NAIH (Hungary) - NAIH-2020-2546-5: Difference between revisions
From GDPRhub
No edit summary |
m (Ar moved page NAIH - NAIH-2020-2546-5 to NAIH (Hungary) - NAIH-2020-2546-5) |
Latest revision as of 10:09, 17 November 2023
| NAIH - NAIH-2020-2546-5 | |
|---|---|
 | |
| Authority: | NAIH (Hungary) |
| Jurisdiction: | Hungary |
| Relevant Law: | Article 5(1)(c) GDPR Article 6(1) GDPR Article 9(1) GDPR Article 12(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 16.12.2020 |
| Published: | |
| Fine: | 35000000 HUF |
| Parties: | n/a |
| National Case Number/Name: | NAIH-2020-2546-5 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Hungarian |
| Original Source: | NAIH (in HU) |
| Initial Contributor: | Hunprivacy |
The Hungarian DPA (NAIH) held that the controller processed copies of documentation containing personal data (including health data) without a legal basis and not in line with the purpose of processing. The processing was also not in line with the controller's legal obligation to process information on the provision of childbirth incentive loan. NAIH imposed a fine of approx. €97,430.
English Summary
Facts
Two parents turned to NAIH in connection with their credit institute’s processing of personal data regarding their “Childbirth incentive loan”.
The couple applied for suspension of repayment, for which they were eligible under the condition that the fetus is at least 12 weeks old. In order to certify this fact, the administrator of the credit institute copied their pregnancy booklet in its entirety.
The parents were of the opinion that this is unnecessary for the purpose of certifying the age of the fetus, as the pregnancy booklet contains a number of sensitive information.
Following this situation, NAIH conducted an ex officio investigation. In order to have all the necessary and relevant information, NAIH collected statements from the controller.
NAIH found that the controller processed the personal data in question excessively and unlawfully, and therefore had breached multiple GDPR provisions. As a consequence, NAIH imposed a data protection fine of HUF 35,000,000 on the controller.
Dispute
Is the controller’s general data processing practice in compliance with the GDPR in connection with collecting personal data from pregnancy booklets and patient records for the purpose of reviewing the eligibility of a couple for repayment suspension for a “childbirth incentive loan” construction?
Holding
The conditions of a special loan called as “childbirth incentive loan” are set out in a respective Hungarian Government Decree. According to the relevant rules, parents, or parents expecting a child are eligible for suspension of repayment, where specific criteria are met, including that the fetus is at least 12 weeks old.
In order to verify this, certain documents must be presented. The controller in this case requested, amongst others, the copy of the complete pregnancy booklet, with all the information in it, as well as the patient records.
The pregnancy booklet contains a wide range of personal data regulated specifically in a ministerial decree, e.g., detailed information about the health status of the mother, including data related to possible previous pregnancies, details about the circumstances of previous childbirth, or miscarriages.
Regarding the legal basis of the above data processing, NAIH highlighted, that the fact of being pregnant is in itself health data, and as such, can only be processed if one of the legal bases in Article 6 (1) and an additional criterion under Article 9 (2) of the GDPR apply.
Article 9 (2) of the GDPR does not contain an exception that would explicitly allow the processing of health data for the purpose of performing a contract. According to Article 9 (2) (a) of the GDPR, health data may be processed if data subjects give their explicit consent. Pursuant to Section 9 (2) of the relevant Government Decree, the spouses must expressly state in the loan agreement that they consent to the processing of data regarding the 12th week of pregnancy and the expected date of childbirth. By this, the Government Decree settles the legal basis for the processing of health data. However, NAIH raised issues as to the validity of the consent. NAIH is of the opinion that it is questionable whether the consent is freely given, since without the prior consent of the contractor, no loan agreement would be concluded.
NAIH concluded, that the controller violated the principle of data minimization by copying the entire pregnancy booklet, containing excessive health data and other highly sensitive data, as it is not strictly necessary in light of the purpose of the processing. In addition to the excessive collection of special categories of personal data, NAIH highlighted that the affected individuals were in an extremely vulnerable situation.
NAIH also held, that the data controller had, in fact, no appropriate legal basis for the processing.
NAIH held that the continuous nature of the violation of the data subjects’ rights, and the large number of affected individuals were aggravating factors in the case. On the other hand, NAIH acknowledged the fact that the controller reconsidered and changed its data processing operations, and ended its unlawful practice of keeping copies of pregnancy booklets and patient records.
Comment
NAIH has already considered the copying of personal and other documents and processing identification documents by controllers in multiple cases. According to NAIH's practice, copying of documents is generally not necessary for concluding a contract or for pre-contractual screening. Processing of identification documents and relevant identification numbers is also generally unnecessary for the given purpose of processing, unless it is prescribed by law.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.
Case number: NAIH / 2020/2546/15. Subject: Decision
H A T Á R O Z A T
Before the National Authority for Data Protection and Freedom of Information (hereinafter referred to as the Authority), the […]
hereinafter referred to as the “Customer”) prior to the conclusion of contracts for the provision of a baby waiting loan,
or, during the term of the contracts, the lending, the related discounts,
the handling of documents containing personal data in connection with grants, and
the lawfulness of information on data processing during the granting of a baby waiting loan, the general
ex officio data protection to verify compliance with the Data Protection Regulation
In administrative proceedings, the Authority shall take the following decisions:
I. Finds that the Customer
(1) infringed Article 5 (1) (c) of the General Data Protection Regulation (GDPR);
the principle of data saving in accordance with the principle of non - compliance with
personal data, including health data, in copies of final reports
managed that were not necessary to achieve the purpose of the data processing;
(2) handled without a legal basis prepared pregnancy books and prepared final reports
personal data, including health data, recorded in copies
Article 6 (1) of the GDPR and, in the case of health data, Article 9 of the GDPR.
Article 1 (1);
(3) did not provide clear and transparent information to those concerned about the baby waiting loan
and the processing of data during the life of the concluded loan agreements
Article 12 (1) of the GDPR.
II. Instructs Customer to do so within 60 days of this decision becoming final
(1) delete any pregnancy books and final reports still available
destroy electronic copies, paper copies, and have done so
credibly to the Authority.
(2) reshape the baby waiting loan application as well as the contracts concluded
information management practices in a manner consistent with Article 12 of the GDPR.
transparency requirement under Article 1 (1).
III. Due to the unlawful data processing, the Customer shall be informed of the 30th day after the final adoption of this decision
within a day
HUF 35,000,000, ie thirty-five million forints
data protection fine
obliges to pay.
