NAIH (Hungary) - NAIH/2020/1154/9

NAIH - NAIH / 2020/1154/9
Authority:	NAIH (Hungary)
Jurisdiction:	Hungary
Relevant Law:	Article 6(1)(f) GDPR Article 12 GDPR
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:	23.07.2020
Published:	23.07.2020
Fine:	2000000 HUF
Parties:	n/a
National Case Number/Name:	NAIH / 2020/1154/9
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Hungarian
Original Source:	Hungarian DPA (in HU)
Initial Contributor:	n/a

he Hungarian DPA (NAIH) issued a fine against Forbes Hungary which published the list of the 50 wealthiest Hungarians and the list of the biggest family-owned businesses, for not performing a balance of interests prior to the publication and lack of information on the rights of the complainant.

English Summary

Facts

Forbes published the 50 wealthiest persons in Hungary and the biggest family-owned business. The data used for the publication had been collected from public sources, including the company register.

Dispute

How to assess the balance between legitimate interests and the freedom of press ? What should be the legal basis applicable here ?

Holding

The Hungarian DPA considered that the balance of interests should be performed before the publication and should be communicated to the complainant so that he can object to the processing of his data on the basis of Article 6.1.f.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.

Page 1
Case number: NAIH / 2020/1154/9Subject: Application in partHistory: NAIH / 2019/8402decision grantingBefore the National Data Protection and Freedom of Information Authority (hereinafter: the Authority ) […]applicants (hereinafter collectively referred to as the Applicants ), through their representative [[]),Mediarey Hungary Services Private Limited Company (address: 1061 Budapest,Andrássy út 12., company registration number: 01-10-140295; hereinafter referred to as "the applicant" ),Forbes Magazine ('Forbes'), published in the applicant' s edition, is published andillegal data processing related to its electronic publications, as well as those of the Applicantsfollowing a request for inadequate enforcementIn the data protection authority procedure, the Authority shall take the following decisions:I. The AuthorityIN ITS DECISION1. The applicants' application is granted in part1.1. and finds that the Applicant is with Forbes in September 2019published and published in the publication of the largest family businessesonline version (Data Management 1) and Forbes 50 released in January 2020for the printed and online version of the richest Hungarian publication(Data Management 2) in connection with related data managementown interests and the legitimate interests of themselves and third parties (the public) and theseHe did not inform the applicants in advance of the result of his comparison with the interestsApplicants, in breach of Article 6 (1) (f) of the General Data Protection Regulationpoint.1.2. The Authority further notes that by requesting that Data Management 1 andThe Applicants did not provide adequate information regarding data management 2 eitherall relevant circumstances of the data processing and the Applicants are personalthe right to object to the processing of personal data and the Applicantsdid not provide information in its replies to the requests forApplicants' access to justice, violated the general data protectionArticle 5 (1) (a), Article 5 (2), Article 12 (1) and (4) ofArticle 14, Article 15 and Article 21 (4).1.3. The Authority condemns the Applicant for unlawful data processing , at the same timeinstructs that1.3.1 within 15 days of the decision becoming finalcomply with the information management information available to Applicantsobligations, including those taken into account in the balance of interests,Applicant's and Applicants' Interests and Balance of Interestinformation on the outcome of the proceedings, information on the right to protest andinformation on enforcement options.1.3.2 if the Applicant is entitled to it during future planned data processinginterest as a legal basis, it shall, in accordance with the law andcarry out a balance of interests in the light of the provisions of this Decision,including a second, individual consideration of interests following the protest.
Page 2
21.3.3 pre-convert in accordance with applicable law and the provisions of this decisioninformation practices.2. The Authority shall reject the application in so far as it:2.1 of the Applicants request the Authority to order the limitation of data management,Deletion of Applicants' Personal Data and Requested Personal Datatreatment;2.2 the Applicants request that the Authority restrict the data processing by an interim measureand prohibit the disclosure of personal information.3. The Authority shall reject the part of the application concerning the imposition of a data protection fine ,however, due to the violations found, the Debtor ex officioHUF 2,000,000, ie HUF 2 milliondata protection fineobliges to pay.No procedural costs were incurred during the official proceedings and therefore no costs were incurredprovided by the Authority.The data protection fine is the starting point for initiating a judicial review15 days after the expiry of the time limit or, in the case of initiation of a review, after the decision of the courtthe Authority’s centralized revenue collection special purpose forint account (10032000-01040425-00000000 Centralized direct debit account IBAN: HU83 1003 2000 0104 0425 00000000). Upon transfer of the amount, NAIH / 2020/1154/9 JUDGMENT. numberto refer to.Failure by the Applicant to meet its obligation to pay the fine within the time limit shall result in delayis required to pay a supplement. The rate of the late payment interest is the statutory interest, which is in arrearsthe central bank base rate in force on the first day of the calendar half-year in question.Section 1.3.1. from the date of notification of the decisionin writing within 30 days of the date of entry into force of this Regulation, together with theto the Authority.The Applicant shall be notified of the decision 1.3.3. in order to comply with the obligation laid down inmeasures shall be taken in writing within 30 days of the date of notification of the decisiontogether with the submission of evidence, to the Authority.The Authority shall impose fines and periodic penalty payments or for failure to comply with the prescribed obligationsinitiate the implementation of the decision.There is no administrative remedy against this decision, but it is from notificationwithin 30 days of the application to the Metropolitan Court in an administrative lawsuitcan be challenged. The application must be submitted to the Authority, electronically, which is the caseforward it to the court together with its documents. Indicate the request for a hearing in the applicationmust. For those who do not receive a full personal exemption from judicial reviewprocedure fee is HUF 30,000, the lawsuit is subject to the right to record material fees. Before the Metropolitan Courtlegal representation is mandatory in proceedings.
Page 3
3II. The request for a finding of an infringement concerns the processing of data before 25 May 2018the Authority shall follow the data protection authority procedureIN THE PERFORMANCE OFeliminate , as the General Data Protection Regulation is not applicable for this period.There is no administrative appeal against this order, but it must be appealed against on the 30th day after notificationmay be challenged in an administrative lawsuit by an action addressed to the Metropolitan Court within one day. THEthe application shall be submitted to the Authority, electronically, together with the case fileforward it to the court. The request for a hearing must be indicated in the application. The entirefor those who do not benefit from personal exemption, the fee for the judicial review procedureHUF 30,000, the lawsuit is subject to the right to record material taxes. In the proceedings before the Metropolitan Court, the legalrepresentation is mandatory.EXPLANATORY STATEMENTI. FactsI.1. Period under investigationFor the first time, the Applicant was included in the August 2015 issue of Forbes"[…] Family" in the "Largest Hungarian family businesses" compilation. Subsequently, in 2019.The “Largest Hungarian Family” owned by the “[…] family” was included in the September issue.enterprises 2019 ”. In addition, the January 2020 issue of “RichestHungarians ”[…]. As a result of […], Forbes January 50, 2020the number containing the richest Hungarian list was recalled by the Applicant to Data Management 1and in the online version of the lists related to Data Management 2, the term […] and […]replaced by […].The Authority will follow this data protection authority procedure on 25 May 2018data processing activities, in particular the personal data of the Applicants (name, surname,property) and inadequate enforcement of the rights of the data subjecthe continued. For data processing prior to 25 May 2018, natural persons aprotection of individuals with regard to the processing of personal data and on the free movement of such data,and Regulation (EU) 2016/679 repealing Directive 95/46 / EC (ahereinafter "the General Data Protection Regulation")therefore the rules of the General Data Protection Regulation do not apply to them, so they areno request for a data protection authority procedure may be made in respect ofor the provisions of the General Data Protection Regulation in respect of such data processingThe Authority is not empowered to examine compliance with this data protection authority procedureframework.I.2. Data provided in connection with the Applicants in the publications examined during the procedureThe Applicants objected to the data management related to the following publications and lists:- Forbes released in September 2019, containing the largest family businessesprinted and online version of the publication (Data Management 1). [The online version ishttps://forbes.hu/extra/csaladi-lista-2019/#/ , and the specific article is […]available under the link.]
Page 4
4- Forbes released in January 2020 - and in the meantime […] recalled - 50 richestThe printed and online version of the Hungarian publication (Data Management 2) . [Onlineversion under the link https://forbes.hu/extra/50-leggazdagabb-magyar-2019/ , the specificand the article is available under […] .]For Data Management 1, the following content was released:- In the printed version, the name of the family ([…] family) is the business in which they have an interestname ([…]), estimated value of the enterprise ([…]), head office of the enterprise ([…]),year of establishment ([…]) and the number of generations interested in the business ([…])indication. The entry contains the following description:[…]- The online version originally included the family name, but this […]has been removed as a result and the term […] can be read instead. In addition, thebusiness name, estimated value, year of incorporation and generations interested in the businessnumber has been indicated. The online version has a shorter description, the entrycontains only:[…]- The full names of the Applicants were not included in either the printed or online versionsas no other family members were named. The Applicantshis portrait was not or is not included in either the print or online versions.For Data Management 2, the following content was released:- In the printed version, only […] of the Applicants were named, the publication isit did not contain any direct or indirect reference to another member of the family. In the publicationthe amount of […] 's estimated assets ([…].), the source of the estimated assets ([…]) has been indicatedand also his age ([…]). The article contained the following description:[…]- The printed version included one of the MNB's Growth Bond Programalso a box describing the purpose of the issue, which also included the name of […] and the volume of the issue.([…]).- The online version also originally included […] 's name, but this […]has been removed as a result and the term […] can be read instead, as well as on thisin addition, the estimated value of the property was also indicated. The online version is shorter anda slightly different description can be read:[…]- The portrait of the Applicants (including […]) is not available in either the printed or online versionscontained or contained.For Data Management 1 and Data Management 2, it is managed and disclosed by the Applicantprovided is not specific under Article 9 of the General Data Protection Regulationpersonal data (racial or ethnic origin, political opinion, religious or worldview)personal data indicating beliefs or trade union membership, as well as naturalgenetic and biometric data, health data andpersonal information about the sexual life or sexual orientation of natural personsdata) category.The publicly available data in the […] business register include the compilation of the objectionable lists andAt the time of its publication, it was found that […] and […] held management positions in theand that […] and […] are members (ie owners) of the undertaking. Although the members of […](owners) occurred on the day ()] of the members (owners)amended on [vált] and replaced […] and […] by […] and […]registration, that development is irrelevant to the case, not least because
Page 5
5publications, lists based on the data and information available and taken into account at that timehave been compiled.Data forming part of the public and public register of companies and / or the Applicantsin the accounts and on the website of the undertaking in which it has an interest, on […] , […] and […]In addition to the information under reference, for Data Management 1, […] is estimatedand for Data Management 2 […] (after the amendment: [módos])estimated assets from its activities have been disclosed.Although the (estimated) value of the company in which the Applicants have an interest, […] / […] (estimated)the amount of its assets is not part of the company register, it is not public data in the public interest,however, publications are not personal to Applicants (e.g., inherited, donated, married)acquired, etc.) are presented to the readership but to the businessand the amount of assets accumulated as a result of the business activityfrom publicly available company data, information, company reports and the companythe Applicant drew a conclusion from his own communications. The Applicant shall estimate these acollected data from public sources and then used them in a specific wayevaluated and communicated as an opinion.I.3. Correspondence between the Applicants and the ApplicantFor several correspondence between the Applicants and the Applicant regarding Data Management 1 and Data Management 2also took place. These exchanges of letters, which are set out in Annex III.4 to the Decision, at the point of concernwill be explained in detail in the context of the exercise of the right - the Authority willobligation to provide information, the balance of interests carried out by the Applicant and the ApplicantsGeneral Data Protection Regulation in response to requests from data subjects to exercise their rightsexamined and assessed for compliance with the relevant provisions ofI.4. Procedure, Statements made by the Applicants and the Requested ProcedureElectronic applications sent by the Applicants on 6 December 2019 and to the Authority on 6 December 2019.in their application received by post on 12 December and on 17 December 2019electronically and by application received by post on 19 December 2019.in their supplement, Data Management 1 and Data Management 2, as well as the Applicants ’such as prior information, access, rectification andthe right to protest - inadequate provision of objections and data protection authority proceedingsinitiated against the Applicant.In the application and its supplement, the Applicants stated the following:- The Applicant first implemented data collection in 2016 when the ApplicantsOn the basis of the data collected regarding the financial situation of the Company, the Applicants wished to be included in thein its publication summarizing the largest family businesses. The Applicants are already at this timestrongly protested against the data processing operations affecting them, as a result of which theApplicant then refused to disclose the data.- From the e-mail sent by the Applicant on 26 August 2019have been informed that they want the “[…] family” for the Requested Data Management 1indicated in the [[] context, so that […] discloses the financial position of the familycalculation of public company data of companies owned by Forbes and Forbes editorial staffbased on its methods.- The Applicants were informed of this by a letter sent by the Applicant on 26 August 2019that [[]] Forbes ’family business listings in previous years did not include […] because
