NAIH (Hungary) - NAIH-5377-12/2023: Difference between revisions

Latest revision as of 14:31, 6 November 2023

NAIH - NAIH-5377-12/2023

Authority:	NAIH (Hungary)
Jurisdiction:	Hungary
Relevant Law:	Article 5(1)(c) GDPR Article 6(1)(b) GDPR Article 6(1)(c) GDPR Article 77(1) GDPR
Type:	Complaint
Outcome:	Rejected
Started:	16.05.2023
Decided:	06.09.2023
Published:	16.10.2023
Fine:	n/a
Parties:	n/a
National Case Number/Name:	NAIH-5377-12/2023
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Hungarian
Original Source:	Decisions of NAIH (in HU)
Initial Contributor:	Laszlo Szabo

The processing of a minor's personal data by a bank, for the purpose of a of a 'baby loan', was lawful under Article 6(1)(c) GDPR as the bank was legally obligated to collect the minor's personal data under domestic law.

English Summary

Facts

On 16 May 2023, the the Hungarian DPA (NAIH) received a complaint from a minor's legal guardian, which alleged that a bank (the controller) had processed the minor's (data subject) personal data unlawfully. The minor's legal guardian had applied for a 'baby loan' ('Babaváró' loan) with the bank. These loans are for the purpose of financing child-related costs.

In order to process the loan application, the bank had requested a copy of the minor's identification documents, which included details such as the minor's residential address, gender, birth date and national identification number. To do so, the bank relied on Article 6(1)(b) GDPR (contract) as a legal ground for processing. In the complaint, the applicant argued that the processing was disproportionate and unnecessary for the purposes of their contract with the bank, which the minor was not party to.

In response to the complaint, the NAIH contacted the bank for more information. The bank responded that Article 14(4) and Article 9(2)(c) of Decree 44/2019. (III. 12.), which regulates the conditions of a “Babaváró” loan, requires banks to process minor's identification documents. Moreover, in order to be able to demonstrate compliance under domestic banking regulations, banks are obliged to document the basis on which they have granted loans and store any relevant information in relation to this.

Holding

The NAIH rejected the complaint. The NAIH held that Article 14(4) and Article 9(2)(c) of Decree 44/2019. (III. 12.), required banks to process the data referred to. Therefore the processing was legitimate as it was necessary for compliance with a legal obligation to which the controller was subject (Article 6(1)(c) GDPR). The NAIH acknowledged that the bank had wrongly indicated Article 6(1)(b) GDPR as a legal basis for processing. However, the NAIH held that the indication of an incorrect legal basis for processing under Article 6 GDPR, did not make the processing illegitimate.

Comment

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.

Case number: NAIH-5377-12/2023. Subject: Decision rejecting the application

Administrator: dr. Kelemen Bíborka

H A T A R O Z A T

The National Data Protection and Freedom of Information Authority (hereinafter: Authority) [...] is legal
minor child represented by a representative (residential address: […]; hereinafter: Representative), of […] concerned
(place and date of birth: [...]; mother's name: [...]; hereinafter: Affected) to the Authority May 16, 2023-
with [...] Bank Zrt. (registered office: [...]; company registration number: […]; hereinafter:
against the Respondent) regarding the illegal processing of the Data Subject's personal data

makes the following decisions in official data protection proceedings:

I. The Authority's request from the Data Subject for the Authority to establish that the Respondent
processed your personal data illegally, refuses.

II. The Authority will respond to the Data Subject's request that the Authority instruct the Applicant to
to delete illegally processed personal data, refuses.

III. The Authority's request by the Data Subject that the Authority instruct the Requested Party is
To make available to the Representative the copies of the affected documents that have been illegally handled,

rejects.

There is no place for administrative appeal against this decision, but the 30th from the date of notification
within days, it can be challenged in an administrative lawsuit with a letter of claim addressed to the Metropolitan Court. THE
a letter of claim must be submitted electronically to the Authority, which forwards it along with the case documents to the
1
to the court. The request to hold a hearing must be indicated in the statement of claim. The complete personal
for those who do not receive a tax exemption, the fee for the administrative lawsuit is HUF 30,000, the lawsuit is substantive
legal representation is mandatory in proceedings before the Capital City Court.