_______________________________________________________________________________________________________________
1055 Budapest Tel .: +36 1 391-1400 ugyfelszolgalat@naih.hu
Falk Miksa utca 9-11. Fax: +36 1 391-1410 www.naih.hu 2
* * *
The fine was imposed on the Authority’s centralized revenue collection forint settlement account (10032000-
01040425-00000000 Centralized direct debit account IBAN: HU83 1003 2000 0104 0425 0000 0000)
to be paid for. When transferring the amount, NAIH / 2020/2546. JUDGE. should be referred to.
If the Customer fails to meet its obligation to pay the fine within the time limit, a late payment surcharge
obliged to pay. The rate of late payment is the statutory interest, which is the calendar affected by the delay
equal to the central bank base rate valid on the first day of the first half of the year.
A II. obligation under point III. non - payment of the fine and penalty for late payment in accordance with point
In that case, the Authority shall order the enforcement of the decision.
Until the expiry of the time limit for bringing an action against the decision, or an administrative action
until the final decision of the court, the data involved in the disputed data processing shall not
can be deleted or not destroyed.
A II. within 8 days of the implementation of the measures provided for in point
together with supporting evidence, shall notify the Authority. To the Customer
as evidence, it must be accompanied by a document fully documenting the fact and IT circumstances of the cancellations
a record (s) and a statement that all copies of the said data
deleted.
There shall be no administrative appeal against this Decision, but it shall be subject to a right of appeal within 30 days of notification
An appeal addressed to the Metropolitan Court may be challenged in an administrative lawsuit within one day. THE
The application shall be submitted to the Authority, electronically, which shall forward it together with the case file to the
court. For those who do not receive a full personal tax exemption, there is an administrative lawsuit fee
HUF 30,000, the lawsuit is subject to the right to record material taxes. In the proceedings before the Metropolitan Court, the legal
representation is mandatory.
I N D O K O L Á S
I. Procedure
(1) The Authority has received a notification in the public interest in which the notifier has submitted that
took a loan with his spouse from the Client. The applicant and his spouse have requested the Client to
suspension of loan repayment. The Customer's administrator copied the entire
a pregnancy care book to prove that the fetus was 12 weeks old.
(2) On the basis of the notification in the public interest, the circumstance giving rise to the initiation of the official inspection came to the
Authority, so that the Authority, on 24 January 2020, issued NAIH / 2020/1156. case number of the Customer
initiated a formal inspection to verify that the Customer
whether its general data management practices in relation to baby loans are in line with a
GDPR requirements.
3. The Authority shall make a declaration at the same time as it notifies the initiation of the official control
called the Customer. The Client's statement was received by the Authority on 14 February 2020. 3
(4) Based on the Client's statement and additional information revealed during the official inspection
it was probable that the Client had breached the provisions of the GDPR, therefore the Authority is
In its case, NAIH / 2020/2546 initiated ex officio data protection proceedings on 28 February 2020.
case number. The investigation period covered the period from 1 July 2019 to 28 February 2020.
(5) In addition to the notification of the data protection authority procedure, the Authority shall clarify the facts
In order to do so, he invited the Client to make a statement, and in his order he reserved the ones already concluded
loan transactions performed by the Client on the maternity books, the adoption
paper - based decisions, abortion or stillbirth documents, and
electronic copies. The Authority left the seized copies of the documents in the custody of the Client. THE
It was necessary to order a seizure because, on the basis of the Client's statement, its
there is a risk that the copies of the records, in the context of the Client's own review of
deleted before the end of the data protection authority procedure.
(6) In its statement dated 15 May 2020 (NAIH / 2020/2546/2), the Client informed the
Authority to comply with the attachment order, the paper - based and
destruction of electronic copies of documents, deletion from systems upon receipt of the order
suspended after.
(7) On 22 June 2020, the Authority adopted Decision NAIH / 2020/2546/3. clarification of the facts in its order no
In order to do so, he invited the Client to make a statement and send various copies of the documents.
(8) In the Client's letter dated 8 July 2020, the deadline for reply is an additional 15
The Authority requested the extension of the application by NAIH / 2020/2546/5. No.
in his order. The Client's statement and the requested documents are electronic, with a password
A copy of the protected copies was received by the Authority on 30 July 2020.
(9) In order to clarify the facts, the Authority should amend NAIH / 2020/2546/9. in his order no
invited the client to make a statement on October 20, 2020. Customer Statement November 2020
He arrived at the Authority on the 25th.
(10) The Authority shall, in the course of loan transactions already concluded by the Client in the care of pregnant women
books, adoption decisions, proof of miscarriage or stillbirth
seizure of paper and electronic copies of documents on 14 December 2020
terminated by order of.
II. Clarification of the facts
(11) Decree 44/2019 on the baby waiting allowance. (III.12.) Government Decree (hereinafter: Government Decree)
under the baby waiting loan interest subsidized, the transaction interest on behalf of the state to the Treasury
disbursed to the credit institution.
(12) Beneficiaries - ie the spouses with whom the financial institution is expecting a baby loan
are entitled to a suspension of repayment - other
after the 12th week of pregnancy, including the post-natal period
or if they adopt a child together.
(13) Beneficiaries are entitled to a non-refundable fee in the event of the second or third child
childbirth allowance, the amount of which is for the second child from the baby-waiting loan
30% of the outstanding debt and, in the case of a third child, the remaining 4
amount corresponding to the loan debt. Childbirth allowance to suspend repayment
similarly after the 12th week of pregnancy, including the postpartum period, or
can be requested in case of adoption.
(14) An application for suspension of repayment and child-raising allowance should be submitted to the credit institution.
to be submitted, which must be accompanied by the provisions of Section 9 (2) (b) and (c) of the Government Decree.
which are as follows:
• the 12th week of pregnancy and the expected date of delivery
to prove the maternity care book, the data content of which is
26/2014 on maternity care. (IV. 8.) Annex 1 of the EMMI Decree
(or, after 1 July 2020, in the Government Decree
a document issued by the treating physician with a specific content);
• in the case of a blood child, proof of birth: the child's birth
birth certificate, official certificate of residence and
tax ID;
• in the case of an adopted child, the final authorizing the adoption
decision, the official identity card of the child and the
tax ID;
• a statement in full private evidence from the beneficiaries stating that
that they live in a household;
• in the case of stillbirth or miscarriage, the document certifying the occurrence,
In client practice, the final report was (fetal death as of July 1, 2020)
in the case of a document pursuant to Annex 3 of the Government Decree; stillbirth
on the examination of the dead and the procedure relating to the dead
in the case of a document according to a government decree, or in the event of the death of a child born alive
death certificate).
(15) In order to suspend repayment and apply for childbirth allowance, the Client shall use the same a
systematized the form. For these requests, the original of the above documents
demanded a presentation, of which he made a copy, not including in a household
declaration of origin, as it required it to be submitted in the original. This
[…] Of the Regulations (hereinafter: the Product Regulations).