Page 6
6based on the data for the given year and our estimates based on them, in our opinion notranked among the 25 largest companies. ” From this, the Applicants concluded thatthat the Applicant has also collected data about them in recent years, however, the Applicanthe did not inform them in any way.- According to the Applicants, the use of the term "[család] family" is misleading and untrueand the use of the term in this context infringes the rights of members of the […] family whowho are not members of the […] and also includes a reference to minor children. THEAccording to the register of companies, […] is not owned by the '[…] family' but by […]and […]. […] And […] are not owners, but only executives of the company,consequently, according to the Applicants, the effectiveness of […] isthe conclusion regarding the property relations of the executives is false.- On 30 August 2019, the Applicants submitted a request to the Applicant in whichfirstly, they protested against the processing of their personal data and secondly against informationrequested in connection with the processing of their personal data and also requested that the Applicantcorrect inaccurate personal information.- In its reply to the request for the exercise of the rights of the data subject, the Applicant:According to the applicants, it was not provided for in the General Data Protection RegulationProvided all the information listed in Article 15 and did not provide any informationtheir rights regarding the processing of their personal dataand the legal remedies available against the data processing.- The Applicants further submitted that the Applicant had not indicated in its reply thaton what legal basis he handles personal data did not indicate that the data processingnor did it pass on the result of the balancing test. THEApplicant raised the issue of informing the public as the purpose of data management, the Applicantsconsiders, however, that this objective does not create a legitimate interest on the part of thewhich would lawfully process personal data, and the Applicants ’privacy andhis right to privacy takes precedence over any legitimate interests of the Applicantopposite. The Applicants claim that for years they have been paying special attention to private andto separate their business and the confidentiality of their privacy, not in the pressthey make a statement, their possible manifestations strictly on business considerationsconcentrate.- The Applicants submitted that the publication containing the largest family businessesFollowing its release in September 2019 - information confirmed by policebased on - identified, persons with a criminal record appeared in the family propertyaround. While the family has previously been able to successfully protect its privacy, the Applicantsin his view, the Forbes list published in September 2019 directed it to Applicantsattention of criminal circles .- By e-mail of 6 November 2019, the Applicant informed theApplicants to be included in the case of Requested Data Management 2 as wellApplicants as individuals.- As in the previous request, that letter did not contain a general data protectionDecree 13-14. and was not included in the listthe person (s) and specific data to be included,on what legal basis Forbes would publish the Applicantspersonal data established on the basis of certain calculations, which the Applicants asthe financial situation of individuals. Excel spreadsheet attached to the letterits document name refers to the “[…] family”, so in the Applicants ’view, the Applicantalready deals specifically with data relating to Applicants as individuals. THEHowever, in the applicants' view, the '[…] family' is inaccurate personal data, as it isit contains a reference to all family members, including children, but […] is ownedits range is limited to […] and […]. Also, according to the Applicants, the alleged propertythe calculation of data on their situation is based on a method of calculation not described,
Page 7
7which […] and […] owns the company’s public company data and the Applicant’s ownbased on calculation methods. In connection with the calculation, the Applicant alone is an excelprovided a table which, according to the Applicants, was sent on 6 November 2019Contrary to its wording, it did not contain a description of the method of calculation.- The Applicants' lawyer sent to the Applicant on 15 November 2019letter of formal notice pursuant to Article 21 of the General Data Protection Regulationprotested against the data processing carried out by the Applicant concerning Applicants andthey were prohibited from accessing any personal data concerning themcollect and perform other data processing activities, includingdisclosure. Applicants were also prohibited from doing so - either by name ormentioned as a family, appear in the statement, either directly or indirectly,and called on the Applicant to provide the Applicants ’personal details without delaydelete them and do not carry out any data processing operations on them or on them.The Applicants are Article 18 (1) (a) and (d) of the General Data Protection Regulationalso requested a restriction on data processing and strongly called on theApplicant to refrain from publishing data concerning Applicants in generalcircumstances set out in Article 18 (1) (a) and (d) of the Data Protection Regulationas well as in the wake of the protest.- In its reply letter delivered on 20 November 2019, the Applicant is the Applicantsin its view, it provided incomplete information, such as no informationgiven to the Applicants by processing their personal datawhat rights they have in relation to them and what remedies are available against the processingthey can live. The Applicant also indicated as the legal basis for data processing withoutArticle 6 (1) (f) of the General Data Protection Regulationgeneral and the individual balance of interests required by the protestwould have provided information on the outcome. According to the Applicants, the information is notcomply with Articles 13 (2) (f) and 14 (2) of the General Data Protection Regulationg), as the Applicants do not know what their personal data islogically analyze the importance of data management and what it is for Applicantshas expected consequences. The duration of data processing is missing from the informationexact definition, and the Applicant did not comply with the Applicants' generalrequests for the exercise of data subject rights under the Data Protection Regulationdata processing in view of the fact that the Applicants indicate that the data are not accurate,nor has it complied with its obligation to cancel.In addition to the above, the Applicants made the following (additional) comments by the Applicantwith regard to the processing of personal data, as regards the legal background:- A 7/2014. Paragraph [62] of the explanatory memorandum to Decision AB (III. 7.) states that “[a]persons exercising public power and politicians in public office are also entitled toprotection of personality, if the value judgment does not identify their person in public affairs disputes, noin connection with their public activities, but also with their private or family lifein this connection. " With their private or family life outside the scope of debating public affairsinformation is considered protected even for public actors, so suchDisclosure of such information constitutes a serious breach of privacy by Applicantsaccording to.- According to the Applicants, satisfying the curiosity of society even thensufficient basis for interference with privacy, if otherwise in social decision-makingit is a person playing a role (BDT2017.3693). According to the Applicantsin particular, this protection applies to persons, including in relation to the Applicants, who:they cannot be regarded as public figures at all, since their activities do not fall within the scope of thepublic performance.
Page 8
8- Regarding the legal assessment of the data management of the press, according to the Applicantsthe position expressed in previous resolutions of the Data Protection Commissioner remains,according to which “[t] he case law also suggests that newspapers consider the aincreasing the number of copies, standing up to market competition, and, conversely, personalthe obligation to protect data is not sufficiently taken into account ".- The Applicants referred to a so-called meeting of representatives of the data protection authorities of the European Union.Working Group 29 WP 217 opinion that “the media cannot get generalauthority to take into account the privacy of public actorspublish a detail ’.- According to the Applicants, the case law of previous years is clear in that the“100 richest Hungarians” and other similar types of lists despite the protest of the person concerned(in connection with the similar list of Magyar Hírlap ABI1472 / A / 2003 or in connection with the Playboy list ABI 922 / A / 2000.resolutions). According to previous resolutions of the Data Protection Commissioner, “[t] heregarding who are not public figures, just wealthy people, I do not holdlawful of this procedure, as their names were published without their consentcontext. In my view, the mere fact that someone is wealthy, yetdoes not mean that he is also a public figure. Also for personal data published on the listensure the data subject's right to self-determination, in the absence of consent to personal datamay not be disclosed ' . Although the resolutions referred to are general privacybefore the entry into force of this Regulation, they are, in the view of the Applicants,differences still apply today.- The Applicants referred to the Authority's website at www.deres.tv “The bigbastard database 2. ” from photographs illegally published in the entrythat the database is capable of beingput stakeholders in a negative color so that they are in the crosshairs.- The Applicants also referred to the Authority's connection with the Serial List of the Watch Sheet.There was also Naihan / 2018/2618/6 / V resolution, which the Authority wrote that "thelisting is intended to provide stakeholders with a sense of negative social perception of data subjectswho do not qualify as public actors, do not take on a public role,and they do not wish to influence the public by their activities. "- In the context of Article 85 (3) of the General Data Protection Regulation, Hungary is as followsnotified relevant legislation: Act V of 2013 on the Civil Code(hereinafter: the Civil Code) 2:44. § (in connection with the free debate on public affairs); on freedom of the pressand the CIV of 2010 on the basic rules of media content. Act (hereinafter:Smtv.) § 4 (3) (principles) and § 6 (resource protection). Position of the Applicantsaccording to which at most the mentioned legal points could be invoked by the Applicant, aArticle 6 (1) of the General Data Protection Regulation in the context of freedom of the pressto establish a legitimate interest under point (f); otherwise for data management onlythe provisions of the General Data Protection Regulation apply directly.- According to the Applicants, the existing infringement is based on the principle thatsubstantiated or presumed allegations concerning the property of a person -regardless of the size of the property - to the information that belongs to the narrowest circle of the given personthey are thus fully integrated into the individual 's privacy, andthey have a direct effect on, among other things, the judgment and acceptance of the given personand in some cases for safety.- Applicants for the safety of the whole family, including minor family membersproperty has been kept strictly confidential for years in order to preserve and maintain ittheir situation. The success of […] was not hidden, but its details and individualsthe amount of assets due was never declared. You are real in the pressFalse information may directly or indirectly affect Applicants or their familiesadditional members of the quality of life of the various security measures and personnel
Page 9
9as a result of its application. According to the Applicants, the lives of minor children andto protect their safety only in a way that adversely affects the spiritual development of childrenfeasible, and future implications are unpredictable and one-offthe appearance of the press also results in the development of an irreversible feeling of fear in the "[…] family"members, regardless of whether their lives, physical integrity, wealth are smaller or largerwhether there is a direct or indirect threat.- According to the Applicants, the purpose indicated by the Applicant (public opinionexercise of the right to freedom of the press) is not real because thethe situation paints a false picture of the natural persons behind the '[család] family',it gives the appearance that the whole “[…] family” is wealthy. According to the Applicants, certainwith regard to the presentation of the financial situation of individuals (ie not public actors)the processing of their personal data cannot be a legitimate aim, as the public is therebynot properly informed.- According to the Applicants, if the purpose is to inform the publicthe Applicant wishes to achieve, it must be obtained from each individual concernedobtain their consent, otherwise calculated by name, company name, unique methoddisclosure of assets constitutes unauthorized data processing. According to the Applicantsthe purpose of the data management is not the same as the purpose for which the business register orreport handles the personal data of the Applicants and consequently the wider personalThe processing of the personal data of the “[…] family” concerning the circle by the Applicant is not purposeful, thusillegal.- Condition for reference to Article 6 (1) (f) of the General Data Protection Regulation(Also in relation to Data Management 1 and Data Management 2) is that the Applicant as data controllercarry out a balancing test and inform the data subject of the result. Thein a balancing test, the controller must demonstrate that it has a legitimate interestfor data enforcement to be necessary and proportionate intervention by the data subjectto his private sphere. An interest balance test was not issued by the Applicant to the Applicantsavailable to you.- According to the Applicants, it also applies to Data Management 1 and Data Management 2,that information based on speculation containing false information may not be appropriateaccurate information to the public and that the processing also applies to personsfor whom there is no public interest. The Applicantsinformation on his or her privileged position, whether real or falsedisclosure has a significant impact on the perceptions, relationships,acceptance, and even personal safety, moreover, in the “[…] family” it isMinor children are also included, who have increased protection from general privacyrequired by Article 6 (1) (f) of Regulation No 40/94.- According to the Applicants, even if some of the data is from public databasesderived, the conclusions drawn from it as personal data are not treated even thencreates a legal basis. No additional information was provided by the Applicant. THEAccording to the applicants, there is no treatment of data on their financial situationIn this way, public data cannot be deduced from the company public or the public interestthe assets of an individual other than his shareholding in a company, oryou may also have debts.- According to the Applicants, the Association refers to a “[…] relationship” and a “[…] generation” -also published data on which data could not be derived from the publicfrom records.- According to the Applicants, only General is concerned with regard to Data Management 2Article 6 (1) (a) of the Data Protection Regulation could provide a legal basis for data processing,however, Applicants consent to the processing of their personal datathey did not.