I N D O C O L A S

I. Subject of the procedure

(1) 2023.

came to the Authority on May 16, in which he stated that he and his wife on October 13, 2021
concluded a babysitting loan agreement with the Application, contract number: [...] The Representative a
in his application, he objected to the processing of data during credit administration, as the Data Subject
considered the handling of his personal data disproportionate and unnecessary. The reason for this is that
when he wanted to prove to the Respondent the birth of the Data Subject, the Respondent's colleague

On March 27, 2023, from both sides of the Data Subject's official ID card verifying the residential address,
he made a copy of his tax certificate and birth certificate, but they were not presented
sufficient.

1
The NAIH_K01 form is used to initiate the administrative lawsuit. The form is the general form filling program
(ÁNYK program) can be filled out. The form is available and can be downloaded from the website of the Authority: https://www.naih.hu/kozig-
decision-bureaucratic review

…………………………………………………………………………………………………………
1055 Budapest Tel.: +36 1 391-1400 ugyfelszolgalat@naih.hu
Falk Miksa utca 9-11 Fax: +36 1 391-1410 www.naih.hu(2) The Representative found the preparation of document copies harmful and therefore
contact with the data protection officer of the Respondent. On April 4, 2023, to the [...] e-mail address
in his e-mail sent, he asked for information about what legislation he was referring to
the Applicant manages "all" of his child's personal data. The Requested data protection
in his reply letter dated April 12, 2023, his official informed the Representative that the mentioned
data, such as the Data Subject's birth certificate, identity card, a
processing a copy of your residential address card and tax certificate about the babysitting allowance
44/2019. (III. 12.) Government decree (hereinafter: Babaváró r.) based on paragraph 14. (4) of §

It is done in accordance with point c) of § 9, paragraph (2), since these legal provisions
based on this, they must be attached to the application for suspension of repayment. Furthermore
informed the Representative that he has a ministerial resolution which
states in general that it applies to the use of state aid for banks
they must be able to prove conditions, i.e. to make the "credit institution decision, that
for review by the housing support authority, and the Hungarian State Treasury
for its subsequent verification, it is necessary to evaluate the support, i.e. the person entitled to the support

preservation of documents establishing the verification of conditions."

(3) The Representative did not consider the above information to be satisfactory. According to his opinion, why did they apply?
family support benefits directly from the Hungarian Treasury, therefore in relation to
Babaváró r. The provisions of § 9, paragraph (2) c) do not apply. Therefore
in his opinion, the Data processing of the Respondent was unnecessary and disproportionate.

(4) In the request for the official data protection procedure, the Representative requested that the Authority establish

and that the Respondent's data processing was largely disproportionate and unnecessary when
the Respondent made a photocopy of the Data Subject's "authority card confirming personal identification",
since personal identification is not necessary at all for credit administration.

(5) The Representative also requested that the Authority oblige the Applicant to
to delete personal data and oblige the Requester to be prepared from the Data Subject's documents
for returning copies to

II. Fact

(6) In the case of the Respondent, in general, with the obligation of banks to copy documents
explained that the supervisory bodies that control banks, such as Magyar
National Bank (hereinafter: MNB) or the Hungarian State Treasury (hereinafter: Treasury)

they set expectations for the banks, based on which it is inevitable that
so that banks are able to provide documents and deeds in all cases
to substantiate that their financial service activities, such as lending
or aid related to state subsidies in the course of their assessment activities, the relevant
legal provisions are complied with.

(7) The Respondent also submitted that the relevant legislation and the MNB apply
in accordance with his recommendations, bank branch staff performing sales cannot be
in a position to make a decision related to credit or a credit assessment. The banks
prudent and transparent operation, protection of depositors' money, and the banking sector
in order to preserve its stability, banks may not develop internal processes that
as a result of which bank branch clerks with a commission interest bring the
bank branch clerks who receive credit assessment decisions, i.e. certificates, are not entitled to a
related to the suspension of repayment and the awarding of child support

to make decisions. In order to ensure prudent and proper banking operations, it is also necessary
to avoid situations where the bank branch employee may data

2 in connection with the misinterpretation or concealment of the credit assessment, or the loan or state
can influence the placement of support or provide it illegally. Based on all this, the
in the banking sector, the high level of documentation required by the supervisory bodies
are expected from banks, it also stems from the basic principle that the prudent operation of banks and the
the possibility of internal abuses must be avoided in order to ensure the stability of the banking sector
may survive.