(16) Electronic copies of the above documents shall be sent to the Customer on or after 1 November 2019
prior to that, its predecessors recorded and stored them in their process management systems.
(17) […] From 1 November 2019, paper-based documents in the customer files in the branches
have been placed.
(18) With regard to the handling of paper-based documents and copies of documents, since 1 November 2019, the
The practice of the Customer 's bank branches is uniform, it is stated in Annex […] of the Product Regulations and
regulated by its annexes […].
(19) In the course of the procedure, the Client referred to the previous decision of the Authority - Data Protection Officers 2019.
conference, received from data protection officials, not in the context of video presentations
expressed in question 25 of the document "Answered questions" that "A
Authority shall accept copies if the employer, as data controller, is such
develop a practice of making copies only of data whose 5
otherwise entitled to handle it. In this case, copy the data on the document
data management operation, but not a new data management purpose compared to the original purpose of data collection, but
a way of collecting data for the original purpose of data processing and the related legal basis,
which otherwise helps to ensure the accuracy of the data. "
(20) The Client shall list and make available on the […] website the information related to the baby waiting loan
documents, including documents governing data management, e.g. […].
(21) The Client informed the Authority that between 1 July 2019 and 30 January 2020 in total
[…] Persons applied for a baby waiting loan from him, of which […] granted a baby waiting loan to a person,
which means a total of […] transactions. […] Transaction was suspended during the repayment of the first
after child and […] supported couple claimed childbirth allowance for the second or
after the third child.
(22) Upon receipt of the Client's order to initiate official control
reviewed its rules of procedure and the forms requested. Of this
abolished the pregnancy books, the adoption permit
copies of decisions, documents certifying miscarriage or stillbirth, and this information,
prepared separate model certificates to prove the circumstances, on which the beneficiary declares the
on the correctness of the data ordered by the Government Decree on the basis of the presented documents.
To prove this, the statement is accompanied by the amended […] Product Regulations
in […] of which the Client has expressly stated that it is to be presented
documents (maternity care book, adoption decision, stillbirth or birth certificate)
abortion certificate) is strictly forbidden. In addition to these, the Authority
made available the amended annexes - [kidolg] - and the newly developed certificates - to the
[…] - patterns as well.
(23) The Client has also reviewed the documents of the baby waiting loan from the point of view of data protection,
which were not affected by the Authority's request. On the implementation of the amendments on 15 May 2020
informed the Authority, the amended Product Regulations, in its statement dated […]
application for support and to verify the data in the […] pregnancy care book
attached to his statement of 27 July 2020.
(24) The Client has stated that in respect of the transactions already concluded in which
In the absence of legal authorization, copies were made pursuant to Section 9 (2) (b) and (b) of the Government Decree
c), decided to make copies of paper-based documents
on the annulment of the decision, on the recording of the fact of the destruction, and on the
the indication of the data required by law and the deletion of electronic copies of documents, and
has begun to do so, following an order by the Authority ordering a seizure
suspended.
(25) At the request of the Authority, the Client provided the Authority with the information from 1 July 2019 to 2019.
1 August 2020 and 1 January 2020-2020. in the periods between January 30 and pregnancy
copies of books.
(26) No copy of the adoption decision was made during the period under review, while abortion or death
A total of 2 copies were made of the birth certificate - the final report - the other two
In this case, the abortion has already been verified with a sample of the certificate prepared by the Client, which
only the natural identity data, address of the pregnant woman, 6 of the 12th week of pregnancy
miscarriage or stillbirth and to identify the specialist
contain the necessary details and signature.
(27) In order to verify the actual application of the new amended certificates, the Client shall
5 from the period from 1 February to 15 March 2020, signed by the parties concerned, a
a copy of the certificate marked with the number […] certifying the presentation of the maternity care book
made available to him.
III. Applicable legal provisions
Following the period under review, the Government Decree was amended several times. The Authority is the Government.
Regulation took into account the provisions in force during the period under review on the lawfulness of data processing
in its assessment.
Pursuant to Article 2 (1) of the GDPR, the GDPR applies to the processing of data in the present case.
The relevant provisions of the GDPR in the present case are the following:
GDPR Recital 35: Personal health data include the data subject
health data which provide information on the past,
current or future physical or mental health. These include: a
personal data relating to a natural person which are provided to the individual in accordance with Directive 2011/24 / EU
for the purposes of healthcare referred to in Directive (9) of the European Parliament and of the Council
during registration or provision of such services, the natural person
number, sign or data assigned to it for individual identification for health purposes,
any part of the body or constituent material of the body, including genetic data and biological samples
- information resulting from testing or examination, and any, such as the data subject
illness, disability, disease risk, medical history, clinical treatment or
information on its physiological or biomedical condition, whatever its source, which
it can be, for example, a doctor or other healthcare professional, a hospital, a medical device or in vitro
diagnostic test.
GDPR Article 4, point 15: "health data" means the physical or mental health of a natural person
personal data, including health care provided to the natural person
services that also carry information about the natural person’s health
status.
GDPR Article 5 (1) (c): Personal data for the purposes of data processing
they must be appropriate and relevant and limited to what is necessary
(“Data saving”).
GDPR Article 6 (1) (b) and (c) and (3): Processing of personal data only
lawful if and to the extent that at least one of the following is met:
(b) the processing is necessary for the performance of a contract to which one of the parties is a party, or
necessary to take steps at the request of the data subject before concluding the contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
3. The legal basis for the processing referred to in points (c) and (e) of paragraph 1 shall be determined by:
(a) Union law, or
(b) the law of the Member State to which the controller is subject. 7
The purpose of the processing shall be defined by reference to this legal basis or in paragraph 1 (e)
with regard to the processing of such data, it must be necessary in the public interest or in the public interest
task performed in the framework of the exercise of a public authority delegated to a data controller
to implement. This legal basis may include adjustments to the application of the rules contained in this Regulation
provisions governing the lawfulness of data processing by the controller
conditions, the type of data which are the subject of the processing, the data subjects, the legal
with which personal data may be communicated and the purposes of such communication for the purpose of data processing
restrictions on the duration of data storage and data processing operations, as well as other
data management procedures so as to ensure lawful and fair data management
measures, including those set out in Annex IX. for other specific data management situations as defined in Chapter
for. Union or Member State law must pursue a public interest objective and be proportionate
for the legitimate aim pursued.
GDPR Article 9 (1): Racial or ethnic origin, political opinion, religion or belief
personal data referring to worldviews or trade union membership, and
genetic and biometric data for the unique identification of natural persons, health
data and on the sexual life or sexual orientation of natural persons
the processing of personal data is prohibited.
