 2025 Rule of Law Report for Hungary noted the legislation. The practical question of whether Hungary can be compelled to comply before the high-risk rules take full effect in 2026 remains unresolved.

Penalties Summary

Civil Remedies for Unauthorized Recording

Beyond criminal prosecution and GDPR fines, unauthorized recording creates civil liability under multiple frameworks.

Under the Civil Code, the person whose voice was recorded without consent may bring a personality rights claim seeking injunctions against further use of the recording, orders for its deletion, publication of the court judgment, and sérelemdíj compensation. Because sérelemdíj does not require proof of financial harm, it is accessible even where the recording caused only dignity-based injury.

Under Act LIII of 2018 on the Protection of Privacy, the statutory right to respect for private life including voice recordings provides a separate civil cause of action. Having multiple statutory bases available increases a claimant's procedural options.

Both civil tracks can proceed concurrently with criminal prosecution and NAIH proceedings. A single recording incident can generate four simultaneous proceedings: criminal prosecution, NAIH investigation, Civil Code personality rights claim, and Privacy Protection Act claim. Consult an attorney for advice specific to your situation.

Phone Calls: Consent Requirements in Practice

Recording your own phone or VoIP call does not violate Btk. § 422; that offense reaches covert third-party dwelling or communications intrusion, not a participant recording a call they are part of. Civil Code Art. 2:48 still requires the other party's consent to make and to use a recording of their voice, so the practical guidance is unchanged: inform the other party and get their consent. What changes is the legal exposure for skipping that step, which is civil (sérelemdíj) and, for businesses, administrative under GDPR, not a criminal charge under § 422.

Business Call Recording

Organizations that record customer calls, including banks, insurance companies, call centers, and telecommunications providers, must satisfy both GDPR's lawful-basis requirement and Civil Code Art. 2:48's consent-to-record-and-use requirement simultaneously.

NAIH's call center guidance requires organizations to provide "easy-to-understand information" at the start of every recorded call. The disclosure must cover the purpose, storage period, data subject rights, and whether any AI or automated processing will be applied to the recording. A formulaic announcement covering only "quality assurance" falls short, as the Budapest Bank case demonstrated.

When AI is used to analyze calls, including keyword spotting, sentiment analysis, or voice biometrics for authentication, separate explicit consent is required for the AI processing beyond consent to recording itself.

The Reciprocal Recording Right

Hungarian civil law includes a reciprocal recording principle rooted in the mutual cooperation obligation (együttműködési kötelezettség). If a business records a phone call with a customer, the customer has an equal right to record that same conversation.

The reciprocal right has a strict limit: the customer may use their recording only for the enforcement or defense of a legal claim in a future dispute. Publishing, sharing, or using the recording for any other purpose would violate the personality rights of the business representatives on the call under Civil Code Art. 2:48's use-consent requirement, exposing the customer to civil liability (sérelemdíj), not criminal liability under Btk. § 422, which does not reach a participant's own recording of a call they took part in.

In-Person Recording: Private and Public Settings

Private Settings

Recording a face-to-face conversation you are part of, even inside someone else's home, does not violate Btk. § 422. The Kúria has held, in a decision reported as BH 2014.5.134, that a participant who secretly records a conversation they are taking part in does not commit this offense. A guest recording their host without the host's consent does not violate the statute for that reason alone. What DOES apply to a participant's recording is Civil Code Art. 2:48: the other person's consent is required both to make and to use a recording of their voice or image, and skipping that consent exposes the recorder to civil liability (sérelemdíj), not a criminal charge under § 422.

Where the narrow criminal offense under § 422(1)(b) does apply, meaning a genuine third-party covertly recording activities inside another's residence, the 2017 Kúria ruling limits it to a dwelling or attached enclosed premises; it does not extend even to a workplace office. Civil Code Art. 2:48's consent-to-record-and-use requirement is not limited by location and applies wherever a recording captures a person's voice or image, subject to its own exceptions.

Public Events and Crowds

Art. 2:48 of the Civil Code contains an explicit exception for crowd recordings and recordings of appearances at public events. No individual consent is required for general documentation of public gatherings.

This covers filming demonstrations, political rallies, concerts, parades, and sporting events. The reasoning is consistent with ECHR jurisprudence on privacy in public spaces: persons who appear in public places accept reduced privacy expectations regarding documentation of the event as a whole.