(8) The Respondent also considered it necessary to record that the banks are state-owned
they are not entitled to the legal provisions with regard to loans related to support
overwrite or supplement. Banks can decide whether to provide state support
whether they provide it or not, but if they decide to provide the given state aid, then so be it
nor may they deviate from the legislation of the legislator, if it applies to the given place of legislation
provision is incomprehensible, inapplicable or inappropriate. Based on all of this, the
Bank, even if it is difficult or impossible to interpret each one from a data protection point of view

legal provision, it is still maintained by the relevant legislation, such as, for example, Babaváró
the application of concepts or solutions defined in r.

(9) Regarding the specific case, the Respondent stated in the preface that it is not true a
Representative's claim that the Respondent handles the Personal Identification Number of the Data Subject, since the
The page containing the personal identification number of the residential address card was not copied, as

as well as for a copy of the Person's identity card. Declaration of this
was prepared from the documents of the Data Subject provided to the Authority for its support
copies. (NAIH-5377-6/2023.)

(10) The Respondent manages the following personal data about the Data Subject: name; birth name; mother
his name; place and time of birth; his nationality; residential address; tax identification number; pregnancy 12.
the date of your week and the date of your expected birth.

(11) The Requested Data subject's personal data based on Article 6 (1) point b) of the GDPR,
it is managed on a contractual legal basis, and the purpose of data management is by the Representative and his spouse
indicated the fulfillment of a signed baby loan agreement, since with the birth of the child
the further fate of the contract depends on the submission of a related certificate, for the interest subsidy
additional entitlement or its repayment obligation, suspension of repayment, etc.

(12) In his statement, the Respondent maintained what he had written to the Representative, i.e. that the Data Subject

the processing of your personal data by Babaváró r. It is prescribed by § 14 (4) and § 9 (2) points c).
for, and additionally referred to Babaváró r. Section 5 (2) and Section 22 (2).
too.

(13) Babaváró r. Section 5(2), Section 14(4), Section 22(2), Section 19(5),
furthermore, Section 9, Paragraphs (2)-(3) require the Respondent, within the framework of the performance of the contract, that the
suspension of repayments, the use of child support, and the 12th of the fetus.

completion of its first week, as well as in connection with the birth or death of a child
which data it must handle, and which certificates the supported person must use as clients
assess your eligibility for support.

(14) The Respondent's task is to enforce repayment with respect to the loan agreement
pausing, child support and pregnancy or childbirth
related to the failure to report a child, in a loan agreement and Babaváró r.-
legal consequences recorded in By pausing the repayment or the child

in connection with his birth, the Applicant will not receive data from the Treasury, so a
The applicant's right to suspend repayment of the subsidized persons, and a

In connection with the birth of 3 children, the loan agreement is contractual or not
its contractual performance and its contractual or non-contractual performance
applicable legal consequences (contractual consequences) must also be met
to be able to determine if the supported persons do not claim or family support
they claim family support at the payment point, or even if it is family support
provision is requested at the Treasury.

(15) Ensuring prudent operation of the Respondent and compliance with its supervisory bodies

you must be able to prove with documents that the state aid
use was made in a regular manner, so the Applicant has the fulfillment of the contract and the
within the scope of awarding the regularity of support, you must handle the copies of the documents
with which he can prove to the supervisory body that the state aid is legal
use. Copying only applies to documents containing that data
who, for the processing of data, the Requested a Babaváró r. is obliged based on For this reason, the Affected
the page of your residential address card that does not contain a personal identification number, your tax certificate and

handles a copy of your birth certificate. The Applicant also informed the
Authority that the attached "Notification" form II. in point the Data Subject
his legal representative consented "in accordance with the wording" contained in Babaváró r
for data management, and the form IX.1. point, it was recorded that the birth
birth certificate, tax certificate and address card have been submitted.