Page 10
10- In the response letter of the Applicant, the state or other information provided to […] as a data processing purposethe use of public funds, their role in successthereby informing the public and, more broadly,the exercise of the right to freedom of the press. The Applicants referred in this connection toAuthority [born before the general data protection regulation became applicable]NAIH / 4454/6/2012 / V, which states that public companyincluding the personal data of owners and senior executives - may not be usedfor purposes other than those provided for in the law on which it is based (currently theAct V of 2006 on Company Proceedings and Liquidation; hereinafter:Ctv.) Records. The Ctv. According to the preamble, these data are exclusively constitutional for entrepreneurssecurity of trade and the interests of the creditor or otherwisemay be used to protect the public interest. According to the Applicants, the Applicantthe objectives set by the applicant are incompatible with those objectives and by the Applicanta specific purpose may not provide a legal basis for the rights of the Applicants indicated as a legitimate interestto limit their privacy; in particular, they cannot be used for thisdata in the business register relating to the financial situation of personsto draw conclusions who are not owners of the company concerned.- The Applicants have indicated to the Applicant that speculative estimates do not givereal result, the data processed do not comply with the principle of accuracy. In view of this, theAccording to the applicants, Article 17 (1) of the General Data Protection Regulationwould have been required under paragraph 1 (c) to immediately delete the untrueor pursuant to Article 5 (1) (d) of the General Data Protection Regulationat least he should have taken all reasonable steps to ensure thatdelete personal data which are inaccurate for the purposes of data processing without delay, orcorrect it. The Applicants strongly requested the deletion of the data on the basis of the protest,however, in its reply, the Applicant indicated only the name in relation to the namewillingness to rectify personal data.- The Petitioners refer to Constitutional Court Decision IV / 1235/2019. No., constitutional lawdecision rejecting the complaint, in which the Constitutional Court stated that “[it] isstatements of fact, the truth of which cannot be substantiated, the expression of opinionfreedom does not protect ’ .- The obligation of the Applicant as data controller to inform about the present caseprimarily defined in Article 14 of the General Data Protection Regulation, as it is personaldata were not collected from the Applicants by the Applicant. According to the Applicants, aThe applicant has manifestly infringed this obligation to provide information on several occasions,and did not provide them with adequate information. The Applicant is also the Applicantsthe result of a mandatory individual balance of interests following a protestinformed the Applicants, thereby also violating its obligation to provide information.- The Applicants pursuant to Article 18 (1) (a) and (d) of the General Data Protection Regulationasked the Applicant to limit the processing of data, the accuracy of personal dataand protests against data processing. The Applicantsin its opinion, the processing of the data affected by the restriction request to the Applicantshould have been restricted, as further processing is covered by Article 18 of the General Data Protection Regulation.None of the reasons set out in Article 2 (2).- In their opinion, the Applicants cannot be considered as public actors, their activitiesit does not fall within the scope of public interest, such as Article 21 of the General Data Protection Regulationlawfully objected to the processing. Applicants Data Management 1 andThey also exercised their right to object in 2 respects. According to the Applicants, theApplicant has not demonstrated compelling legitimate interests which take precedenceenjoy the rights and freedoms of the Applicants and the protestThe Applicants did not provide a mandatory interest balance test afterfor. In the opinion of the Applicants, there are no compelling legitimate reasons
Page 11
11maintained on the Applicant’s site, as the Applicant handles personal onlydata to create a large readership for yourself on the website, andincrease Forbes sales. These cases, according to the Applicants, in no waycreated by Article 21 (1) of the General Data Protection Regulationexception.According to the applicants, the present case is very similar to that of the Court of Justice of the European Union('the CJEU') in Case C-131/12. number,Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD)and Mario Costeja González, in which the CJEU ruled that the publicit has a strong interest in making the data available if it is in the public domain concernedhis role justifies this. According to the Applicants, to the case referred tosimilarly, in the present case, no such circumstance exists, and despite the dataits publication elsewhere was lawful, the data processing of the Applicant is expressillegal due to protest.- Of the Applicants, […] builds export markets, […] is present in more than […] countries.[…] Their partner was abducted three times and his wife once. According to the Applicantsappearing on such lists also raises the question of the family and the international contextfamily members on the map, search engines pre-position these lists by whicha member of the family is more likely to be a victim, even foreign perpetratorsalso with regard to.- According to the Applicants, Data Management 1 directed the attention of criminal circles to the Applicants.In support of this, the Applicants sent a letter to the Authorityin which the […] security director indicates the […] family in personal protection dutieschanges and provide information on related measures.In view of the above, the Applicants initiated a data protection authority procedureData Management 1 and Data Management 2 and requested that the Authority be generalArticle 5 (1) (a), (b), (d) and (e) of the Data Protection Regulation, Article 6 (1) (f)Article 13 (2) (f) and Article 14 (2) (g), Article 14 (1) andArticle 15 (1) (h) and Article 21 (1)infringement of Article 18 (1) (a) and (d).order the restriction of personal data and then Article 17 (1)pursuant to Article 58 (2) (f) and prohibitApplicant for the processing of personal data.The Applicants requested that the Authority issue the Infotv. Pursuant to Section 61 (1) (a), the generalalso impose a fine under Article 83 (4) of the Data Protection Regulation on the Applicantopposite.The Applicants further requested that the Authority issue a decision on the General Administrative Procedure 2016.year CL. Act (hereinafter: Ákr.) with a temporary measurerestrict the processing of data, prohibit the disclosure of personal data, given that itsin the absence of the Applicants and their minor children (who are also involved, only not in the present proceedingsapplicants) the appearance of Data Management 2 with unavoidable damage, danger, orwould inevitably infringe the rights of the individual.On the basis of the request, Article 57 (1) (f) of the General Data Protection Regulation and Infotv. 60.§ (1), a data protection authority procedure was initiated.Following the initiation of the procedure, Applicants will receive an email dated January 24, 2020It was sent on 27 January 2020 and sent to the Authority by post on 28 January 2020informed the Authority in their letter of formal notice that the data protection application submitted to the Authorityon the basis of a request for an official procedure in parallel with an ongoing procedure
Page 12
12there is also a civil action in which an interim measure is granted at first instance on […]in its order on the subject, ordered the Applicant to:- indicate the personal data processed concerning the Applicants,- the personal data processed concerning the Applicants is expressly provided by the Applicantswith your written consent,- the disclosure of personal data processed concerning Applicantsabstain.The Applicants further informed the Authority that the Applicant had the abovehas failed to fulfill its obligations and has disclosed both online and on paperApplicants' personal data and includes the Applicants in the list of the richest Hungarians(Data Management 2).On […] […], it established the preliminary enforceability of the order, on the basis of which theorder can be enforced independently of the second-instance proceedings.An extract from […] 's order for interim measures [ideiglen] and the[…] ordering the applicants for a preliminary ruling on the provisional enforceability of an interim measuresent to the Authority.The Authority dated 28 January 2020 initiating the data protection authority procedureNAIH / 2020/1154/2, and Ákr. With reference to § 63 of the factsinvited the Applicant to make a statement in order to clarify The order to the Authoritywas received on February 3, 2020 based on the returned return receipt.Forbes issued a notice on its website on […]. The Communication states, inter alia:includes:[…]The full notice is available at URL […] .Date of receipt of the application by the Applicant dated 6 February 2020, received by the Authority on 12 February 2020informed the Authority in a letter dated- Members of the […] family have filed a civil lawsuit against the Applicant. Background to the civil lawsuit,that the defendants applied for interim measures. The temporary[…] […], which was registered under number […] under number […].left in place by order. An application for interim measures shall be subject to the condition that:Applicants page within 30 days to file a lawsuit for the alleged infringement on the meritsassessment. […] Ordered the provisional application for interim measures, whichcondition for bringing an action. To the best of the Applicant's legal representative, the actionhas been filed and is under investigation for litigation.- Given that the contents of the Authority's request are subject to legal proceedingsis pending, in the Applicant's view, as a basis for the Authority's requestThe right to information self - determination and theCXII of 2011 on freedom of information. Section 53 (3) of the Information Act (hereinafter: the Information Act)pursuant to paragraph 1 (a). [Infotv. Section 53 (3) (a): The Authority shall make the notificationrefuses, without a substantive examination, if legal proceedings are pending in the case in question, orthe case has previously been the subject of a final court decision.]The Authority did not agree with the position of the Applicant, as Infotv. § 53 of the Ákr.therefore not an administrative procedureapplicable. In view of the above, the Authority issued NAIH / 2020/1154/4 of 13 February 2020
Page 13
13In his order no., he repeatedly invited the Applicant to make a statement. The order to the Authoritywas received on 19 February 2020 on the basis of the returned return receipt.In an e-mail dated 27 February 2020 but sent on 26 February 2020, aThe applicant, through his / her legal representative ([…]), shall provide the requested information.and sent supporting documents to the Authority.In its reply to the Authority, the Applicant stated the following:- The Applicants, through their legal representative, apply for interim measurespresented. By order of […], the interim measure was granted byprovided that Applicants may, within 30 days, file an action on […] the merits of the caserequesting an assessment. Not until the reply letter is sent to the Applicant to the Authoritythe action was served, only one order was received in which the actioninformed the Applicant of his refusal by […] (Order No […]).- Between the Applicants and the Applicant in connection with the handling of the personal data of the ApplicantsDue to the ongoing court proceedings, the Applicant is of the opinion that the data protectionthere is a need to suspend official proceedings. The position of the Applicant is as followsjustified: The Acre. Pursuant to Section 48 (1) a), the Authority shall suspend the proceedings,if the decision on the preliminary question falls within the jurisdiction of a court. Given that it is temporaryfollowing an order imposing a measure, the Authority shall form the basis of the proceedingscivil and non-civil proceedings are pending in connection with data processing,the possibility arises that the Ákr. Pursuant to Section 46 (1) (b)there will be a place of refusal or it will be infringed by the adjudication of a question of law which is completely identical in contentjudicial proceedings, since if the Authority pursues the data protection authorityinvestigation, the situation may arise that in a legal issue (Applicants for our personal datatreatment by the Applicant) is decided by two courts, as an aCXXX of 2016 on Civil Procedure. procedure (hereinafter: Pp.),and clients have the option of judicial review of the Authority's decisionto ask. It depends on the court process: either it decides the merits of the action or some sortreason does not make a final decision and the applicant side loses the opportunity to Pp. according toenforcement. This is a preliminary issue that is pending in the ongoing court proceedingsel. In view of all this, the Applicant requested that the Authority suspend the data protectionofficial procedure.- The Forbes press product is primarily a business paper that is, among other things, Hungariancompanies, owners, their business, their developments, the market economyand any relationship with the Statereadership. Applicants are the owners ([…] and […]) and manager of […]officials ([…] and […]).- Forbes was first published in August 2015 (ie not in 2016,as stated by the Applicants) included the “[…] family” in the “Largest Hungarianfamily businesses ’. It was subsequently published in the September 2019 issueowned by the “[család] family” […] of the “Largest Hungarian Family Enterprises 2019”compilation (Data Management 1). In addition, it appeared in the January 2020 issueIt is included in the entry […] of the compilation “Richest Hungarians” […] (Data Management 2).- Compilations are prepared by Forbes journalists based on publicly available company data. THEcalculations based on public data for the company or person concerned at all timessent, giving the opportunity to correct the calculations, other comments. THERequested employees proactively contacted and informed in advance theApplicants as well.- The [...] information URL available show that a regular [...] in recent yearsreceived large amounts of state and EU funds totaling several billion forintsgrants.