GDPR Article 12 (1): The controller shall take appropriate measures to ensure that
referred to in Articles 13 and 14 concerning the processing of personal data
information and Articles 15 to 22. and 34, each information in a concise, transparent, comprehensible and
in an easily accessible form, in a clear and comprehensible manner, in particular:
for any information addressed to children. The information shall be provided in writing or otherwise -
including, where appropriate, the electronic route. Oral information at the request of the data subject
provided that the identity of the data subject has been otherwise established.
Article 58 (2) (b), (d) and (i) GDPR: Acting in the corrective power of the supervisory authority:
(b) condemn the controller or the processor if his or her data processing activities have infringed this
provisions of this Regulation;
(d) instruct the controller or processor to carry out its data processing operations, where applicable
in a specified manner and within a specified period, in accordance with the provisions of this Regulation;
(i) impose an administrative fine in accordance with Article 83, depending on the circumstances of the case
in addition to or instead of the measures referred to in paragraph 1;
Article 83 (1) to (2) and (5) (a) to (b) of the GDPR: 1. Each supervisory authority shall ensure that:
infringements of this Regulation referred to in paragraphs 4, 5, 6
administrative fines should be effective, proportionate and dissuasive in each case.
2. Administrative fines shall be imposed in accordance with Article 58 (2) (a) to (2), depending on the circumstances of the case.
It shall be imposed in addition to or instead of the measures referred to in points (h) and (j). When deciding that
whether it is necessary to impose an administrative fine or the amount of the administrative fine
In each case, due account shall be taken of the following:
(a) the nature, gravity and duration of the breach, taking into account the nature of the processing in question;
the scope or purpose of the infringement and the number of persons affected by the infringement and by them
the extent of the damage suffered;
(b) the intentional or negligent nature of the infringement; 8
(c) the mitigation of damage suffered by the data subject by the controller or the processor
any measures taken to
(d) the extent of the responsibility of the controller or processor, taking into account the
Technical and organizational measures taken pursuant to Article 32;
(e) relevant infringements previously committed by the controller or the processor;
(f) the supervisory authority to remedy the breach and the possible negative effects of the breach
the extent of cooperation to alleviate
(g) the categories of personal data affected by the breach;
(h) the manner in which the supervisory authority became aware of the infringement, in particular
whether the controller or processor reported the breach and, if so, in what detail;
(i) if, previously against the controller or processor concerned, on the same subject matter,
ordered one of the measures referred to in Article 58 (2), the
compliance with measures;
(j) whether the controller or processor has considered itself approved in accordance with Article 40
codes of conduct or approved certification mechanisms in accordance with Article 42; and
(k) other aggravating or mitigating factors relevant to the circumstances of the case, such as:
financial gain obtained or avoided as a direct or indirect consequence of the infringement
loss.
5. Infringements of the following provisions in accordance with paragraph 2 shall not exceed 20 000 000
With an administrative fine of EUR 1 million or, in the case of undertakings, the previous financial year in full
amounting to a maximum of 4% of its annual worldwide turnover,
a higher amount should be charged:
(a) the principles of data processing, including the conditions for consent, in accordance with Articles 5, 6, 7 and 9;
(b) the rights of data subjects under Articles 12 to 22. in accordance with Article
Infotv. Pursuant to Section 2 (2), the General Data Protection Decree is indicated therein
shall apply with the additions provided for in
Infotv. Pursuant to Section 60 (1), the enforcement of the right to the protection of personal data
In order to do so, the Authority may initiate ex officio data protection proceedings. The data protection authority
procedure CL of the General Administrative Procedure of 2016. Act (hereinafter: Act)
rules shall apply with the additions specified in the Information Act and the general data protection
with derogations under this Regulation.
Infotv. Section 61 (6): Until the expiry of the time limit for bringing an action open to challenge the decision,
or, in the case of the initiation of an administrative lawsuit, until the final decision of the court is involved in the disputed data processing
data cannot be deleted or destroyed.
Infotv. Section 71 (2): The Authority shall obtain a document or data lawfully obtained in the course of its proceedings
you may use another means of proof in another procedure.
Infotv. 75 / A. § the Authority in Article 83 (2) - (6) of the General Data Protection Regulation
shall exercise its powers in accordance with the principle of proportionality, in particular by:
legislation on the processing of personal data or in a binding act of the European Union
for the first time in the event of a breach of the rules, to remedy the breach
in accordance with Article 58 of the General Data Protection Regulation, in particular the controller or
by alerting the data controller. 9
Section 9 (2) (b) and (c) of the Government Decree (in force between 1 July 2019 and 29 February 2020)
time status): The loan agreement contains the beneficiaries
(b) a statement that the 12th week of pregnancy and the expected date of confinement
are certified by the maternity care book and contribute to the management of this data,
(c) a statement that, if not after the birth or adoption of the child
claim family support or, if they are claimed at a family
the child's birth certificate, official certificate proving the address and tax certificate,
or, in the case of an adopted child, the final decision authorizing the adoption, and
an official identity card and a tax certificate proving the residence of the adopted child, and
in a private document of full probative value
living in the household or, in the event of the death of the fetus, in accordance with Annex 3
a document with a specific content, in the case of stillbirth, on the examination of the dead and with the dead
or a child born alive
in the event of his death, a death certificate certifying that this has taken place, within a maximum of 60 days
presented to the credit institution and consent to the management of that data.
Government Decree § 14 (1) and (4): Beneficiaries to suspend repayment
eligible
(a) after a fetus of at least 12 weeks of gestation, if the gestation is due to the loan application
on or after the date of submission of the loan and at the latest from the disbursement of the loan
reaches the 12th week of pregnancy within a period of 5 years, or
(b) adopted after the entry into force of this Regulation and adopted jointly by the beneficiaries
after the child, if the decision authorizing the adoption after the submission of the loan application, but
it will become final no later than 5 years after the disbursement of the loan.
4. An application for suspension of repayment shall be submitted to the credit institution. Attach to the application
the documents specified in Section 9 (2) (b) and (c), respectively.
Section 19 (1), (2), (5), (7), (8) of the Government Decree: The supported persons in paragraph (2)
meets certain conditions
(a) in the case of their second child, 30% of the outstanding debt under this Regulation
amount,
(b) in the case of their third child, corresponding to the total outstanding debt under this Regulation
amount
are entitled to a non-refundable childbirth allowance.
(2) Childbirth allowance
(a) in the event of pregnancy occurring on or after the date on which the loan application is submitted,
may be claimed after a fetus of at least 12 weeks of gestation for beneficiaries, and
(b) adopted after the entry into force of this Regulation and adopted jointly by the beneficiaries
may be applied for after a child if the decision authorizing adoption is the submission of a loan application
becomes final after.
5. An application for child-raising allowance shall be submitted to the credit institution. Attach to the application
the documents specified in Section 9 (2) (b) and (c), respectively.