(16) According to the Respondent's point of view, its data processing is legal, since with the performance of the contract
in this context, you have the right to Babaváró r. manage the scope of data included in paragraph (2) of § 5,

including that with proof of the child's birth, i.e. the contract
the certificates related to its performance and the data circles contained therein

(17) The Respondent further submitted that the Treasury expects it to

he supports his legitimacy with deeds and documents. Regarding the practice of the Treasury
from this point of view, there is no difference in whether you are on a family support payment site
whether the supported persons claim family support from the Treasury.

III. Applicable legislation

(18) On the basis of Article 2 (1) of the GDPR, the GDPR shall apply to the data processing in this case
apply.

(19) Article 5 (1) point c) GDPR: Personal data from the point of view of the purposes of data management
they must be appropriate and relevant and limited to what is necessary
("data saving").

(20) Article 6(1)(b) and (c) of the GDPR: Processing of personal data only when and
legal insofar as at least one of the following is fulfilled:

b) data management is necessary for the performance of a contract in which the data subject is one of the parties,
or steps taken at the request of the data subject prior to the conclusion of the contract
necessary to do;
c) data management is necessary to fulfill the legal obligation of the data controller;

(21) GDPR Article 77 (1): Infringement of other administrative or judicial remedies
without, all data subjects have the right to complain to a supervisory authority -
in particular your usual place of residence, place of work or the place of the alleged offence

in the Member State of origin - if, according to the judgment of the data subject, the personal data relating to him/her
handling violates this regulation.

4(22) Infotv. Section 2 (2): Personal data according to (EU) 2016/679 of the European Parliament and
falling within the scope of the Council Decree (hereinafter: General Data Protection Decree).
III-V of the General Data Protection Regulation. and VI/A. In Chapter, as well as § 3, § 3,
4., 6., 11., 12., 13., 16., 17., 21., 23-24. point, paragraph (5) of § 4, § 5 (3)-(5), (7)
and (8), § 13, § 2, § 23, § 25, § 25/G. § (3), (4) and
in paragraph (6), 25/H. § (2), 25/M. in paragraph (2) of § 25/N. in §, it is
51/A. in paragraph (1) of § 52-54. §, § 55 (1)-(2), § 56-60. in §, a

60/A. (1)-(3) and (6) of § 61, points a) and c) of § 61 (1), § 61 (2) and (3)
paragraph, paragraph (4) point b) and paragraphs (6)-(10), paragraphs 62-71. in §, § 72-
in, paragraphs (1)-(5) of § 75, § 75/A. § and defined in Annex 1
must be applied with supplements.

(23) Infotv. Validation of the right to the protection of personal data based on § 60, paragraph (1).
in order to do so, the Authority may initiate an official data protection procedure ex officio. The data protection authority
for procedure CL. 2016 on the general administrative procedure. law (hereinafter:

Ákr.) rules must be applied with the additions specified in Infotv. and the general
with deviations according to the data protection regulation.

(24) CL of 2016 on the general administrative procedure for the official data protection procedure.
Act (hereinafter referred to as the Act) shall be applied as specified in the Infotv
with additions and deviations according to the general data protection regulation.

(25) Babaváró r. Section 5, paragraph (2) point a): When the loan application is submitted, the applicants are complete
in a statement contained in a private document with evidentiary force, they agree to the fact that
a) data relating to the loan and the maternity allowance, as well as the personal and a
their children born or adopted after submitting a loan application

aa) name
ab) birth name,
ac) their mother's name,
ad) their place and time of birth,
ae) their citizenship or stateless status,
af) their address,
ag) their notification address,

ah) their identity cards, travel documents or card-format drivers
their license number,
i)
aj) their tax identification number
evaluating the loan application, concluding the loan agreement, disbursing the loan and
to be managed by the credit institution and forwarded to the treasury for the purpose of checking legal use,
for the state tax authority, the government office.