Page 14
14- The processing of personal data is inseparable - and therefore cannot be legally assessedseparately from the content published in Forbes compilations. In Forbes compilations acompany information was provided: in what state aidthey benefited from what marketing activities they carried out, what expansions they implementedme.- According to the Applicant, the term '[…] family' cannot be considered generalpersonal data pursuant to Article 4 (1) of the Data Protection Regulation.- The Basic Law of Hungary both recognizes the right to the protection of personal dataand the publicity of data of public interest [VI. Article 3 (3)], freedom of the press and the pressdiversity [IX. Article 2 (2)] and states that Hungary 's economy is abased on the freedom of establishment [Article M (1)].- Pursuant to Article 39 (2) of the Basic Law, all organizations managing public fundsis accountable to the public for its management of public funds. THEpublic funds shall be managed in accordance with the principles of transparency and public purity; anddata on public funds and national wealth are data of public interest.- Article 85 (1) of the General Data Protection Regulation also shows the Member Statesreconcile the right to freedom of expression and information with data protection. Thethe European Data Protection SupervisorsPublished by the Working Party (Working Group 29) on 26 November 2014 [WP 227paragraph 2 of its resolution, according to which data protection rights are the expression of opinionshould be interpreted in the light of (also) the law of In the case of EUB Tele2Sverige AB [C-203/2015] 2016.Paragraph 93 of its decision of 21 December 2006 is similar to the followingstates: “Thus, both Article 7 of the Charter, for respect for privacyprotection of personal data as guaranteed by Article 8 thereofthe importance of the right to justice as established in case law (see in this sense:Schrems judgment of 6 October 2015, C-362/14, EU: C: 2015: 650, paragraph 39, and the judgment there.case-law cited above) Article 15 of Directive 2002/58 must be taken into accountIn the interpretation of paragraph 1. The same is true of expressionfreedom, given the particular importance that this freedom attaches to allin a democratic society. This fundamental right guaranteed by Article 11 of the Charter aone of the essential foundations of a democratic and pluralistic society, is one of the valueson which the Union is founded under Article 2 TEU (see, to that effect, June 2003)Schmidberger judgment of 12 December 2003, C-112/00, EU: C: 2003: 333, paragraph 79; September 6, 2011Patriciello, C-163/10, EU: C: 2011: 543, paragraph 31.)- A 7/2014. (III. 7.) AB in the wording of Resolution AB “[a] freedom of the press - which encompassesfreedom of all types of media - the institution of freedom of expression. The press -despite the increasingly complex and diversified nature of its activities, in particularexpression of opinion, opinion-forming and opinion-formingmeans of obtaining information. " (Justification [40]). This is the role of the press in particularappreciates in the expression of public opinion, since “[a] social, political debatesThese are largely due to the fact that public actors and, in the public debate,typically through the press - participants ’perceptions of each other’s ideas, political performance andin this context, they also criticize each other’s personalities. And the press is constitutionalits mission is to monitor the exercise of public authority, of which thepresentation of the activities of persons and institutions involved in shaping public affairs "(Justification [48]).- The interpretation of the media by the Constitutional Court is democratic public opinionits central role in the formation of the press does not lead to “the pressits activities should not be subject to legal requirements […], but at the time of their creation andthe constitutional mission of the press,the publication of information of public interest shall not be hindered or impeded "{3/2015. (II. 2.) AB decision, Justification [25]}. A 28/2014. (IX. 29.) AB
Page 15
15' As long as any information does not constitute an abuse of freedom of the press,in the context of the protection of human dignityrarely justify a restriction on the exercise of freedom of the press. " (Justification[42]). This interpretation is based on 16/2016. (X. 20.) and 17/2016. (X. 20.) AB decisionshave also been consistently enforced in favor of press freedom.- Personal within the meaning of Article 6 (1) (f) of the General Data Protection Regulationdata processing is lawful if the data processing is legitimate by the controller or a third partynecessary to safeguard its interests, unless those interests take precedenceenjoy the interests or fundamental rights and freedoms of the data subject which are personaldata protection, unless the child concerned.- Given that Hungary is a market economy, the task of the press cannot be narrowed downinterpreted as the operation of private companies owned by private individuals,publicity is not possible at any level regarding its ownership backgroundprovide information. Of course, this activity also has its limitations:protection of trade secrets, protection of human dignity, etc., while business journalism is onelegitimate activity. The Applicant does not handle or disclose any personal informationdata which would constitute a disproportionate invasion of privacy. Managed by the Applicant anddisclosed (minimum) personal information is closely related to the businessactivity. The Applicant is essentially information about the ownership background of the company(name) handles. Estimates of the extent of wealth are solely businessare based on activity-related public data and are therefore not covered by the compilationreal estate, private property (eg inheritance, marriage)wealth, lottery winnings). Similarly, Applicant does not handle and disclose to the private sectorgrossly disruptive data. (For example, it would be obviously illegal toa compilation that would predict changes based on contractors ’health datain the course of business.)- The Smtv. Section 10 (1) also states: “Everyone has the right to be properly treatedto inform about local, national and European public affairs, as well as Hungaryevents of importance to its citizens and members of the Hungarian nation. THEIt is the responsibility of the media system as a whole to provide credible, prompt and accurate information on these matters andevents. "- The Ctv. Section 10 prescribes publicity of the company in the public interest. Company data - and what's in itpersonal data - so they are not just for road safety. (The public interestrefers to the protection of the Ctv. preamble). The Ctv. Company data pursuant to Section 10 (2)are fully public.- The task of business journalism analyzing the market economy is to explore the nodes of the economy,internal relations, scope of ownership, networks, state involvement. THEAccording to the Applicant, it is a company owned or controlled by the Applicantsthis is exactly what the page issued by the Applicant did. According to the Applicanta Ctv. interpretation of its provisions on public disclosure in accordance with the Basic Law,that the right of the press to be informed about the operation of the economy should also be includedin the public interest justifying the public. According to the Applicant, the opposite is trueinterpretation would result in the owners of companies, leadinginformation on their officials could only be provided with the consent of the data subject, thisand it makes sense to make the role of the press “watchdog” impossible, which cannot be narrowed downto control state public power.- According to the Applicant 's legal position, information on the Applicants' assets andtheir public connection to the Applicants in the Infotv. Pursuant to Section 3, Clause 6public personal data in the public interest, the disclosure of which,its acquaintance or making available is required by law in the public interest. THEThe names of the applicants and the company they own and their value are central,data found in public, publicly available records that is accessible to anyone.
Page 16
16- Infotv. Pursuant to Section 26 (2), public personal data in the public interest for the purposein accordance with the principle of data management. The Applicant from themanages the data of the Applicants in order to exercise their rights arising from the freedom of the press,and the information activities of the press in a democratic societyimplement. The Applicant shall record each calendar year the publicly availablebased on databases, the richest natural persons and families in Hungary.The aim is to make Hungarian society aware of the greatest economic influenceeconomic influence is in itself a significant public goodgives a role to some individuals, often with other social, political influencesassociated with. Introducing such a concentration of power to and in societyrecording changes from year to year is a matter of public interest information. THEThe requested aim is also to inform the Hungarian business community, the largestabout the owners behind Hungarian-owned companies, thus contributing to businesstransparency and traceability. The Applicant also considers it his responsibility tostrengthening the Hungarian entrepreneurial culture by making successful Hungarian entrepreneursreports on its activities - the compilation of the annual rich list also serves this purpose in part.- According to the Applicant, his activity is in the public interest. The economicjournalism is a legitimate activity in the public interest, and in its context it is the richest and at the same timehaving the greatest (or in any case much greater than average) social influencepersons according to a regular methodology based on reliable public dataits collection and archiving is in the public interest. The Applicant is public onlycompiled a list of the most fashionable people based on available databases. Theseregisters (real estate register, company database created on the basis of court registration dataand companies ’own public disclosures) and the wide range of personal data they containit is public so that economic life is transparent and accessible to citizenswork. Journalism adds value to the publicdatabases to help lay citizens interpret and summarize theotherwise a huge amount of information is publicly available. The Applicants[…], which is owned or controlled byin itself justifies the fact that the citizens (the readership) are behind the investmentthe identity of the standing owner is known.- On 16 August 2019, the journalist employed by the Applicant contacted theBusinesses that can be linked to applicants in connection with Data Management 1. Attached to the lettera description of the methodology used to compile the compilation has been attached,indicating the source of the data used for the compilation (publicly available)available company data). An excel spreadsheet has been sent as an email attachmentin the form of a calculation based on the data of […]. Legal Representative of the ApplicantsIn response, the Applicant sent a reply containing its legal position in September 2019On the 12th day, in which he provided information on the scope of the processed data, as well as the data managementstaff were also named.- On 14 November 2019, the Applicant's journalist repeatedly contacted […]Data management 2 connection. Once again, the methodology was attached to the requestdescription and excel spreadsheet showing business data. Employee of the Applicant 2019.the legal position of the Applicant's legal representative on 20 Novembersent a presentation response letter.In addition to the information provided to the Authority, the Applicant Section 33 (1) and (4)requested that the Authority submit the Applicants' submission and its annexes electronicallysend, given that the Applicant, in the knowledge of the submission, has submitted further commentsintends to do.In its order NAIH / 2020/1154/6 of 16 March 2020, the Authority granted access to the filelimited request, without sending any unknown documents
Page 17
17and the Applicants ’request for a data protection authority procedure and itsthe Annex, the supplement to the application and its annexes (except by the Security Director of […]introducing changes to personal protection tasks concerning the […] family, andinformation on related measures) and to the Applicant Authoritysent on 24 January 2020 and its annexes by post and electronicallyalso sent to the Applicant by letter.By e-mail sent on 23 March 2020 and by post to the Authority by 2020.By letter received on 26 March 2006, the Applicant made the following additional comments:- Judging the falseness or reality of a fact is not a data protection issue,but also the Civil Code. or Smtv. may be judged on the basis of the rules of protection of privacy orin a press correction procedure. The Applicants did not initiate such proceedings. With thisIn this context, according to the Applicant, there is a clear inability toinclude minors who do not have the capacity to actmay be actors in a business.- The Applicants complain that they have not been informed of their rights and remediestheir possibilities. The reply letter does not really include the Infotv. and generalrelevant provision of the data protection regulation, but on the one hand on the forbes.hu website at that timeThe data management information was also available, from which theon the other hand, the Applicants through their legal representativeturned to the Applicant and the legal representative to the Lawyer's Act of 2017LXXVIII. (hereinafter: the Act) was obliged to inform the Applicants of thetheir enforceable rights and how to enforce them. Letters of invitation specificallyindicate that enforcement proceedings will be initiated by the Applicants. The legalMember may not make such a summons without giving notice of enforcementinformation to its principals.- According to the Applicant's position, the Applicants' statement that it cannot be established is misleadingthe logic of Forbes journalists analyzing the data. The reply lettersA methodological letter was sent as an annex to thedata analysis method. The Applicant notes in this regard that the journalistsovereign right to draw conclusions after analysis of raw data.In case of inaccuracy of the personal data, the Applicants were assured thatcomments, the Applicant’s staff member also explicitly requested feedback from thecalculations.- In the Applicant's view, other information listed by the Applicantsdeficiencies have not been substantiated and documents previously sent to the Authoritycertify that the Applicants have been duly informed.- The resolution of the Data Protection Commissioner referred to by the Applicants ["in itself the factthat someone is wealthy does not mean that he is also a public figure ”] in relation to the Applicantpoints out that the present proceedings are based on the General Data Protection Regulation, Article 6 of which provides:.A balance of interests shall be established in accordance with Article 1 (1) (f). As stated by the Applicantreferred to in a reply sent previously to the Authority, advocates for the public thatpersonal data has been processed in connection with the use of public funds. THEAccording to the applicant, the public is not justified by the fact of wealth,but because the state supports the Applicants' business with billions of forintsfor years.- The Applicant refuses to accept the professional work referred to by the Applicants as homophobic,and juxtaposing government expiring propaganda lists. The Requestedin his view, the argument for his tastelessness is also erroneous because of the marked listsprocessing of special personal data for expiration purposes. The Applicant was not treatednever any special personal information about Applicants or Forbespublished publications were published with no expiration date.