The exception has limits. Targeted surveillance of a specific individual at a public event, such as persistently following someone in a crowd or recording in a manner designed to enable identification rather than document the event generally, brings that recording back within the consent requirement.

Recording Police Officers and Public Officials

Hungarian law does not grant police officers or public officials blanket immunity from being recorded while performing their duties in public.

When an officer exercises official authority in a public setting, recording that conduct for the purpose of documenting potential unlawful behavior is generally permissible under the public event exception to Art. 2:48 and under the principle that public officials exercising public power have a reduced expectation of privacy with respect to that conduct.

Legal analysis from Hungarian practitioners indicates that recording police conduct is most defensible when:

• The officer is exercising official authority against you specifically (an arrest, a stop, a search)
• There is an objectively apparent basis to believe the officer may be acting unlawfully (unjustified physical force, threats, discriminatory conduct)
• The recording is made openly rather than covertly
• The purpose is to preserve evidence for a potential legal complaint

Covert surveillance of police in non-confrontational contexts remains criminal under Btk. § 422(2), which specifically prohibits gathering information to identify undercover law enforcement personnel. Recording openly and preserving the footage exclusively for legal proceedings is the safest position under Hungarian law.

Workplace Monitoring and Employee Recording

Hungary's Labour Code (Act I of 2012, amended April 2019) sets specific rules for workplace surveillance layered on top of general recording law.

Employer Rights and Limits

Art. 11(a) of the Labour Code permits employers to monitor whether employees fulfill their work duties using technical equipment, subject to three conditions:

1. The monitoring must be justifiably connected to the employee's specific work duties
2. It must be proportionate to the legitimate aim
3. It must be conducted with respect for human dignity

Surveillance cannot be used to measure employee productivity through continuous video or audio observation. Property protection is an accepted purpose; performance tracking through constant recording is not.

Prohibited Monitoring Locations

Recording devices may never be placed in showers and changing rooms, restrooms and toilets, kitchens and dining areas, or rest rooms and break facilities. The only exception is health and safety monitoring at industrial sites where physical danger requires it.

Notice and Works Council Requirements

Employers must inform employees in advance about all surveillance measures, covering the type of monitoring, its purpose, the retention period, and employees' data protection rights. Covert workplace surveillance is prohibited without exception. Even suspicion of employee misconduct does not create a lawful basis for secret monitoring.

Before implementing surveillance measures affecting a significant number of employees, employers must consult the works council (üzemi tanács). CCTV footage in the workplace may generally be stored for only three working days unless a specific legitimate reason justifies longer retention.

Voyeurism and Non-Consensual Intimate Images

Hungary addresses intimate image abuse through personality rights law and criminal provisions.

Civil Code Art. 2:48 provides the baseline: any recording of a person's image or voice without consent is a personality rights violation, triggering sérelemdíj liability without proof of financial harm. This protection applies comprehensively to intimate images.

For sexualized deepfakes and AI-generated intimate images, Btk. §§ 226/A and 226/B provide the primary criminal framework. Creating a fabricated intimate image of a real person with reputational harm as the purpose carries criminal liability regardless of whether any real recording exists. The crime is in the fabrication and distribution of false content.

Act LXXVIII of 2024 on Combating Online Aggression, which entered into force on 1 January 2025, introduced the offense of "internet aggression" into the Criminal Code. It penalizes publishing or using via electronic communications networks expressions, depictions, or audiovisual content expressing intent or desire for violent crimes against identifiable persons, with up to one year of imprisonment. While not a dedicated NCII statute, the provision covers harmful content distribution in ways that overlap with intimate image abuse.

The NMHH Internet Hotline has accepted reports of unauthorized intimate content since October 2024. Reports can be filed when images, videos, or audio recordings have been published online without the subject's consent.

Deepfakes and AI-Generated Content

Hungary's criminal provisions apply to AI-generated audio and video. The key question under Btk. §§ 226/A and 226/B is not whether a recording is authentic but whether it is false or manipulated and whether it is intended to damage the subject's reputation.

An AI-generated voice clone of a politician saying something they never said, distributed on social media, falls within § 226/B. A synthetic video of a private individual in a compromising scenario designed to harm their reputation is also covered. The sophistication of the AI tool used does not affect criminal liability.