(26) Babaváró r. Section 9 (2) points b) and c): The loan agreement includes the subsidized
persons

b) a statement in which they agree that the 12th week of pregnancy and the birth is expected
the date is specified in the ministerial decree on pregnancy care
with antenatal care book or issued by the attending physician, defined in Annex 2
with a document containing the content, and consent to the processing of this data,

c) a statement in which they undertake that if the child is born or adopted
after that, they do not require family support benefits, or if they do, family support benefits

required at the payment point, the birth certificate of the biological child, proof of address
his official identity card and tax certificate, or in the case of an adopted child
5 final decision authorizing adoption, as well as the adopted child
they will present their official identity card and tax certificate confirming their address, as well as their criminal record
they declare jointly in a private document with full evidentiary force, made with the assumption of responsibility
about living in a household, or in the case of the death of the fetus, instead of the above documents, the 3.
a document with the content specified in the annex, on the postmortem examination in case of stillbirth
and a document according to the government decree on the procedure related to the dead, or the living
in the event of the death of a born child, the death certificate confirming this has occurred
extract is presented to the credit institution within a maximum of 180 days, and they agree to this

to manage data,

(27) Babaváró r. Section 14 (1) point a) Subsidized persons to suspend repayment
are eligible
a) after their fetus has completed at least the 12th week of pregnancy, if the pregnancy
exists at the time of submitting the loan application or after, and the fetus

she becomes pregnant within a period of 5 years from the disbursement of the loan at the latest
week 12,

(28) Babaváró r. § 14, paragraph (4): The request for suspension of repayment must be submitted to the credit institution
submit. It must be attached to the application in points b) and c) of paragraph (2) of § 9

specific documents. The fulfillment of the eligibility conditions for pausing a
determined by the credit institution on the basis of submitted certificates.

(29) Babaváró r. § 22, paragraph (2): If childbearing support is used after a fetus,
and in the event of a suspension of repayment, the supported persons will receive the birth of the child or the
the death of a fetus, stillbirth or the death of a child born alive is defined in Section 9 (2)
in accordance with paragraph c) within 180 days after the expected date of delivery
are verified, the credit institution - within 15 days after the end of the deadline - notifies the treasury of this.
If the child is uniform according to the Family Support Act

no data can be found in the social register, the treasury will immediately notify the state
tax authority.

(30) Babaváró r. § 23, paragraph (1): Babysitting subsidies are calculated by the credit institution a
with treasure.

(31) Babaváró r. Section 23 (8): The treasury is on-site at the credit institution during its inspection
can carry out an inspection and is entitled to request the necessary information and documents, or
to inspect them on the spot.

(32) Babaváró r. Section 24, paragraph (1): The credit institution is liable to the state for any damage
which was created by violating the obligation imposed on him under this regulation. Exempted from

credit institution from liability if it proves that it acted as it should in the given situation
is generally expected.

ARC. Decision

ARC. The legality of the data processing of the Respondent

(33) Babaváró r. names several forms of support. Subsidized married couples are entitled on the one hand
for an interest subsidy in relation to the loan taken out - which interest subsidy is different

can be lost in the event of certain conditions, or already disbursed by the Treasury
in relation to interest subsidies, a reimbursement obligation arises -, on the other hand, they are entitled to a
to pause repayment after the 12th week of pregnancy, including childbirth
period as well, or if they jointly adopt a child. Second, the beneficiaries

6 or in the event of a third child, they are entitled to non-refundable child support
for support, the amount of which is still outstanding from the baby loan in the case of the second child
30% of the debt, and in the case of a third child, of the entire remaining debt
appropriate amount. Child support, similar to the suspension of repayment a
after the 12th week of pregnancy, including the period after childbirth, or
can be requested in case of adoption.

(34) In the specific case, the Representative and his wife asked the Applicant to suspend the repayment
On [...] 2022, given that the 12th week of pregnancy has been completed, then on [...] 2023

certified to the Respondent that their child, the Subject, was born, which is their obligation
Babaváró r. prescribed by § 22, paragraph (2). In connection with the suspension of repayment, Babaváró r.
Paragraph (4) of § 14 stipulates that the request for the suspension of repayment must be submitted to the
must be submitted to a credit institution. Section 9 (2) b) and c) must be attached to the application
documents specified in point Eligibility conditions for pausing
compliance is determined by the credit institution based on the submitted certificates.