(7) The fulfillment of the eligibility conditions shall be established by the credit institution on the basis of the submitted certificates.
(8) In the case of recourse to childbirth allowance with regard to the fetus, the childbirth allowance
the expected date of confinement must be indicated when the allowance is fixed.
26/2014 on pregnant care. (IV. 8.) of EMMI Decree 1
the contents of a pregnancy care book. 10
About the identification methods that replace the personal identification mark and the use of identification codes
XX of 1996 (hereinafter: Szaztv.) Section 7 (2): The data controller who is appointed by law
does not authorize the use of an identification code, the identification code specified in § 6 can only be used by the citizen
preliminary, in accordance with Article 4 (11) of Regulation (EU) 2016/679 of the European Parliament and of the Council
with your consent or with the consent given in the administrative order.
The Szaztv. § 23 determines which bodies are entitled to manage the TAJ number and for what purpose.
ARC. Decision:
IV.1. The need to process personal data recorded in the pregnancy care book
(28) Pursuant to Section 9 (2) (b) of the Government Decree - in force at the beginning of the official proceedings -
the beneficiaries must declare at the time of concluding the loan agreement that:
the 12th week of pregnancy and the expected date of delivery with a pregnancy care book
verify and consent to the processing of this data. The 12th week of pregnancy and the
proof of the expected date of confinement is required if the fetus is 12 weeks old
the assisted couple wishes to claim a discount, ie to suspend the repayment, or
childbirth allowance.
(29) Section 14 (4) and Section 19 (5) of the Government Decree provide that the repayment
application for childcare allowance or childbirth allowance a
must be submitted to a credit institution providing a baby waiting loan, to which the Government Decree must be attached
Documents pursuant to Section 9 (2) (b) and (c). The Government Decree does not define that submission
how the term is to be understood, as a presentation at the bank branch when submitting the application or as a document
a copy to the application. Subject to Section 9 (2) (b) of the Government Decree
which is only expected for the 12th week of pregnancy and childbirth
and that from 13 June 2020 the Government Decree § 9 (2)
In accordance with paragraph 2 (b), the above data shall relate to obstetrics with the content specified in Annex 2.
may also be attested by a certificate issued by a gynecologist, in the opinion of the Authority
submission shall be construed in a narrower sense as a presentation.
(30) What data should be recorded and what data can be recorded in pregnancy care
26/2014 on Pregnancy Care. (IV. 8.) EMMI Decree (hereinafter: EMMI
Regulation). In the pregnancy care book, the pregnant woman is natural
In addition to the personal identification data, the social security number is indicated
sign, place of residence, place of residence, place of work, occupation, education, telephone number, a
the name and address of the next of kin (page 1). They shall also indicate:
data on those involved in maternity care, ie the area nurse, the GP, the obstetrician, the
various details of a gynecologist or midwife, e.g. name, address, phone number, email address
(Page 2).
(31) At the expected time of confinement or in addition to the fact that the obstetrician-gynecologist
in which week the pregnant woman appeared - from which it can be calculated that the 12th week of pregnancy
when loaded - a number of additional details will be recorded in the pregnancy care book,
some of which are health data. The pregnancy care book contains the pregnant woman
blood group, risk classification of pregnancy, data on previous births and pregnancies (3.
side). These data include that if a pregnant woman has already given birth,
when was she born, in how many weeks of pregnancy, how many grams was the newborn born, what was it like 11
whether its position - cranial position, pelvic end, transverse position - was there any
complication during labor, vaginal delivery - episiotomy or barrier protection, or
by gripping surgery or vacuum extraction - or by cesarean section, or that the child
what state of health you are in when you are admitted to another pregnancy.
(32) Data on ‘failed pregnancies’ indicate in which year, the number of pregnancies
how many weeks and how the pregnancy was terminated: with an artificial or spontaneous abortion, or whether it was
angina or ectopic pregnancy in a pregnant woman.
(33) In addition to the above, a history of diseases, diseases,
surgeries - developmental disorders in the parents' family, inherited diseases,
drug sensitivity or test finding (page 4). It is also recorded by the dentist
study findings (page 4), records of those involved in pregnancy care (pages 8-13),
in which they record when, in what week of pregnancy the size of the pregnant woman was
body weight, blood pressure, heart rate, abdominal circumference and the position of the fundus, as well as
symptoms observed during the studies and the therapy or measure recommended for them.
(34) Also included in the Pregnancy Care Book (pages 6-7) according to the EMMI Regulation
free, mandatory examinations - e.g. various blood tests, urine tests, ultrasound
tests or genetic testing (page 14) if the pregnant woman is 37 years of age at conception
assessment and any specialist comments, and when it was
the first day of the last menstrual period, usually how long a menstrual cycle is and what the birth is
expected date.
(35) The Authority notes that there is no explicit section in the Pregnancy Care Book in which
it could be indicated when the 12th week of pregnancy was loaded, it can only be calculated
may be from when, in what week of pregnancy the proof of pregnancy occurred.
This should or can be listed in two places in the pregnancy care book, first inside it
on page 7, which is completed by the nurse, and on page 7, “The ultrasound of intrauterine pregnancy
examination ’, completed by the obstetrician and gynecologist performing the examination.
(36) As acknowledged by the customer, the Client supported it in accordance with its general practice during the period considered
on a women’s pregnancy care book who, along with their spouses, applied for a baby-waiting loan
suspension of childbirth or childbirth allowance
made a copy for the 12th week of pregnancy, sometimes to varying degrees.
(37) The Authority examined the pregnancy books provided by the Client
made copies showing that […] the practice of each account was not uniform
the extent to which a copy of the pregnancy care book was made. Some […]
accounts copied the entire pregnancy care book, others only natural
pages with personal information and the expected date of delivery. Also a copy
attached is the Client, which was made exclusively from the page of the pregnancy care book on which the
specialist indicates the expected date of delivery. However, in addition to these, there are also copies
were made which did not contain the pages on which the expected date of confinement was given
or from which the 12th week of pregnancy could have been calculated.
(38) The data content of the copies of the pregnancy books of each beneficiary varies according to the
depending on the personal circumstances of the spouses, the number of their children or whether
at what stage of pregnancy did the Client turn to suspend the repayment, or 12
application for childbirth allowance, as the more advanced the pregnancy, the more
several test results are recorded in the pregnancy care book.
(39) In addition to the data specified in the EMMI Regulation, nurses and general practitioners are unique
comments have also been included in pregnancy books, e.g. how many days was the
the menstrual cycle of a pregnant woman at the age of 15 or the age of her first child
breastfed.