Page 18
18- In connection with the case - law decision BDT2017.3693 relied on by the Applicants, theThe petitioner notes that the factual basis of the judgment is based on the Civil Code. the right to an imagewas a violation. However, in the Applicant's view, it is a paragraph of the decisionto be highlighted. According to it, '[t] he applicant's identity in a matter of public interest isinterest has come to the forefront, however, not with the public authorities but with the economic onesmay be considered a public figure in the context of power, its reputation is narrower,media appearances are not considered common. Although the AB referred to in that regardhas a greater tolerance obligation based on decisions, its tolerance obligation is not the samewith the obligation of tolerance of a person of political or public authority. Not like thata public figure whose publication of photographs of litigation without consent is thoroughhe should endure for no reason. " According to the Applicant, this shows thatpersons with economic power also have an increased obligation of tolerance.- The content of the data processing and the public communications based on them is not the Applicantsbut also the company owned and controlled by themfinancial support from the state; neither the data processed nor the objectionscommunications have nothing to do with family and private life.- The Applicants also justify the serious threat to the rights of minor childrenthe merits of their complaint. In this regard, the Applicant notes that theit can be established from the attached documents that the Applicant does not treat a minorany information and that the Applicants, including through a legal representative,no minor found.- The Applicants refer to the September 2019 compilation of criminal circles' attentiondirected to the family, which puts them at constant safety risk. THEAccording to the applicant, it was not substantiated in what way the criminal circles were directedattention to the family, and that between the publication of the Forbes list and the actions of criminalswhat is the causal relationship. In the Applicant's view, it is speculative and unjustifiablethe relationship even if to the detriment of the Applicants in an unfortunate mannerto Act C of 2012 on the Penal Code (hereinafter: the Criminal Code)conflicting behavior has taken place recently.- According to the Applicant, Case C-131/12 relied on by the Applicants. CJEU Decision Nomisleading reference because the case is expressly out of date information(‘right to forget’). Paragraphs 70 and 81 of the judgment.also requires a balancing of interests. According to the Applicant, apublished information are timely communications from the press body, and therefore misleading aApplicant reference.- With regard to purpose limitation, the Applicant emphasizes that the purpose of data processing iscarrying out journalistic work and informing the public on matters of public interest.- The Applicant informed the Applicants about the result of the balance of interests, the ApplicantIn its view, its aspects and results are clearly distinguished by thefrom reply letters.- The methodological information sent to the Applicants and the introduction to the lists, andit is clear from the records of the Applicants that, in the Applicant 's view,only economic data related to the company was used.- According to the Applicant, there is no automatic in case of inaccuracy of the datacancellation obligation [mainly not by the General Data Protection Regulation by Applicantsnot referred to in Article 17 (1) (c)]. The Applicant further notes thatthat the Applicants did not avail themselves of the provisions of Article 16 of the General Data Protection Regulationright of rectification, even though they had the opportunity to do so.
Page 19
19The Applicants sent it to the Authority on 24 April 2020 by e-mail onlyIn their letter, they reiterated their previous submissions and informed the followingAuthority:- The […] Police Headquarters is paying close attention to the surroundings of […] 's property, as thein the family’s living environment, as announced by the […] Security Directora well-known criminal living in Keszthely but of Moldavian origin appeared, about whomvideo was also recorded.- Owners of […] as a result of the events at issue in the present case, proceedings by the publisher of Forbesdue to […] a gift contract was redeemed representing a significant value, existing for 16 yearspart of their business.- Applicants withdraw their application with respect to Data Management 2 implementeddisclosure.- The Applicants also maintain their previously submitted applications Data Management 1, iefor data management operations in September 2019 and earlier.The Applicants thus as a whole with respect to Data Management 1 and Data Management 2 - the abovewith the exception of disclosure - have maintained their request for general data protectionArticle 5 (1) (a), (b), (e), Article 6 (1) (f) ofArticle 13 and Article 14 (1) and (2), andEstablishment of unlawful data processing by the Applicant pursuant to Article 21 (1)with regard to. The Applicants requested that the applications submitted by the Authority be limitedcircle.II. Applicable legal provisionsPursuant to Article 2 (1) of the General Data Protection Regulation, the General Data Protection Regulationshall apply to the processing of personal data in part or in full by automated means,and the non - automated processing of personal data which:are part of a registration system or are part of a registration systemthey want to do.For data management falling within the scope of the General Data Protection Decree, Infotv. Section 2 (2)according to the general data protection regulation in the provisions indicated thereinshall apply with additions.According to Article 4 (1) of the General Data Protection Regulation, "personal data" means identified orany information relating to an identifiable natural person ("data subject"); identifiable by aa natural person who, directly or indirectly, in particular by an identifier, e.g.name, number, location data, online identifier or physical, physiological,genetic, mental, economic, cultural or social identity of one or more relevantidentifiable by a factor.According to Article 4 (2) of the General Data Protection Regulation, "processing" means personal dataor any operation on data files in an automated or non - automated manner, ora set of operations, such as collecting, recording, organizing, sorting, storing, transforming, orchange, query, view, use, transmit, distribute or otherwiseharmonization or interconnection, restriction, deletion,or destruction.According to Article 4 (4) of the General Data Protection Regulation, "profiling" means personal dataany form of automated management in which personaldata for the assessment of certain personal characteristics of a natural person,
Page 20
20especially for job performance, economic situation, health status, personalpreferences, interest, reliability, behavior, location, orused to analyze or predict motion-related characteristics.According to Article 4 (6) of the General Data Protection Regulation, "registration system" means personal datadata in any way - centralized, decentralized or functional or geographicalaccording to - a segmented stock that is accessible according to specific criteria.According to Article 4 (7) of the General Data Protection Regulation: "controller" means the natural or legal personperson, public authority, agency or any other body that provides personal datadetermine the purposes and means of its management, alone or in association with others; if the data managementpurposes and means are determined by Union or Member State law, the controller or the controllerUnion or Member State law may also lay down specific criteria for the designation ofPersonal data pursuant to Article 5 (1) (a) of the General Data Protection Regulationmust be handled lawfully and fairly and in a way that is transparent to the data subject("Legality, due process and transparency").Pursuant to Article 5 (1) (b) of the General Data Protection Regulation, personal data onlymay be collected for a specific, clear and legitimate purpose and may not be combined with those purposescannot be dealt with in a compatible way (‘purpose-based’).Purposes of data processing under Article 5 (1) (c) of the General Data Protection Regulationthey must be appropriate and relevant to what is necessary and limited to what is necessary(“Data saving”).Personal data pursuant to Article 5 (1) (d) of the General Data Protection Regulationthey must be accurate and, where necessary, kept up to date; all reasonable measures must be takento ensure that personal data are inaccurate for the purposes of data processingdeleted or corrected immediately ("accuracy").Personal data pursuant to Article 5 (1) (e) of the General Data Protection Regulationshould be stored in a form that identifies the data subjects only for personal useallows the time necessary to achieve its data processing objectives; personal information than thislonger storage can only take place if personal datain accordance with Article 89 (1) for archiving in the public interest, scientific andfor historical research or statistical purposes, those concerned by this Regulationappropriate technical and organizational arrangements to protect the rights and freedoms ofsubject to the implementation of measures (‘limited storage capacity’).Pursuant to Article 5 (2) of the General Data Protection Regulation, the controller is responsible forshall be able to demonstrate such compliance(“Accountability”).Pursuant to Article 6 (1) of the General Data Protection Regulation, personal data may only be used if andcan be lawfully managed if at least one of the following is met:(a) the data subject has given his or her consent to the processing of his or her personal data for one or more specific purposestreatment;(b) processing is necessary for the performance of a contract to which one of the parties is a party,or taking steps at the request of the data subject prior to the conclusion of the contractnecessary to do so;(c) processing is necessary for compliance with a legal obligation to which the controller is subject;(d) the processing is in the vital interests of the data subject or of another natural personnecessary for its protection;(e) the processing is in the public interest or a public authority conferred on the controller
Page 21
21necessary for the performance of the task carried out in the exercise of(f) processing for the protection of the legitimate interests of the controller or of a third partynecessary, unless those interests take precedence over those interestsinterests or fundamental rights and freedoms which constitute the protection of personal dataespecially if the child concerned.According to recital 47 of the General Data Protection Regulationin any case, it must be carefully examined, inter alia, whether the person concernedwhether you can reasonably expect when and in connection with the collection of personal datathat data may be processed for that purpose. Interests and fundamental rights of the data subjectmay take precedence over the interests of the controller if the personal data are suchconditions in which data subjects do not expect further data processing.[...] The processing of personal data in order to prevent fraud is also essentialit is in the legitimate interest of the controller concerned. Personal information for direct business purposesmay also be considered to be based on a legitimate interest.Data controllers related to measures for the exercise of data subjects' rightsobligations are set out in Article 12 of the General Data Protection Regulation.Pursuant to Article 12 (1) of the General Data Protection Regulation, the controller is appropriatetake measures to enable the data subject to process personal dataall the information referred to in Articles 13 and 14 and Articles 15 to 22. and Article 34each piece of information in a concise, transparent, comprehensible and easily accessible form, in a clear mannerand provide it in plain language, in particular any information addressed to childrenin the case of. The information shall be provided in writing or by other means, including, where appropriate, by electronic meansalso - must be specified. Oral information may be provided at the request of the data subject, provided otherwisethe identity of the data subject has been verified.Pursuant to Article 12 (2) of the General Data Protection Regulation, the controller shall facilitateaffected 15-22. exercise of their rights under this Article. In the cases referred to in Article 11 (2)the controller shall refer to the relevant 15-22. fulfillment of his request to exercise his rights under Articlehe may not refuse it unless he proves that he is unable to identify the person concerned.Pursuant to Article 12 (3) of the General Data Protection Regulation, the controller is unjustifiedwithout delay, but in any case within one month of receipt of the requestinform the data subject in accordance with Articles 15 to 22. the action taken on a request pursuant to Article. NeedIn view of the complexity of the application and the number of applications, this time limit shall be extended by two further periodsmay be extended by one month. The extension of the deadline by the data controller shall be the reasons for the delayinform the data subject within one month of receipt of the request. Ifthe data subject has submitted the application electronically, the information shall be provided, if possible, electronicallyunless otherwise requested by the data subject.Pursuant to Article 12 (4) of the General Data Protection Regulation, if the controller does not do someasures at the request of the data subject, without delay, but at the latest at the time of the requestinform the data subject of the non-action within one month of receiptand that the person concerned may lodge a complaint with a supervisory authority and may residejudicial redress.Pursuant to Article 13 (5) of the General Data Protection Regulation, Articles 13 and 14information and Articles 15 to 22. The information and action provided for in Articles 31 and 34 shall be provided free of chargeto assure. If the data subject's request is clearly unfounded or - particularly repetitive in natureexcessive, the data controller, subject to the provision of the requested information or information or the requestedadministrative costs associated with the adoption of the measure, may charge a reasonable fee,or refuse to act on the request. The request is clearthe burden of proving that it is unfounded or excessive is on the controller.