(35) Babaváró r. Paragraph (4) of § 14 thus refers back to points b) and (c) of § 9 (2)
to specific documents, which is a general legal drafting technique,
which aims to avoid unnecessary repetitions. That is, for the suspension of repayment
from the point of view of the application, only the part of § 9, paragraph (2) b) and c) applies
significance in which the documents to be submitted are named, not that § 9 (2)
points b) and c) of paragraph otherwise aim to trigger what legal effect.

(36) As a result, the fact that the Representative and his wife applied for

whether, and if so, where, family support benefits, it is not affected by the suspension of repayment
the range of documents to be submitted in order to support the application for
paragraph 9. (2) points b) and c) defines which are blood
in the case of a child according to the following: pregnancy care book or by the attending physician
exhibited, Babaváró r. document with the content specified in Annex 2; by blood
child's birth certificate, official ID card confirming his address and
tax certificate.

(37) In addition, Babaváró r. Paragraph (2) of Section 5 expressly authorizes credit institutions to
the name of the children born after submitting a loan application for subsidized married couples,
their birth name, their mother's name, their place and time of birth, their nationality
or for the treatment of their stateless status, address and tax identification number a
assessment of the loan application, conclusion of the loan agreement, disbursement of the loan and the legal
for the purpose of checking usage. The documents copied by the Applicant are exclusively on this
contain data, copies of the authenticity and correctness of this data

are used for verifiability. In his submission, the Representative only claimed that the Data Subject
also the page containing your personal identification number of your official ID card confirming your address
was copied by the Respondent, he could not support it with anything, so the Authority a
Based on the copies of documents provided to him by the respondent, he states that
The Personal ID of the Data Subject was not processed by the Respondent, about which a
You did not make the requested copy.

(38) Babaváró r. Paragraph (4) of § 14 specifically emphasizes that for the suspension of repayment

the fulfillment of relevant eligibility conditions on the basis of the submitted certificates by the credit institution
establishes, i.e. in the absence of these documents, the credit institutions to suspend repayment
applications must be rejected.

(39) It should also be noted here that the Applicant and all other baby loans
disbursing credit institution has a settlement relationship with Kincstár, as well as Babaváró r. Section 23 (8)

According to paragraph 7, the Treasury is responsible for activities related to baby loans
can check and is entitled to request the necessary information and documents, or to access them
to inspect on site. Babaváró r. According to § 24, paragraph (1), the credit institution is also responsible
against the state for any damage that is an obligation imposed on him based on this decree
caused by its violation. That is, the Respondent's compliance with the law, as well as
in order to verify compliance, it must be handled as specified in Babaváró r
documents. Thus, on the basis of the above, to prove eligibility for support
Babaváró r. is not enough. Defined in points b) and c) of paragraph (2) of § 9

the mere presentation of documents at the credit institution.

(40) Based on all of this, the Authority concludes that the Applicant in Babaváró r. Section 14 (4)
paragraph and Section 9 (2) points b) and c) legally prepared
a copy to the Affected Babaváró r. on the documents containing your data according to paragraph (2) of § 5,
i.e. from the part of the Data Subject's official ID document confirming the residential address containing the residential address,
of your tax certificate and birth certificate, and the personal information on it
handles data legally. The personal data on the copies of documents Applicant

is necessary to be handled by and is proportionate to the goal to be achieved, as it concerns the suspension
eligibility conditions are met by the Applicant based on the submitted certificates,
in the absence of these, the grant applications would not be considered. Consequently, the Authority
states that the Respondent is in accordance with Article 5 (1) point c) of the GDPR
in accordance with the principle of data saving, legally manage the Data Subject's personal data, and
as a result, the Representative rejects the requests submitted on behalf of the Data Subject.

