NAIH (Hungary) - NAIH/2020/5911/7

NAIH - NAIH/2020/5911/7
Authority:	NAIH (Hungary)
Jurisdiction:	Hungary
Relevant Law:	Article 12 GDPR Article 17 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	19.10.2020
Published:	15.12.2020
Fine:	None
Parties:	Debreceni Egyetem MarkMyProfessor
National Case Number/Name:	NAIH/2020/5911/7
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Hungarian
Original Source:	NAIH (Hungary) (in HU)
Initial Contributor:	n/a

The Hungarian DPA (NAIH) issued a warning to MarkMyProfessor Media Advertising for failing to provide transparent information, communication and modalities for the exercise of data subject rights.

English Summary

Facts

On 14th April 2020 the lecturers of the University of Debrecen complained to MarkMyProfessor, a website where users may publish opinions about professors. According to them, one of the users since mid-November had systematically published "assessments" consisting solely of obscene words. However, MarkMyProfessor did not reply to the requests. As a result, the Dean of the University of Debrecen lodged a complaint before the Hungarian DPA.

Dispute

May a lack of immediate response to a data subject's request be justified by a letter being wrongly addressed?

Holding

During the investigation, the DPA concluded that the request sent to MarkMyProfessor was sent not to its office, but to its registered office address. Because of the first wave of the COVID-19 coronavirus epidemic it was difficult for the controller to find out about it and give a meaningful response to it in a timely manner.

The DPA warned MarkMyProfessor and decided not to impose a fine, taking into account as mitigating circumstances that the infringement was a result of negligence and that the controller quickly reacted to the order of clarification by deleting personal data in question and introducing new profile settings to avoid future infringements.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.

Case No:NAIH/2020/5911/7Subject:Decision to close the procedureThe University of Debrecen (represented by ...data protection officer, whistleblower; registered office: 4028 Debrecen, Kassai út 26.; hereinafter referred to as the "Authority") filed a complaint against MarkMyProfessor Médiareklám Szolgáltató Kft. building; hereinafter referred to as: The Authority has taken the following decision in an ex officio data protection authority proceeding against the Notifier (hereinafter referred to as the Notified Party or the Notifier), on the basis of a notification concerning the adequacy of the information provided on the processing of personal data and the exercise of the rights of data subjects, by failing to comply with the notifier's requests to exercise its data subjects' right to information in relation to the matter notified to the Authority and by failing to provide information within the one month time limit provided for in the General Data Protection Regulation in response to the requests made to it, it has infringed the data subjects' right to information and the principle of transparency. There is no administrative remedy against this Decision, but it may be challenged by means of an administrative appeal within 30 days of notification by means of a letter of claim addressed to the Metropolitan Court of Budapest. The statement of claim must be submitted electronically to the Authority, which will forward it to the court together with the case file. The request for a hearing must be indicated in the application. For persons who do not benefit from the full personal exemption from fees, the fee for administrative proceedings is HUF 30 000, subject to the right to charge a fee for the subject matter of the proceedings. Legal representation is mandatory in the proceedings before the Metropolitan Court.REASONING. Facts and historyOn 11 June 2020, the Notifier filed a complaint with the Authority, complaining about the way in which the Notified Party's objections to the infringement of its rights were being handled and the fact that it had not received a reply to the letters sent to the Notified Party concerning the above. The complainant informed the complainant that the University of Debrecen had lodged a complaint with the University of Debrecen, in which it was alleged that the websitewww. markmyprofessor.comwebsite, which was hosted by the complainant, had published offensive remarks about them.According to the complaint, since mid-March 2020, an unknown person had published "reviews" of several university lecturers, several times a day, usually in four waves (morning, afternoon, afternoon and evening), with one to two-minute intervals between each wave, consisting exclusively of obscene words. In the case of some negative comments, the trainers concerned also complained on the "Report me" interface at www.markmyrofessor.comoldalon, claiming that the comments were 
2in addition to being personal, they also violate markmyprofessor.com's rating policy, as they are considered "vulgar and rude".The instructors notified the Notified Party on 14 April 2020, exercising their right to object under Article 1212 of the General Data Protection Regulation, which applies to data subjects of personal data, and asked the Notified Party to delete their personal data - the offensive comments/ratings concerning the instructors - from the website.  The Dean of the Faculty of Humanities of the University of Debrecen also lodged a complaint with the Notified Party.According to the Notified Party, neither the Dean nor the lecturers have investigated the complaint, nor have they provided any information on the handling of the complaint. Subsequently, on 22 April 2020, representing the interests and rights of the lecturers, the Notifier sent a letter of complaint to the Notified Party - electronically - in which - referring to Article 21 of the General Data Protection Regulation and confirming the objections of the lecturers - he requested the enforcement of the rights of the data subject and the deletion of the offending evaluations.Given that the Notified Party did not respond to his letter, he sent the complaint to the Notified Party again on 12 May 2020 and requested the fulfilment of the conditions set out therein. The notifier then turned to the Authority and requested an investigation to be carried out and the content he objected to be deleted due to the failure to take into account the objection of the data subject.The Authority, on the basis of the notification, Article 57 (1) f) of the General Data Protection Regulation and Article 38. § Article 1Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation (EC) No 95/46/EC.221 Article 1 - Right to object(1) The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of his or her personal data based on Article 6(1)(e) or (f), including profiling based on those provisions. In such a case, the controller may no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. (2) Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him or her for such purposes, including profiling, where it is related to direct marketing.(3) Where the data subject objects to the processing of personal data for direct marketing purposes, the personal data shall no longer be processed for such purposes. (4) The right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject at the latest at the time of the first contact with the data subject and the information shall be clearly displayed and separately from any other information.(5) In connection with the use of information society services and by way of derogation from Directive 2002/58/EC, the data subject may exercise the right to object by automated means based on technical specifications. (6) Where personal data are processed for scientific or historical research purposes or statistical purposes in accordance with Article 89(1), the data subject shall have the right to object, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.