(40) The processing of data listed in the above paragraphs, in particular health data, is not
necessary to complete the 12th week of pregnancy and the expected date of delivery a
supported by the Client are certified to the Client, i.e. by the Client in the Pregnancy Books
data handled in copies - excluding the expected date of delivery and the pregnancy is loaded
are not appropriate for the purpose of data processing and are not
relevant, they go far beyond the required range of data and the Authority therefore concludes that
that the Customer has violated the principle of data protection pursuant to Article 5 (1) (c) of the GDPR.
IV.2. Handling of personal information contained in copies of maternity care books
legal basis
(41) Certain conditions for the use of the baby waiting loan and related aid are a
Government Decree, in addition to in accordance with Section 4 (4) of the Government Decree
a loan agreement may be concluded only with claimants who are covered by the credit institution's general internal rules
according to which it qualifies as creditworthy for the borrowing requested.
(42) According to Section 9 (2) (b) of the Government Decree in force during the period under review, the repayment
pause and childbirth allowance for the 12th week of pregnancy
and the expected date of confinement must be evidenced by the pregnancy record book if the
to apply for discounts to the Customer to submit the child
takes place before birth.
(43) The processing of this data by the Client is necessary in order to be able to ascertain the
the eligibility of applications for benefits and the benefits
can ensure the use of this data between the beneficiaries and the
necessary to fulfill the contracts concluded between the beneficiaries. That doesn't change that
nor that as a condition for the use of the grant the processing of these data by Government Decree
makes it binding on the Client within the framework of the contractual relationship. Therefore, the
data on the completion of the 12th week of pregnancy and the expected date of delivery, which
the legal basis for the processing of a pregnant woman's personal data under Article 6 of the GDPR is Article 6 (1) of the GDPR
paragraph (b).
(44) It should also be emphasized that the fact of pregnancy is in itself the health of the pregnant person
including how many weeks of pregnancy you are going and when you are expected to
to give birth. According to Article 9 of the GDPR, personal data are personal data
and their handling is, in principle, prohibited. Health data legally
they can only be dealt with if one of the legal bases set out in Article 6 (1) of the GDPR
In addition, there is a circumstance within the meaning of Article 9 (2) of the GDPR.
(45) Article 9 (2) of the GDPR does not contain an exception which is expressly a contract
would allow the processing of health data in order to meet Article 9 (2) of the GDPR
(a), health data may be processed if one or more of the specific data subject 13
express consent. According to Section 9 (2) of the Government Decree, the spouses a
they must expressly state in the loan agreement that the 12th week of pregnancy
contribute to the processing of data on the loading and expected date of confinement,
that is, the Government Decree apparently settles the legal basis for the processing of health data. THE
In the Authority's view, the contribution is voluntary as one of the contributions
whether the condition of validity is fully enforced during the data management is questionable, since a
without the prior consent of the contracter at the time of conclusion of the contract
no loan agreement would be concluded.
(46) The Client may not review or act on the laws of the Member States which govern it
on the contrary, the Authority finds that in the case of spouses who have
they wish to take advantage of the benefit provided for in the Government Decree with regard to their fetuses,
legally manages the 12th week of pregnancy and the expected date of delivery
data.
(47) The Client shall lawfully manage the data contained in the pregnancy care book in addition to the
spouses ’natural identity and contact information, and the pregnant woman
data on the occupation and education of the Client, which is managed by the Client and the
necessary for the performance of a contract between spouses, including before the conclusion of the contract
credit assessment - and, on the other hand, to fulfill its various legal obligations, e.g. money laundering and
contributing to the prevention and deterrence of terrorist financing. These
the Client has an appropriate purpose and legal basis for its management.
(48) The Authority has a copy of the TAJ number of the pregnant woman in the copy of the pregnancy care book
considers it necessary to emphasize that the TAJ number is in line with the Szaztv. according to
an identification code that is handled and transmitted only by statutory rules
that is, that is, the data controller who is not authorized by law to use the TAJ number
only with the consent of the GDPR concerned in accordance with Article 4 (11). The Szaztv. Section 23
also determines which bodies are authorized to manage the TAJ number, for what purpose,
however, no financial institutions are listed among them, nor is there any other sectoral law
authorizes them, and the parties concerned have not demonstrably contributed to the TAJ
for their handling by the Client, ie they are managed by the Client without a legal basis.
(49) Section III.1 of the Decision. The treatment of the health data described in
(45), supplemented by the fact that the processing of these data is not limited to Article 9 of the GDPR.
None of the circumstances set out in Article 2 (2) apply, but also to the Client
admittedly, it does not have a legal basis under Article 6 of the GDPR. In the Pregnancy Care Book
pregnant women have not demonstrably contributed to the processing of the health data
they are not necessary for the fulfillment of the loan agreement - not including the pregnancy
12th week and the expected date of delivery - their management by the Client
not necessary to fulfill its legal obligation. In addition, the Customer is in the public interest
does not perform a task, does not exercise public power, the data management of the data subjects or other natural
protection of personal vital interests is not necessary, as well as the Customer these
cannot present a legitimate interest in the management of those concerned
rights and freedoms.
(50) The findings made in the previous paragraph with regard to Article 6 (1) of the GDPR are as follows:
personal data not mentioned as hitherto, which do not qualify as health data - who is the pregnant woman
GP, nurse, dentist. 14
(51) In the Authority’s view, the Client should have recognized that the Government Decree
It shall apply subject to the provisions of the GDPR and in conjunction with that legislation
a prudent, proportionate data management practice in line with the principles of data management
to design.
(52) On the basis of the above, the Authority concludes that by the 12th week of pregnancy, the expected
with the exception of the data referred to in point (47) of the Decision
all additional data in pregnancy books, including health data
the Client did not have an adequate legal basis for dealing with the breach, in breach of Article 6 (1) of the GDPR.
as well as Article 9 (1) of the GDPR as regards health data.
IV.3. Necessity and legal basis for the processing of the data recorded in the final reports
(53) According to Section 9 (2) (c) of the Government Decree - in force during the period under review - the subsidized
persons must also declare their commitment, dead, when concluding the loan agreement
in the case of birth or miscarriage, a certificate certifying that this has taken place within a maximum of 60 days a
presented to the credit institution and contribute to the management of that data.
(54) Section 14 (4) and Section 19 (5) of the Government Decree provide that the repayment
application for childcare allowance or childbirth allowance a
must be submitted to a credit institution providing a baby waiting loan, to which the Government Decree must be attached
Documents pursuant to Section 9 (2) (b) and (c). The Government Decree does not define that submission
how the term is to be understood, as a presentation at the bank branch when submitting the application or as a document
a copy to the application. Section 9 (2) (c) of the Government Decree expressly
it provides for the presentation, not the copying, of the documents listed there.