(41) The Authority further notes that the Respondent is responsible for handling the Data Subject's personal data

as its legal basis, it indicated point b) of Article 6 (1) of the GDPR, according to which the personal
data processing is legal if and to the extent that the data processing is a contract
necessary for the fulfillment of which the person concerned is one of the parties, or the conclusion of the contract
it is necessary to take steps at the request of the data subject beforehand

(42) However, the Data Subject has no rights or rights in the contract
obligations do not arise, the contracting parties do in relation to the baby loan
Affected parents and the Applicant, therefore only the beneficiaries of Article 6 (1) point b) of the GDPR

can be considered as a suitable legal basis for contracting parties.

(43) The children – whether they are biological or adopted children of the beneficiaries –
personal data is processed so that parents and beneficiaries can verify
that the conditions of the support received from the state have been fulfilled in parallel with the baby loan,
and that this performance can later be certified by the credit institution to the Treasury. THE
proof of compliance with the eligibility conditions for support by the parents to the credit institution

an obligation that is created by concluding a babysitting contract. For those supported
although they have to prove compliance to the credit institution, it is the support provided by the state
is significant from the point of view of the fulfillment or non-fulfillment of the conditions of the support a
does not affect the existence of a loan agreement. On the other hand, the conditions of support
verification of its existence is the legal obligation of credit institutions prescribed by law, which
in connection with its execution, they are liable for compensation to the Treasury. All of these
based on which it can be stated that the processing of children's personal data by credit institutions is legal
based on their obligation, the data management is carried out in relation to their personal data

its corresponding legal basis is Article 6 (1) point c) of the GDPR.

(44) Nevertheless, in the specific case, the Respondent does not comply with Article 6 (1) of the GDPR
referred to its appropriate legal basis when handling the Data Subject's data, data management
it has no significance in terms of its legality and necessity. On the one hand, it is the Representative
He did not dispute the legal basis for processing the personal data concerned, but only the necessity of it,

8, on the other hand, the Respondent has, regardless of this, appropriate means to manage personal data
with the legal basis that it marked an inappropriate point in Article 6 (1) of the GDPR
as the legal basis for data processing in the statement addressed to the Authority, since Article 6 (1) of the GDPR
on the basis of paragraph 1, the processing of personal data is lawful if and to the extent that it is
one of the conditions in points a)-f) exists.

A. Other questions

(45) The competence of the Authority is defined by Infotv. Paragraphs (2) and (2a) of § 38 define it, and its competence is

covers the entire territory of the country.

(46) The decision in Art. 80-81 § and Infotv. It is based on paragraph (1) of § 61. The decision is in Art.
Based on § 82, paragraph (1), it becomes final upon its publication.

(47) The Art. Section 112, Section 116(1), Section 116(4)(d), and Section 114(1)
based on paragraph 1, the decision may be appealed through an administrative lawsuit.

(48) The rules of the administrative procedure are laid down in Act I of 2017 on the Administrative Procedure
hereinafter: Kp.) is defined. The Kp. Based on § 12, paragraph (1), by decision of the Authority
the administrative lawsuit against falls within the jurisdiction of the court, the lawsuit is referred to in the Kp. Section 13, paragraph (3).
Based on point a) subpoint aa), the Metropolitan Court is exclusively competent. The Kp. Section 27 (1)
legal representation in a lawsuit within the jurisdiction of the court based on paragraph b).
obligatory. The Kp. According to paragraph (6) of § 39, the submission of the claim is administrative
does not have the effect of postponing the entry into force of the act.

(49) The Kp. Paragraph (1) of § 29 and, in view of this, Pp. According to § 604, the electronic one is applicable
CCXXII of 2015 on the general rules of administration and trust services. law (a
hereinafter: E-administration act) according to § 9, paragraph (1), point b) of the customer's legal representative
obliged to maintain electronic contact.

(50) The time and place of filing the statement of claim is determined by Kp. It is defined by § 39, paragraph (1). THE
information on the possibility of a request to hold a hearing in Kp. Paragraphs (1)-(2) of § 77

is based on. The amount of the fee for the administrative lawsuit is determined by Act XCIII of 1990 on fees. law
(hereinafter: Itv.) 45/A. Section (1) defines. From the advance payment of the fee
the Itv. Paragraph (1) of § 59 and point h) of § 62 (1) exempt the person initiating the procedure
half.

Budapest, September 6, 2023.