Page 22
22Article 14 of the General Data Protection Regulation states that the controller shall, as a minimumwhich data processing circumstances and how to inform data subjects if personaldata were not obtained from data subjects. According to:[14. Article 1 (1): If the personal data have not been obtained from the data subject, the controllerprovide the data subject with the following information:(a) the identity and contact details of the controller and, if any, of the controller 's representative;(b) the contact details of the Data Protection Officer, if any;(c) the purpose of the intended processing of the personal data and the legal basis for the processing;(d) the categories of personal data concerned;(e) the recipients or categories of recipients of the personal data, if any;(f) where applicable, the fact that the controller is a recipient in a third country, orintends to transfer personal data to an international organization, andthe existence or absence of a Commission decision on compliance, or in Article 46,the transmission referred to in Article 49 or the second subparagraph of Article 49 (1)where appropriate, an indication of the appropriate and suitable guarantees and a copy thereofreference to the means of obtaining them or their availability.[14. Article 2] (2): In addition to the information referred to in paragraph 1, the controller shall be the data subjectto ensure fair and transparent data processing for the data subjectthe following additional information is required:(a) the period for which the personal data will be stored or, if that is not possible, that periodaspects of its definition;(b) where the processing is based on Article 6 (1) (f), the controller or a third partylegitimate interests of a party;(c) the data subject's right to request from the controller the personal data concerning him or heraccess to, rectification, erasure or restriction of the processing of data, andmay object to the processing of personal data and to the data portability concernedthe right to(d) information based on Article 6 (1) (a) or Article 9 (2) (a);the right to withdraw consent at any time in the case of data processing,which does not affect the processing carried out on the basis of the consent prior to the withdrawallegitimacy;(e) the right to lodge a complaint with a supervisory authority;(f) the source of the personal data and, where applicable, the public availability of the datawhether they come from sources; and(g) the fact of automated decision-making referred to in Article 22 (1) and (4), including:profiling as well as, at least in these cases, the logic used and thatcomprehensible information on the significance of such data processing andthe expected consequences for the data subject.[14. Article 3 (3): The controller shall provide the information referred to in paragraphs 1 and 2 as followsenter according to:(a) personal data, taking into account the specific circumstances of the processing of personal datawithin a reasonable time of receipt, but not later than one month;(b) where personal data are used for the purpose of contacting the data subject, at least:affected first(c) at the time of contact; obsession(d) where the data are expected to be communicated to another recipient, the personal data at the latestthe first time.[14. Article 4 (4): If the controller is different from the purpose for which the personal data were obtainedintends to carry out further data processing for that purpose, it shall inform thethis different purpose and any relevant additional information referred to in paragraph 2information.
Page 23
23[14. Paragraphs 5 to 4 shall not apply if and to the extent that:(a) the data subject already has the information;(b) it proves impossible to provide the information in question, orwould require a disproportionate effort, in particular for archiving in the public interest,for scientific and historical research or statistical purposes, in accordance with Article 89 (1)in the case of data processing subject to the conditions and guarantees set out inwhere the obligation referred to in paragraph 1 of this Article is likelywould make it impossible or seriously jeopardize the achievement of the purposes of this data processing. SuchIn such cases, the controller must take appropriate action - the informationincluding the rights, freedoms and legitimate interests of the data subjectto protect its interests;(c) the acquisition or communication of the data is expressly provided for in the Union law applicable to the controlleror the law of a Member State which is appropriate to protect the legitimate interests of the data subjectprovides for measures; obsession(d) professional secrecy of personal data as required by Union or Member State lawobligation, including legal confidentiality,must remain confidential.Pursuant to Article 15 (1) of the General Data Protection Regulation, the data subject is entitled to:receive feedback from the data controller on the processing of your personal datais in progress, and if such data processing is in progress, you are entitled to personalaccess to data and the following information:(a) the purposes of the processing;(b) the categories of personal data concerned;(c) the recipients or categories of recipients to whom the personal data relatecommunicated or will be communicated, including in particular to third country consignees, andinternational organizations;(d) where applicable, the intended period for which the personal data will be stored or, failing thatpossible, criteria for determining this period;(e) the data subject's right to request personal data concerning him or her from the controllerrectification, erasure or limitation of handling and may object to such personalagainst data processing;(f) the right to lodge a complaint with a supervisory authority;(g) if the data were not collected from the data subject, all available sourcesinformation;(h) the fact of automated decision-making referred to in Article 22 (1) and (4), including:profiling as well as, at least in these cases, the logic used and thatcomprehensible information on the significance of such data processing andthe expected consequences for the data subject.Under Article 16 of the General Data Protection Regulation, the data subject has the right to requestthe data controller shall correct the inaccurate personal data concerning him without undue delay.Taking into account the purpose of the data processing, the data subject is entitled to request the incomplete personalsupplementing the data, inter alia, by means of a supplementary declaration.Pursuant to Article 17 (1) of the General Data Protection Regulation, the data subject is entitled to:at the request of the controller, delete the personal data concerning him without undue delay,and the controller is obliged to make the personal data of the data subject unjustifieddelete without delay if one of the following reasons exists:(a) personal data are no longer required for the purpose for which they were collected ortreated differently;(b) the data subject withdraws the authorization referred to in Article 6 (1) (a) or Article 9 (2);(a) the consent which is the basis for the processing and the processinghas no other legal basis;(c) the data subject objects to the processing pursuant to Article 21 (1) and is not
Page 24
24overriding legitimate reason for the processing or Article 21 (2) is concernedprotests against data processing on the basis of(d) personal data have been processed unlawfully;(e) personal data are required by the law of the Union or Member State applicable to the controllerto be canceled in order to fulfill an obligation;(f) the collection of personal data referred to in Article 8 (1)the provision of social services.Pursuant to Article 17 (2) of the General Data Protection Regulation, if the controller is made publichas brought personal data and is required by paragraph 1 to delete it using available technologyand take the steps reasonably expected, taking into account the costs of implementation,including technical measures - in order to inform the data controllerdata controllers that the data subject has requested from them links to the personal data in questionor the deletion of a copy or duplicate of such personal data.Pursuant to Article 17 (3) of the General Data Protection Regulation, paragraphs 1 and 2 do notapplicable if data processing is required:(a) for the purpose of exercising the right to freedom of expression and information;(b) the Union or Member State rules governing the processing of personal data applicable to the controllerfulfillment of a legal obligation or in the public interest or entrusted to the controllerfor the performance of a task performed in the exercise of a public authority;(c) in accordance with Article 9 (2) (h) and (i) and Article 9 (3)on grounds of public interest in the field of public health;(d) for archiving purposes in the public interest, in accordance with Article 89 (1), for scientific andfor historical research purposes or for statistical purposes where referred to in paragraph 1law would be likely to make it impossible or seriously jeopardize thatdata management; obsessione) to submit, enforce or defend legal claims.Pursuant to Article 18 (1) of the General Data Protection Regulation, the data subject is entitled to:at the request of the controller, the controller shall restrict the processing if one of the following is met:(a) the data subject disputes the accuracy of the personal data, in which case the limitation shall be:applies to a period of time that allows the controller to verify the personalaccuracy of data;(b) the processing is unlawful and the data subject opposes the deletion of the data and requests it insteadrestrictions on the use of(c) the controller no longer needs the personal data for the purpose of processing the data, butthe data subject requests them to bring, assert or defend legal claims;obsession(d) the data subject has objected to the processing in accordance with Article 21 (1); in this case therestriction shall apply for as long as it is established that thewhether the legitimate reasons of the controller take precedence over the legitimate reasons of the data subject.According to Article 18 (2) of the General Data Protection Regulation, if the processing is in accordance with paragraph 1such personal data, with the exception of storage, only by the data subjector to bring, assert or defend legal claims, orto protect the rights of another natural or legal person, or of the Union or any of theimportant public interest of the Member State.According to recital 67 of the General Data Protection Regulation, personal dataMethods used to limit the treatment may include, but are not limited to, the subjecttemporary transfer of personal data to another data management system, orterminating their access to users or from a website posted theretemporary removal of data. Restriction of data management with automated registrationsystems are basically provided by technical means, in a way that is personal
Page 25
25no further data processing operations may be performed on the data and they may not be altered.The fact that the processing of personal data is limited must be clearly indicated in the systemPursuant to Article 21 (1) of the General Data Protection Regulation, the data subject is entitled to:protest at any time for reasons relating to his own situation, in accordance with Article 6 (1).based on points (e) or (f) of paragraph 1, including those provisionsbased profiling. In this case, the data controller may not process the personal dataunless the controller demonstrates that the processing is justified by compelling legitimate reasons.justified by the interests, rights and freedoms of the data subjector to bring, assert or defend legal claimsare related.Pursuant to Article 21 (2) of the General Data Protection Regulation, if the processing of personal datain the interests of direct acquisition, the person concerned shall have the right to object at any timeagainst the processing of personal data for that purpose, including profiling, whereit is related to direct business acquisition.Pursuant to Article 21 (3) of the General Data Protection Regulation, if the data subject objects to theagainst the processing of personal data for the purpose of direct business acquisition, you are personaldata can no longer be processed for this purpose.Pursuant to Article 21 (4) of the General Data Protection Regulation, referred to in paragraphs 1 and 2at the latest at the time of the first contact with the data subjectclearly and separately from any other informationto be displayed.Pursuant to Article 77 (1) of the General Data Protection Regulation, other administrative orwithout prejudice to judicial remedies, any person concerned shall have the right to lodge a complaint with onesupervisory authority, in particular its habitual residence, place of employment or presumptionin the Member State of the offense, if the data subject considers that the personal dataprocessing of data infringes this Regulation.Infotv. Pursuant to Section 38 (2), the Authority is responsible for the protection of personal data,and the right of access to data of public interest and public interestpersonal data within the European Unionfacilitating its free movement. The Authority's tasks and powers are general data protectionArticle 57 (1), Article 58 (1) to (3) and Infotv. Paragraphs (2) - (4) of Section 38defined in detail.The right to the protection of personal data pursuant to Section 60 (1) and (2) of the Information Actthe Authority shall, at the request of the data subject, be a data protection authorityinitiate proceedings and may initiate ex officio data protection authority proceedings. The data protection authority procedureArticle 77 (1) of the General Data Protection Regulation andIt may be submitted in the case specified in Section 22 (b)..Unless otherwise provided in the General Data Protection Regulation, the application was initiatedfor data protection authority proceedings under Ákr. provisions of the Infotv shall applywith differences.Infotv. Pursuant to Section 61 (1) (a), it was taken in a data protection authority proceedingIn its decision, the Authority With the data management operations specified in Section 2 (2)in this context, in accordance with Article 58 (2) of the General Data Protection Regulationmay apply legal consequences. Accordingly , acting within the remedial powers of the Authority:(a) warn the controller or processor that one of the planned data processing operationsits activities are likely to infringe the provisions of this Regulation;
Page 26
26(b) condemn the controller or the processor if his or her data processing activitieshas infringed the provisions of this Regulation;(c) instruct the controller or the processor to comply with this Regulationexercise its rights under this Regulation;(d) instruct the controller or processor to carry out its data processing operationsin such a way and within a specified period, bring this Regulation into line with this Regulationprovisions;(e) instruct the controller to inform the data subject of the data protection incident;(f) temporarily or permanently restrict data processing, including data processingprohibition;(g) order personal data in accordance with Articles 16, 17 and 18 respectivelyrectification or erasure of data or restrictions on data processing, and in accordance with Article 17 (2).order notification to the addressees in accordance withwith whom or with whom the personal data have been communicated;(h) withdraw the certificate or instruct the certification body in accordance with Articles 42 and 43revoke a duly issued certificate or instruct the certification body to:do not issue the certificate if the conditions for certification are not or are no longer met;(i) impose an administrative fine in accordance with Article 83, depending on the circumstances of the casein addition to or instead of the measures referred to in this paragraph; and(j) order the flow of data to a recipient in a third country or to an international organizationsuspension.All supervisory authorities pursuant to Article 83 (1) of the General Data Protection Regulationensure that the infringements referred to in paragraphs 4, 5 and 6 of this Regulation comply with this ArticleThe administrative fines imposed pursuant to this Regulation shall be effective, proportionate and dissuasive in each casebe dissuasive.Pursuant to Article 83 (2) of the General Data Protection Regulation, administrative fines are imposed byreferred to in Article 58 (2) (a) to (h) and (j), as the case may beshould be imposed in addition to or instead of measures. When deciding if it is necessaryimposing an administrative fine or setting the amount of the administrative finein each case due account shall be taken of the following:(a) the nature, gravity and duration of the breach, taking into account the processing in questionthe nature, scope or purpose of the infringement and the number of persons affected by the infringement; andthe extent of the damage they have suffered;(b) the intentional or negligent nature of the infringement;(c) the mitigation of damage suffered by the data subject by the controller or the processorany measures taken to(d) the extent of the responsibility of the controller or processor, taking into account theTechnical and organizational measures taken pursuant to Articles 25 and 32;(e) relevant infringements previously committed by the controller or the processor;(f) the supervisory authority to remedy the breach and the possible negative effects of the breachthe extent of cooperation to alleviate(g) the categories of personal data affected by the breach;(h) the manner in which the supervisory authority became aware of the infringement, in particularwhether the controller or processor has reported the infringement and, if so, whatin detail;(i) if previously against the controller or processor concerned, in the samehave ordered one of the measures referred to in Article 58 (2),compliance with the measures in question;(j) whether the controller or processor has complied with Article 40approved codes of conduct or approved certification in accordance with Article 42mechanisms; and