(55) The Client made a copy of the final report on the miscarriage of two subsidized women to the
period in order to verify the above. The final report is a natural identity for women
In addition to the data, it includes the tests performed, the therapy used, and the tests performed
description of the intervention. The health status of women, the examinations, their results, the performed
information on interventions, as well as the fact of miscarriage, Article 4 (15) of the GDPR
health data which are not necessary for the fact of a miscarriage
inappropriate and irrelevant to achieve the purpose of the data processing, therefore the
Authority finds that by handling these, the Client has violated Article 5 (1) of the GDPR
(c).
(56) The Authority finds that, as explained in point (49) of this Decision, the Client does not
in addition to the fact of the abortion and the date thereof, in the final report
in breach of Article 6 (1) of the GDPR,
and Article 9 (1).
IV.4. Information on data management during the application and granting of a baby waiting loan
transparency
(57) The Client provides information in several different documents regarding the application for the baby waiting loan, respectively
in the case of the conclusion of a loan agreement, of the data processing carried out in the course of that agreement, which
documents on the Client 's website, under the […] tab, collected in a clickable form and
grouped under […] addresses are easily accessible. 15
(58) The Authority shall assess the adequacy of the information provided by the Client on the processing of personal data a
examined on the basis of the following documents: […] prospectus; […] Prospectus (a
hereinafter referred to as the Data Management Information); […] (Hereinafter: Application Form); […] (hereinafter:
Business Rules).
(59) According to the Code of Conduct […], the purpose, legal basis and processing of personal data
detailed rules, the data management rights of the Clients on the website and at the bank branches
detailed in the data management information provided. The Terms and Conditions expressly a
no further information on data management in connection with a baby waiting loan
contain.
(60) The prospectus […] is of a general nature and covers data processing of a general nature carried out by […],
thus also for the data management performed by the Client in connection with the baby waiting loan - in which
intends to provide data subjects with information on the aspects of the processing of their personal data.
(61) Section […] of the prospectus sets out the possible processing of data by group members.
objectives in a general way, such as “interest in a service, requesting a service
procedure "or" conclusion of a contract, performance of a contract ". Data management is possible
its legal bases are listed in point […]. The scope of managed data under the title is managed data
categories are described, for example […].
(62) In Section […], the Data Protection Prospectus describes in a similar way to Prospectus […] the
the possible purposes of data management, which are detailed in […].
(63) In […], the Customer defines the processed data for data management purposes, their
"Types", the legal basis for the processing and the retention period uniformly for all […]
in connection with the service. This means that the prospectus is not broken down into individual financials
products separately, e.g. mortgage loan, personal loan, baby waiting loan, family
home creation discount, etc. As a result, any personal data or personal information
data category is listed among the managed data for which you have some type of credit or
necessary for the performance of the contract by the Client during the provision of a cash loan.
(64) In the Authority's view, the definition of the purpose of data processing alone is' with the Bank
data processing required for the performance of a contract ”is too broad, not specific, precise and
final, it is difficult to determine what the aspects of the contract are and
related data management is included because e.g. […] the provision and provision of the service
for the customer as a separate data management purpose, although the general meaning of the words, and
Chapter according to the concept of contract, performance of the contract is nothing more than under contract
provision of a service to be performed.
(65) In the Authority's view, in order for the data management to be transparent to the Client
set more specific data management goals, such as the 12th week of pregnancy and
the purpose of the processing of personal data concerning the expected date of delivery is that the Client sets
be able to verify the legitimacy of the claim or subsequently verify that the grant is supported
persons wish to take advantage of the benefits provided for in the Government Decree with regard to their fetus. THE
Authority does not dispute whether the suspension of repayment or childbirth allowance
is provided within the contractual relationship during the performance of the contract, but the
in the absence of a sufficiently specific definition of data management purposes for data subjects
it is clear why they need to make some of their data available to the Client. 16
(66) In the Authority’s view, the data and categories of data processed in the Data Management Information Sheet […]
its listing in this way does not meet the requirement of transparency either, since it is there
approximately all personal information that the Customer has any credit is listed
or in connection with a loan agreement. As a result, it is difficult for those involved to be convinced
that the fulfillment of their credit or loan agreement with the Client, certain aspects thereof
exactly what information they will need to provide. In the present case, for example, a
Beneficiaries do not have to provide a
details of their property insurance or details of their property sold to the Client within five years, as
these data are irrelevant to the credit they use, while, for example, fetal data is one
they are not relevant in a personal loan agreement. In this regard, the Authority also
notes that it is not entirely clear exactly what data the Client understands
fetal data, as the fetus is not yet legal, the 12th week of pregnancy and the
data on the expected date of delivery are the health data of the mother.
(67) In addition, the Data Protection Information Statement states that the purpose of data processing is to:
fulfillment of the reporting obligation to the Hungarian State Treasury (hereinafter: MÁK).
It does not appear from the Data Protection Information that such a reporting obligation is
When it exists for a customer, it affects what kind of contract stakeholders.
(68) Section 26 of the Government Decree also prescribes the obligation to provide information to the MÁK for control purposes, and
specifies which of the persons supported or the child born
must transfer your personal data to the Customer. Defined in the Privacy Policy
the scope of data does not correspond to the scope of data specified in the Government Decree, e.g. the Data Management
is not indicated in the prospectus of the identity card of the supported persons, travel
document or card format driving license number as data to be transmitted [Gov.
Section 26 (1) (bd) of the Decree].
(69) The Application Form must indicate the identity of the applicants for the baby loan, the credit assessment
necessary personal data, data of the requested loan, statements according to the Government Decree,
which are necessary to establish the eligibility conditions, and […].
(70) Under the heading “[…]”, the Client essentially agrees with the contract, its conclusion and conditions.
provides information on a total of […] points. The Government has been inserted in point […].
statements concerning data processing pursuant to Section 9 (2) of the Decree. According to point […]
and [consent to the processing of their personal data]. In the Authority 's view,
privacy statements should have been separated by the Customer from other contractual
provisions in the interests of transparency. Furthermore, the wording of point […] is incorrect
may give the impression to those concerned that their personal data provided on the Application Form
their legal basis for their management.
(71) In the light of the above, the […] prospectus, the Privacy Notice and the Application Form
The information provided by the customer on the handling of personal data is not transparent, not sufficiently
specific and not suitable for the persons concerned to know and see through the personal
process of handling their data and be aware of exactly which Customer is
for what purpose and on what legal basis they process their personal data. The Authority finds that
Customer does not provide clear and transparent information to those concerned about the baby waiting loan
and the processing of data during the life of the concluded loan agreements
Article 12 (1) of the GDPR 17
IV.5. Legal consequences
(72) The Authority finds that the Client has infringed Article 5 (1) (c) GDPR, Article 6
Article 9 (1), Article 9 (1) and Article 12 (1).