Dr. Habil. Attila Péterfalvi
president
c. professor

9

@@ Line 65: / Line 65: @@
 }}
-The bank argued that it is necessary that the official deciding receives the justifying documents and bank cannot deviate from the requirements of the law.
+The processing of a minor's personal data by a bank, for the purpose of a of a 'baby loan', was lawful under [[Article 6 GDPR|Article 6(1)(c) GDPR]] as the bank was legally obligated to collect the minor's personal data under domestic law.
-The back side of the card certifying the residence address was not copied.
 == English Summary ==
 === Facts ===
-The legal representative of the data subject (a minor) requested NAIH to establish that a bank processed the personal data of the data subject illegitimately. The bank made a copy of both sides of the card certifying the residence address and of the tax card and the extract from the birth register. The applicant considered the processing disproportionate and unnecessary. On the complaint of the applicant, the bank informed the applicant that the processing was based on article 14, paragraph 4 pof the Government Decree 44/2019. (III. 12.) (regulating the “Babaváró” loan) 14. § (4), taking into account article 9 paragraph 2 subparagraph c of the same decree, which requires that these documents are attached to the request to set out repayment. Moreover, the relevant ministry issued a guidance, according to which the bank is obliged to document the basis of granting the repayment break and store the justifying documents mentioned.
+On 16 May 2023, the the Hungarian DPA (NAIH) received a complaint from a minor's legal guardian, which alleged that a bank (the controller) had processed the minor's (data subject) personal data unlawfully. The minor's legal guardian had applied for a 'baby loan' ('Babaváró' loan) with the bank. These loans are for the purpose of financing child-related costs.
+In order to process the loan application, the bank had requested a copy of the minor's identification documents, which included details such as the minor's residential address,  gender, birth date and national identification number. To do so, the bank relied on [[Article 6 GDPR|Article 6(1)(b) GDPR]] (contract) as a legal ground for processing. In the complaint, the applicant argued that the processing was disproportionate and unnecessary for the purposes of their contract with the bank, which the minor was not party to.
+In response to the complaint, the NAIH contacted the bank for more information. The bank responded that Article 14(4) and Article 9(2)(c) of Decree 44/2019. (III. 12.), which regulates the conditions of a “Babaváró” loan, requires banks to process minor's identification documents. Moreover, in order to be able to demonstrate compliance under domestic banking regulations, banks are obliged to document the basis on which they have granted loans and store any relevant information in relation to this.
 === Holding ===
-The Supervisory Authority rejected the application. The Supervisory authority established that the Government Decree regulating the “Babaváró” loan requires the banks to collect and store the documents referred to and therefore the processing is legitimate.
+The NAIH rejected the complaint. The NAIH held that Article 14(4) and Article 9(2)(c) of Decree 44/2019. (III. 12.), required banks to process the data referred to. Therefore the processing was legitimate as it was necessary for compliance with a legal obligation to which the controller was subject ([[Article 6 GDPR|Article 6(1)(c) GDPR]]). The NAIH acknowledged that the bank had wrongly indicated  [[Article 6 GDPR|Article 6(1)(b) GDPR]] as a legal basis for processing. However, the NAIH held that the indication of an incorrect legal basis for processing under Article 6 GDPR, did not make the processing illegitimate.
-Interesting side point that the bank indicated article 6 (1) b (contract) as basis of lawfulness of processing the personal data while the minor is not a party to the “Babaváró” loan contract. According to the Supervisory authority, however, the fact that an incorrect legal basis was indicated, does not make the processing illegitimate.
-Therefore the Supervisory authority established that the processing of personal data was legitimate and necessary – legitimacy based on the legal obligation and the necessity to prove the information necessary for the decision and necessary to establish that the conditions of the benefits (repayment break) were fulfilled.
 == Comment ==
-To be noted that one side of the card certifying the residence address contains the national identification number (and has nothing to do with the residential address) consisting of the gender code, the birth date and a serial number plus one check digit.
-It is rather strange that article 5 (2) of the Government Decree regulating the “Babaváró” loan requires the data subjects that they consent to the processing of their personal data listed.
 == Further Resources ==