The EU AI Act's transparency obligations add another layer from August 2024 onward. AI systems generating synthetic audio or video must disclose that the content is artificially generated. Deployers who distribute AI-generated recordings without that disclosure face regulatory exposure under the AI Act independent of any Btk. criminal liability.

Cross-Border Recording Considerations

Hungarian law applies based on both territorial and nationality principles.

When Hungarian law applies to a recording:

• Recordings made on Hungarian territory, regardless of participants' nationality
• Recordings made by Hungarian nationals abroad, for offenses qualifying as felonies under Hungarian law
• Personal data of Hungarian residents processed by organizations anywhere in the world where EU residents' data is processed in connection with offering goods or services to them (GDPR Art. 3)

EU one-stop-shop mechanism:

For organizations operating across multiple EU member states, the lead supervisory authority is determined by the organization's main EU establishment. An organization headquartered in Germany recording calls with Hungarian customers would be subject to primary GDPR enforcement through Germany's DPA, with the NAIH as a concerned supervisory authority.

Non-EU callers:

When a person in a non-EU country records a call with a Hungarian resident, Hungarian law applies to the Hungarian participant. The foreign participant's practical exposure under Hungarian criminal law is limited by jurisdictional reach, but the Hungarian participant retains the right to bring civil claims in Hungarian courts under Art. 2:48.

Practical guidance across borders:

Regardless of which side's consent rule is more permissive, obtaining every party's consent before recording is the safer practice: it satisfies both Civil Code Art. 2:48's use-consent requirement and GDPR Art. 6's lawful-basis requirement, which apply to a Hungarian participant's voice recording even though Hungary's narrow criminal offense, Btk. § 422, does not reach a participant's own recording of the call. A US-based business calling a Hungarian customer should still obtain consent to record, but the legal driver on the Hungarian side is the civil and GDPR consent requirement, not an all-party criminal consent rule.

ECHR Oversight: Szabó and Vissy v. Hungary

Hungary's surveillance laws have faced international scrutiny. In Szabó and Vissy v. Hungary (Application No. 37138/14, 2016), the European Court of Human Rights found that Hungary's national security surveillance framework violated Article 8 of the European Convention on Human Rights.

The case arose from NGO staff members challenging the surveillance powers of Hungary's National Security Services under Act CXXV of 1995. The ECHR found that the regime was so broadly defined it could reach "virtually anyone," that authorization rested entirely with the executive branch without judicial oversight, that vast amounts of incidentally collected data from non-targeted individuals were captured, and that no effective post-hoc judicial review existed.

The judgment remains the controlling international authority on the outer limits of permissible state surveillance in Hungary. Hungary's March 2025 biometric surveillance expansion has renewed these tensions, with European institutions questioning the law's compatibility with both the AI Act and the ECHR.

Secret Recordings as Evidence in Court

The admissibility of secretly obtained recordings in Hungarian courts follows a balancing approach rather than automatic exclusion.

The Kúria (Hungary's Supreme Court) has ruled that "the mere fact that evidence is obtained illegally does not make it impossible to use in front of a court as evidence." Courts apply a case-by-case balancing test weighing the recorded person's data protection rights against the interests of procedural fairness and reaching a correct outcome.

In a landmark child custody case, the Kúria upheld the use of dictaphone recordings made during a psychological examination where written consent had not been obtained. The court characterized the missing written approval as a "minor procedural fault" rather than grounds for full exclusion, ordered the recording destroyed after use, but permitted the expert opinion based on it to remain in the case file.

Factors courts weigh include: whether participants were aware of the device; whether the recording was concealed or open; the importance of the evidence to the case outcome; whether data protection arguments are being deployed tactically to exclude unfavorable evidence; and the proportionality of the privacy intrusion against the interests of justice.

One critical point remains constant: court admissibility and any underlying criminal or civil liability are separate questions, and which liability actually applies depends on who made the recording. Where a recording was made by a genuine third party through the narrow covert intrusion Btk. § 422 covers, that criminal liability persists regardless of whether a court later admits the recording. More commonly, where the recording was made by a participant, the exposure is civil under Art. 2:48 rather than criminal. Admission as evidence does not immunize the recorder from whichever liability actually applies, and it is a separate point from the exception already built into Art. 2:48 for using a recording as evidence of wrongdoing or under a legitimate interest.