(73) Pursuant to Article 58 (2) (d) of the GDPR, the Authority instructs the Client to
electronic of the pregnancy books and final reports available to him
delete copies, destroy paper-based copies, and credit for doing so
duly substantiated to the Authority.
(74) Pursuant to Article 58 (2) (d) of the GDPR, the Authority instructs the Client to restructure the
application for a baby waiting loan and data management during the concluded contracts
information practice in such a way as to comply with Article 12 (1) of the GDPR
transparency requirements.
(75) The Authority has examined whether it is justified to impose a data protection fine on the Client. E
In particular, the Authority considered all the circumstances of the case under Article 83 (2) of the GDPR.
In view of the circumstances of the case, the Authority found that it had been identified in the present proceedings
in case of infringement - Infotv. 75 / A. § - warning is disproportionate and dissuasive
sanction and therefore a fine should be imposed.
(76) In particular, the Authority took into account that the nature of the infringements committed by the
in accordance with Article 83 (5) (a) and (b) of the GDPR
constitute an infringement falling within the category of fines.
(77) In setting the fine, the Authority took into account the following as aggravating circumstances:
• Infringements committed by Customer are considered serious infringements as follows
[Article 83 (2) (a) GDPR]:
o Infringements found - breach of the principle of data protection, legal basis
without prejudice to the transparency of data processing and the transparency of information,
were continuous in nature, given that during the period considered
persisted .;
o The infringement affects a large number of persons concerned [Article 83 (2) (a) GDPR]:
▪ personal data in connection with the baby waiting loan
Infringement by inadequate information on the management of
Clients are all baby waiters who have a loan agreement or are waiting for a baby
affects your customer in need of a loan. The Client did it during an official inspection
According to the statement, during the period under review, […] persons requested a baby waiting room
a loan, of which the Client has entered into a contract with […] persons;
▪ the health data in the pregnancy care book is illegal
treatment involved a total of […] women during the study period.
o The subject of the present case is a financial arrangement in which the Client
contractual partners in families or in any special life situation
women who are in their most personal life situation during childbearing
they come into contact with the Client to ensure the existential future of their family
in order to. The Authority considers the attached documents from the circumstances of the present case
on the basis of which he concluded that he was particularly violating his privacy by having children
personal and health data relating to such numbers are of a general nature
his treatment.
• Customer has a significant amount of personal information that is a special category
prepared health data on pregnancy books without a legal basis
copies and the two final reports [Article 83 (2) (g) GDPR];
(78) The Authority considered the following as mitigating circumstances:
• In connection with the personal data handled by the Client in the copies of the pregnancy books
admitted to them - not including the 12th week of pregnancy and childbirth expected
unlawfully handled and ordered the erasure of the copies,
or destruction. [Article 83 (2) (c) GDPR];
• Customer has reviewed its applicable data management practices and terminated the
copying pregnancy books and final reports for the future. Sample certificates
the introduction and application of which are suitable so that they cannot be avoided in the future
line can again be used to process data in the context of a baby waiting loan
grants which are not necessary to achieve the purpose of the processing and which
has no legal basis for dealing with it. [Article 83 (2) (f) GDPR];
• The Government Decree did not fully regulate the issues of data management, it did not decide
clearly state how the data will be handled (eg submission under the word presentation or
copying), thus creating an uncertain legal situation in matters of data management
created at baby-waiting loan financial institutions, including the Client. The Authority
considers it necessary to note that in such a case the data controller is concerned with the data processing
decisions need to be made even more carefully when applying data protection legislation
and in particular to enforce data protection principles. [Article 83 (2) GDPR
paragraph (b) and (k)].
(79) In imposing the fine, the Authority also took into account that the Client had not committed
previously relevant data breach. GDPR Article 83 (2) (e)]
(80) In imposing the fine, the Authority did not consider Article 83 (2) (d), (h),
(i), (j), as they cannot be interpreted in the light of the specific case.
(81) The total amount of the Client's balance sheet in 2019 was HUF […] million, HUF […] million.
(82) The amount of the fine was determined by the Authority in accordance with its statutory discretion.
V. Other issues:
(83) The powers of the Authority are limited by Infotv. Section 38 (2) and (2a), its jurisdiction is
covers the whole country.
(84) The decision is based on Article 80.-81. § and Infotv. It is based on Section 61 (1). The decision is based on Ákr. 82.
§ (1), it becomes final with its communication. 19
(85) Art. § 112 and § 116 (1) and § 114 (1), respectively
there is a right of appeal against an administrative action.
(86) The rules of administrative litigation are laid down in Act I of 2017 on the Procedure of Administrative Litigation (a
hereinafter: Kp.). A Kp. Pursuant to Section 12 (1) by a decision of the Authority
The administrative lawsuit against the court falls within the jurisdiction of the court. Section 13 (3) a)
The General Court has exclusive jurisdiction under subparagraph (aa) of A Kp. Section 27 (1)
Legal representation shall be mandatory in proceedings falling within the jurisdiction of the General Court under paragraph 1 (b).
A Kp. Pursuant to Section 39 (6), the filing of an application is an administrative act
has no suspensive effect.
(87) A Kp. Section 29 (1) and with this regard Pp. Applicable pursuant to Section 604, electronic
CCXXII of 2015 on the general rules of administration and trust services. Act (a
hereinafter: E-Administration Act) pursuant to Section 9 (1) (b) of the Customer's legal representative
obliged to communicate electronically.
(88) The time and place of the submission of the application are set out in Kp. Section 39 (1). THE
Information on the possibility to request a hearing can be found in Kp. Section 77 (1) - (2)
based on. The amount of the fee for an administrative lawsuit is set out in Act XCIII of 1990 on Fees. law
(hereinafter: Itv.) 45 / A. § (1). From the advance payment of the fee is
Itv. Section 59 (1) and Section 62 (1) (h) shall release the party initiating the proceedings.
(89) If the obligor fails to provide adequate evidence of compliance with the required obligation, the Authority will
considers that it has failed to fulfill its obligations within the prescribed period. The Acre. According to § 132, if a
the obligor has not complied with the obligation contained in the final decision of the authority, it shall be enforceable.
The decision of the Authority Pursuant to Section 82 (1), it becomes final upon notification. The Acre.
Section 133 of the Act - unless otherwise provided by law or government decree
- ordered by the decision-making authority. The Acre. Pursuant to Section 134 of the Act - if law,
a government decree or, in the case of a municipal authority, a local government decree otherwise
does not have - is carried out by the state tax authority. Infotv. Pursuant to Section 60 (7) a
Authority to carry out a specific act contained in a decision, specified
the decision as to the obligation to conduct, tolerate or cease
shall be carried out by the Authority.
Budapest, December 16, 2020
Dr. Attila Péterfalvi
President
c. professor