Page 27
27(k) other aggravating or mitigating factors relevant to the circumstances of the case,for example, the financial gain obtained as a direct or indirect consequence of the infringementor avoided loss.Pursuant to Article 83 (5) of the General Data Protection Regulation, the following provisionsan administrative fine of up to EUR 20 000 000 in accordance with paragraph 2fines or, in the case of undertakings, the total annual worldwide turnover of the preceding financial yearshall not exceed 4%, with the higher of the two amountsto impose:(a) the principles of data processing, including the conditions for consent, in accordance with Articles 5, 6, 7 and 9;appropriately;(b) the rights of data subjects under Articles 12 to 22. in accordance with ArticlePursuant to Article 83 (7) of the General Data Protection Regulation, the supervisory authorities are Article 58Without prejudice to its power of correction under paragraph 2, each Member Statemay lay down rules on whether a public authority or body established in that Member Statewhether an administrative fine can be imposed on another body performing a public function, and if so, what kindextent.Infotv. Pursuant to Section 61 (1) (bg), in the data protection authority proceedingsIn its decision, the Authority may impose a fine.Infotv. 75 / A. § pursuant to Article 83 (2) to (6) of the General Data Protection Regulationshall exercise its powers in accordance with the principle of proportionality, in particular by:legislation on the processing of personal data or binding European Union lawin the event of a first breach of the rules set out in its actin accordance with Article 58 of the General Data Protection Regulation, in particularby alerting the controller or processor.The Acre. Under Section 17, the authority has the powers and competencies at all stages of the proceedingsex officio. If you notice any of your deficiencies and your doubts can be ruled out in the casecompetent authority shall transfer the case or, failing that, shall reject the applicationor terminate the proceedings.Pursuant to Section 47 (1) a) of the Ákr, the authority terminates the procedure if the applicationshould have been rejected, but the reason for this was after the initiation of the procedureauthority.Article VI of the Basic Law Under Article 1 (1), everyone has the right to private and family liferespect for his or her life, home, contacts and reputation. The expression of opinionfreedom of association and the exercise of the right of assembly must not affect the private and family life of others,and damage to your home.Act LIII of 2018 on the protection of privacy. Act (hereinafter: Mvtv.) 1-2. §everyone has the right to respect for his private and family life, his home and his relations (ahereinafter collectively referred to as the "right to privacy"). Right to privacy apart of the right to free expression of personality, under which the individualfreedom belongs to the responsible, independent shaping of life, family, home and human relationshipsestablishment and conservation. […] This right is only the exercise of another fundamental right or of onein order to protect constitutional value, to the extent strictly necessary, for the purpose to be achievedproportionately, respecting the essential content of the right to privacy and human dignitylimited by holding. The essence of the right to privacy is that it - in a separate lawwith certain exceptions - not to be harmed by others against the will of the individual. For privacyEveryone must respect the rights of others when exercising their right to
Page 28
28The Mvtv. Pursuant to Section 8, Paragraphs (1) - (2), the purpose of the right to respect for private life,in particular the right to anonymity, personal data, privacy, images and sound recordings,protection of honor and reputation. Violation of the right to privacymay mean personal data which an individual wishes to retain, in particular in relation to his or her privacy,abuse of secrecy, image, sound recording, or breach of honor and reputation.The Mvtv. Pursuant to Section 9, Paragraphs (1) - (3), everyone has the right to have his or her family life asprivacy, increased protection. The right to respect for family life isthe individual and his or her family member are entitled to it together. Infringement of the right to respect for family lifemeans, in particular, the unauthorized violation or disturbance of the family life of others or the family life of othersunauthorized interference with his or her life.Article VI of the Basic Law Everyone has the right to the protection of personal data pursuant to Articleand to learn about and disseminate data of public interest.Infotv. Pursuant to Section 1, the purpose of this Act is to process data in the areas covered by itlaying down basic rules for the protection of natural personsprivacy of data controllers and the transparency of public affairs in the public interest.and enforcing the right to access and disseminate public data in the public interestcome true.Infotv. Pursuant to Section 3 (6), public data in the public interest does not fall within the definition of data of public interestany information relating to the disclosure, disclosure or disclosure of whichdisclosure is required by law in the public interest.Infotv. Pursuant to Section 26 (2), public personal data in the public interest is purposefulin accordance with the principle of data management.The Ctv. The preamble states that the Ctv. aims to create a modern legal framework for theIn accordance with the regulations of the European Union.the order of registration and the constitutional rights of entrepreneurs in the economicto ensure the safety of traffic and to protect the interests of creditors or other public interestsfull disclosure of the data of the public register of companies, directly or electronically.The Ctv. Pursuant to Section 10 (1), the company register is from the company register as well as in the company registerconsists of annexes to certify the information contained in the Annex and other documents to whichsubmission of the company - in the public interest, or traffic safety, as well as the interests of creditors(hereinafter collectively referred to as company documents).The Ctv. Pursuant to Section 10 (2), the existing or deleted data of the company register, as well as the company documents -including company documents submitted electronically or converted into electronic documents,are fully public. Tax registration procedure under the Taxation Actwill also be fully public after the successful completion of the submitted, but not yet completedalso reviewed the application for registration and its annexes by stating that the application for registration (change registration)the business register must indicate the existence of an assessment. The legality of supervisionprocedure documents are public in accordance with the provisions of this Act.The Ctv. Pursuant to Section 24 (1) (b), (f) and (h), the register of companies is for all companiescontains the name of the company, its subscribed capital, its executive officer and the person authorized to represent the companyname, tax identification number, in the case of a natural person, place of residence, date of birth, motherbirth name,, in the case of a legal person, registered office and company registration number or registration number,as well as the position of the persons entitled to representation, the date of the establishment of this legal relationshipin the case of temporary representation, the date of termination of the legal relationship or if the legal relationshiptermination takes place earlier than the date indicated in the register of companies, the termination is effectiveand the fact that the company representative is notarized
Page 29
29a copy of the title or a specimen signature countersigned by a lawyer or bar counsel for submissioncost.The Ctv. Pursuant to Section 27 (3) a) and e), the register of companies is based on Articles 24-26. §in addition, in the case of a limited liability companya) the names of the members, in the case of a natural person, their place of residence, date of birth, birth name of their mother,in the case of a legal person, its registered office and its registration or registration number, andif the member's voting rights exceed 50 percent, or the memberhas a qualified majority influence, this fact as welle) in the case of a jointly owned share, the names of the owners, in the case of a natural personplace of residence, date of birth, mother 's birth name, in the case of a legal person, registered office, andcompany registration number or registration number.Act CVI of 2007 on State Property. Section 5 (1) - (2) of the Property Act (hereinafter: Property Act)public interest in and management of all public propertyavailable non-public interest data. State-owned enterpriseor a body or person in possession thereof is the Public Data Disclosure Actshall be deemed to be a body or person performing a public task in accordance withInfotv. Pursuant to Section 27 (3), it does not qualify as a business secret in the public interestcentral and local government budgets and EU supportbudget allowance, discount, state and municipalmanagement, possession, use, recovery of property,information relating to its encumbrance, the acquisition of any right affecting such property,as well as data the disclosure or disclosure of which is the subject of a separate lawin the public interest. However, disclosure should not result in such data- so especially protected knowledge - access to which are familiar with the businesswould cause disproportionate damage to the pursuit of the activity, provided that it does not impede itaccess to public data in the public interest.Article IX of the Basic Law Under Article 1 (1), (2) and (4), everyone has the right to:freedom of expression. Hungary recognizes and protects freedom of the press anddiversity, ensures the free movement necessary for the development of democratic public opinionconditions for information. The exercise of freedom of expression must not be directed at othersviolation of human dignity.Pursuant to Article 85 (1) of the General Data Protection Regulation, Member States shall legislatereconcile the right to the protection of personal data under this Regulation withthe right to freedom of expression and information, including personal datafor journalistic, scientific, artistic or literary purposes.Pursuant to Article 85 (2) of the General Data Protection Regulation, personal data are journalisticscientific, artistic or literary expressionMember States shall provide for exceptions or derogations from Annex II. Chapter III (Principles), Chapter III Chapterrights concerned), Annex IV Chapter V (the controller and the processor), Chapter V (personal datato third countries or international organizations), Chapter(independent supervisory authorities), Annex VII. Chapter IX (Cooperation and Coherence) and Chapter IX Chapterspecial cases of data processing) if these exceptions or derogations are necessary in order to:the right to the protection of personal data can be reconciled with the expression of opinionfreedom of expression and the right to information.According to recital 65 of the General Data Protection Regulation […], personal dataits further retention is considered lawful if it is an expression of opinion and informationthe exercise of the right to liberty, the fulfillment of a legal obligation, respectivelythe performance of a task carried out in the public interest or the public authority conferred on the controller
Page 30
30or in the public interest in the field of public health, archiving in the public interestfor scientific and historical research or statistical purposes, or for legal purposesnecessary to submit, validate or defendAccording to recital 153 of the General Data Protection Regulation, [the] law of the Member Statesmust reconcile expression of opinion and information - including journalism,the rules on freedom of scientific, artistic and literary expressionthe right to the protection of personal data under this Regulation. It is appropriate that the onlypersonal data for journalistic, scientific, artistic or literary expressionbe exempted or exempted from certain provisions of this Regulationfrom the requirements of this Directive if this is necessary for the protection of personal datareconciling the right to freedom of expression and information,provided for in Article 11 of the Charter. This applies in particular to personal audiovisual datanews archives and press libraries.Consequently, Member States shall determine the scope of this by adopting legislative measuresnecessary exceptions and derogations in order to strike a balance between fundamental rights. Member Statesexceptions and derogations shall be adopted in accordance with the general principles, the rights of the data subject, the controller and thepersonal data to third countries or international organizationsindependent supervisory authorities, cooperation and uniformityapplication and individual data management situations. If these are your exceptionsdifferences between Member States, the law of the Member State applicable to the controller should applyapply. The right to freedom of expression in all democratic societiesIn order to take account of the importance oflike journalism, it must be interpreted broadly.The Smtv. Pursuant to Section 4 (3), the exercise of freedom of the press may not be exercisedcriminal offense or incitement to commit a criminal offense shall not be contrary to public morality,and must not infringe on the privacy rights of others.The Smtv. Under Section 10, everyone has the right to be properly informed by the local, thenational and European public affairs, as well as citizens of Hungary and members of the Hungarian nationevents of major importance to him. The task of the media system as a whole is to provide authentic, fast,accurate information on these matters and events.The Smtv. Pursuant to Section 13, linear media services performing information activities are obligedlocal, national, national and European and Hungary of public intereston events and controversial issues of importance to its citizens and members of the Hungarian nationin a balanced way in the information and news programs they publishto inform. The detailed rules of this obligation are law of proportionality and democracyin accordance with the requirements of public opinion.A Ptk. 2:44 on the protection of the right to privacy of a public figure. § (1) - (3) athe exercise of fundamental rights to ensure the free challenge of public affairs to the privacy of the public figurenecessary and proportionate, without prejudice to human dignity;however, it must not harm your private and family life or your home. The publicagainst a communication or conduct outside the scope of free debate in public mattersthe same protection as a non-public actor. A public actor is not a public matteractivity or data related to your private or family life.Article 8 of the European Convention on Human Rights states that everyone has the right to:respect for private and family life, home and correspondence. Authority to exercise this rightit can only intervene in cases where it is democratic, as defined by lawin the interests of national security, public security or the economic well-being of the country,prevention of riots or crime, protection of public health or morals, ornecessary to protect the rights and freedoms of others.