Frequently Asked Questions

Can I record a phone call in Hungary without telling the other person?

It depends which legal track you mean. Recording your own phone call without the other person's consent does not violate Btk. § 422, since that offense reaches covert third-party dwelling or communications intrusion, not a participant recording a call they are part of. It does expose you to civil liability under Civil Code Art. 2:48 (sérelemdíj, without needing to prove financial harm), and a business recording customer calls needs a GDPR lawful basis, typically consent, or risks NAIH fines up to EUR 20 million or 4% of global turnover. The reciprocal exception lets you record a call a business has already recorded, but only for enforcing or defending a legal claim.

What are the criminal penalties for illegally recording someone in Hungary?

Btk. § 422's criminal penalties apply only to a narrow set of covert third-party intrusions, mainly secretly recording inside another's dwelling or intercepting mail or network communications; a participant recording their own conversation does not trigger it. Where § 422 does apply, the basic offense carries up to 3 years imprisonment, and aggravated cases (commercial operations, criminal conspiracy, or significant harm) carry 1 to 5 years. Btk. § 219 adds up to 1 year for ordinary personal data and up to 2 years for biometric voice data. Btk. § 224 can add up to 3 years in cases involving officials and significant harm. Most unauthorized recordings made by a participant fall outside these criminal provisions and instead carry civil liability under Art. 2:48 and, for businesses, GDPR exposure.

Is it legal to record police officers in Hungary?

Recording police officers exercising official authority in public is generally permissible, particularly when they are acting against you directly and you have reason to believe unlawful conduct is occurring. The recording should be made openly, not covertly. Covertly recording undercover officers or gathering information to identify undercover law enforcement is specifically criminalized under Btk. § 422(2). The safest approach is to record openly and use the footage only for formal legal complaints.

Can my employer record me at work in Hungary?

Your employer may use surveillance for property protection with advance notice, but covert monitoring is prohibited without exception. Cameras and recording devices are banned from restrooms, changing rooms, kitchens, and break rooms. Surveillance cannot be used to measure employee productivity. Your employer must inform you about monitoring methods, purposes, and your data protection rights before recording begins. CCTV footage must generally be deleted after three working days. The NAIH fined one employer HUF 15 million for inadequate transparency and disproportionate monitoring.

How does Hungary's law treat deepfakes and AI-generated recordings?

Creating a false or manipulated audio or video recording intended to damage someone's reputation violates Btk. § 226/A (up to 2 years imprisonment). Distributing such content publicly violates Btk. § 226/B (up to 3 years when committed with wide publicity or causing significant harm). The EU AI Act additionally requires AI-generated audio and video to be labeled as artificially generated. Hungary's March 2025 biometric surveillance law expanded police facial recognition authority, though EU institutions have raised concerns it violates the AI Act.

Can a secretly recorded conversation be used as evidence in a Hungarian court?

Potentially yes. The Kúria has ruled that illegally obtained evidence is not automatically excluded, and courts apply a balancing test weighing privacy rights against the interests of justice. Separately, Civil Code Art. 2:48 itself is understood to permit unconsented use of a recording as evidence of wrongdoing, or where a legitimate interest applies, particularly in legal proceedings. Admission into evidence does not erase liability where it genuinely exists: a non-participant's recording made through the narrow covert intrusion Btk. § 422 covers still carries criminal exposure, and a participant's recording made without the other person's consent still carries potential civil liability under Art. 2:48.

What is the two-step consent requirement under Civil Code Art. 2:48?

Under Art. 2:48, consent to make a recording and consent to use or distribute that recording are two separate legal requirements. Agreeing to be recorded in a meeting does not authorize the recorder to share that recording with others or use it outside the originally agreed context. Both steps require independent informed consent. Violating either step triggers civil liability including sérelemdíj compensation, which requires no proof of financial harm.

How does GDPR affect businesses that record calls in Hungary?

Businesses must have a lawful basis under GDPR Art. 6 (typically consent), provide detailed notice at the start of every recorded call covering purpose, legal basis, retention period, and data subject rights, and comply with access and erasure requests. The NAIH fined Budapest Bank HUF 250 million for failing to disclose AI voice analysis and for improperly relying on legitimate interest rather than consent. AI-powered call analysis requires separate explicit consent beyond consent to simple recording. Maximum fines reach EUR 20 million or 4% of global turnover.