Page 31
31Under Article 10 (1) of the European Convention on Human Rights, everyone has the right to: afreedom of expression. This right includes freedom of expression andit respects the freedom to know and communicate information and ideas across national borderswithout the intervention of an official body.III. Decision of the AuthorityIII.1. The identity of the controllerA natural person as defined in the General Data Protection Regulationany information on the basis of which that natural person is directly or indirectlyindirectly identifiable personal data, any operation performed on the datathe purpose and means of data management, alone or in association with othersnatural or legal person, public authority, agency or any other bodyand the body is considered a data controller.With regard to the data management examined, the full name, surname and economic situation of the Applicantspersonal data pursuant to Article 4 (1) of the General Data Protection Regulation,and the publisher of a press product that collects, processes, lists and publishes data isunder Article 4 (7) of the General Data Protection Regulation, a data controller is either online or offlinecontent, publications and personal data published in printed formwith regard to the (re) use of personal data andthe purpose of its publication is determined by the publisher of the press product.Data Management 1 and Data Management 2 pursuant to Article 2 (1) of the General Data Protection Regulationfalls within the scope of the General Data Protection Regulation and, consequently, thethe rules of the general data protection regulation apply.Pursuant to the above, the Applicant, as the publisher of Forbes in Hungary, is the objected data handlersis considered a data controller.III.2. The identity of the ApplicantsThe lack of public role of the Applicants was also repeatedly invoked by the Applicants in the proceedingsin their statements and correspondence with the Applicant.3145/2018. (V. 7.), the Constitutional Court emphasized that the change had taken placeexpansion of the range of public actors through the spread of social conditions, especially telecommunicationsso that people have the opportunity to become active participants in public debates,who were not previously included in the conceptual scope of public actors. These persons are the so-called. exceptionalpublic actors. {3145/2018 (V. 7.) Decision AB Justification [46]}Freedom of expression is primarily concerned with criticizing public authoritiesexpresses opinions, but in the interpretation of the Constitutional Court it is publicthe range of issues is wider than political speech and persons exercising public powercriticizing its activities. Accordingly, the public debate is not limited to the state andit covers the whole operation of the local government, the system of public authorities, but also encompasses itin the world of corporate social responsibility and businesspublic issues (eg environmental, energy efficiency, labor, etc.)road safety issues). {3145/2018 (V. 7.) AB Decision Justification [31] - [32]}According to the decision of the Constitutional Court, in deciding the quality of a public figure, the followingaspects are relevant:
Page 32
32- whether the public statement expressing the opinion reflects the position expressed in the public interest debate,- whether the public communication involves a public performance,- whether the communication to the public involves a statement of fact or a judgment of value,- whether the communication to the public infringes the human dignity or reputation of the person concerned(honor).Public actor quality is the fact of public involvement that goes hand in hand with the discussion of public life issueswhich, according to AB, must always be assessed individually on the basis of the specified criteria:the manner and circumstances of the communication and the subject and context of the opinion (eg the medium)type, subject of communication, content, style, purpose, topicality, reactions to it).The exercise of freedom of expression can only be justified in cases wherein which the participants have become, at their own discretion, more active actors in public affairs than others,thereby also undertaking public assessments and criticisms of the community concerned. Public affairstherefore, statements which affect or characterize them and which attack themthey have to put up with more patience. { 3145/2018 (V. 7.) Decision AB Justification [48]}The Applicants emphasized that they had always wanted to separate their private lives frommarket life, and although the establishment of a business is voluntary, this does not in itself mean thatbusiness owners, senior executives become public actors, andthat someone is rich is not necessarily a sufficient condition for restricting privacy, that israther, it is only one component of influence.However, in the case of the Applicants, the fact that the […]in a few years - from state subsidies and from state or other public fundsresources - has become a market leader in several countries. Applicants must counthad to be a successful, high-wealth company in the case of the business world as a public life onethey also become active shapers of its segment, undertaking the accompanying evaluations and criticismswhich they thus have to endure with greater patience.In connection with the present case, it can also be stated that one of the content elements of the examined communications is the Applicantsname and managing position, ownership position shall be considered as public data in the public interestdue to:- The Ctv. Pursuant to Section 10 (2), the existing or deleted data of the register of companies are in fullare public. Thus, the data contained in company files, including personal data,which, during registration in the register of companies, the purpose of the register of companiesaccordingly, data subjects provide their personal data with a view to disclosureaccessible to anyone. Existing or deleted data in the register of companies, as well aspersonal data contained in company records are public data in the public interest which are personaldata and also public data in the public interest.- On the mandatory content of the register of companies, the Ctv. Section 24 (1), as well as limited liabilitycompanies such as […] - Ctv. Section 27 (3) provides. The referencedlegislation stipulates that the register of companies for all companies, inter alia,contains the name of the company's senior executive or the person authorized to represent the company,the position of the persons entitled to represent and, in the case of a limited liability company,among other things, the names of the members or, in the case of a jointly owned share, the owners.- The publicity of the data included in the register of companies is regulated by Ctv. according to its preamblepurposes and the legislator considered that this interest outweighed the data subjectsinterests.It should also be noted that the information provided in the publications on […] is on the one handcan be found in […] 's own accounts and website, and on the other hand, that [[] publichas implemented and is implementing various expansions, capacity enhancements,
Page 33
33public data in the public interest according to the Property Act. Section 5, paragraphs (1) - (2), and Infotv. Section 27 (3)pursuant to paragraphIII.3. Legality of data processingThe subject matter of the present case is not usually the data protection analysis of economic journalism, and although the nature of the caseand circumstances, the Authority also makes general findings to emphasize that it is presentIn this procedure, the Authority is linked to specific publications ("products") issued by the Applicantexamined data treatments.Under the provisions of the General Data Protection Regulation, there are a number of reasons for the lawfulness of data processingrequirement must be met.Article 5 of the General Data Protection Regulation contains the main principles that are personalmust be taken into account in the processing of the data and which must be in force at all timesduring data management. Such principles include legality, due process and transparency,the principles of purpose limitation, data saving, accuracy and limited storage [5. Article 1paragraph 1 (a) to (e)]. From the principle of accountability [5. Article 2 (2)]is responsible for complying with data protection principles and must be able to do soalso to prove. Accordingly, the data controller must be able to prove that it is personalthe purpose for which it processes the data and why it can be considered for that purposeit is imperative to process your personal information, in addition, you must do everythingreasonable steps to ensure that it is inaccurate for the purposes of the processingdelete or rectify personal data without delay and document andkeep records of data processing so that its lawfulness can be proved afterwards.The controller must have a legal basis in accordance with Article 6 of the General Data Protection Regulationhave access to the data and be able to demonstrate that, with the consent of the data subject, orwhich legal provision it handles / has handled personal data in accordance with or whichdata processing is necessary to enforce the legitimate interests of the controller or a third party,and the processing restricts the data subject's right to the protection of the personal data proportionately.The name and financial situation of the Applicants are undoubtedly personal to the Applicantshowever, their activities in relation to the company in which they have an interesthaving regard to the fact that their data entered in the business register are public data in the public interest, as well asa Ctv. Company data pursuant to Section 10 (1).Of course, the quality of the company data in the data in question does not mean that the data in the company registercould be used in any way: respecting the principle of purposeful data managementappropriate legal basis, and - ensuring the right to information self-determinationwith due regard for the rights of the data subject.According to the Applicant's statement, the purpose of data processing is the rights arising from the freedom of the pressinformation activities of the press in a democratic societyimplement. The Applicant also aims to inform the Hungarian business community, aabout the owners behind the largest Hungarian-owned companies, thus contributing to businesstransparency and traceability. The Applicant also considers it his responsibility to be Hungarianstrengthening the entrepreneurial culture by reporting on the activities of successful Hungarian entrepreneurs- the compilation of the annual rich list partly serves this purpose.In the publications, the Applicant linked […] to the “[…] family”. The Authority considers thatin the context of publications, the word ‘family’ is synonymous with family businessshould be interpreted, and although there is no legal definition of a family business in Hungary,according to professional interpretation, regardless of their size and results, it is a family-run economy
Page 34
34companies, ie family businesses, are companiesmajority controlled by a family or families with common ancestors,in the hands of family members is concentrated so that control is at least two, owner and / or managerthrough the strategic and / or operational activities and decisions of the employed family member.Of the Applicants, only […] were named for Data Management 2, and although Data Management 1it has been indicated that the […] generation of the family has an interest in the economic activity,publications never name other family members, either specifically or indirectlyreferring to them. From the information in the company register, it is clear that the […] familywhich members belong to this staff group.Consequently, the Applicants' view that the "[…] family" is not valid is incorrect.it would be inaccurate personal data because it applies to all family members, including minor childrencontains a reference. Neither the printed nor the online versions of the lists contain any direct or indirectreference to minor children, i.e. the Applicant does not treat the family as a minorand information on minor family members in the register of companieslocated. Consequently, minor members of the […] family cannot be considered Data Management 1 andData management for 2 stakeholders.It should also be noted that Forbes is an economic, business articles and articlesa press product containing compilations, so that the Authority considers it accessible to anyonerecords and data forming part of companies' own public communications and accounts; andthe communication and dissemination of information in different compilations does not violate the purposeprinciple of data management.It should also be emphasized that assets derived from economic activities orEstimating the value of a company using a specific method is clearly afreedom of expression. The Applicant's estimate is different from the publiccollected data from different sources and then this data into a specificevaluated on the basis of a methodology.For Data Management 1, the following methodologies can be found in both the printed and online versionsdescription:“We took as families the companies where the ownership circle and the leaderthere is a blood relationship between the members of the management (i.e. owned by the spouses)companies, if no other relative is a member of the management, were not taken into account). The companiesevaluated based on the American Forbes methodology. Where possible, on an EBITDA basiswe calculated, this is best suited to show the money-making capacity of firms.We used industry multipliers and then deducted the company's liabilities from the value thus obtained,and we added your cash stock.In all cases, we worked from publicly available information, where possible, on a consolidated basisdata were used where such were not available, we ourselves consolidated theresults on the basis of available information. The Bisnode PartnerControl collections helped theConcorde MB Partners advised us on the company evaluation. ”For Data Management 2, the following methodological descriptions can be found in the printed and online versions:“We evaluated the companies based on the methodology of our American parent company. Where we knew it isWe calculated on the basis of EBITDA and took into account the court data. The internationalin accordance with company valuation practice, we used an industry multiplier. This is AswathWe used Damodaran, a professor at New York University, as a starting point, buttogether with our company valuation specialists and our regional sister sites, the multipliers for the region, respectivelywe tailored it to the Hungarian market, where it was necessary. The company was added to the value thus obtained
Page 35
35and the loans were withdrawn from it (in the case of larger holdingsalways based on consolidated accounts).Assets accumulated in real estate, asset management or financial companies (thevalues ​​of real estate, assets, investments) and according to the American Forbes methodologyall liabilities were accounted for.We deducted taxes on dividends, and where we knew, we surveyed billionaires, among othersfinancing needs of its interests and have also been deducted from the dividend or offsetalso part of the dividends of recent years. We always work from publicly available data.We have always used the most recent data available, for most non-public companiesthis means the financial statements submitted for the financial year from 1 January 2018 to 31 December 2018.For stocks, we have calculated the latest data. Closing of the property valuation: December 201910.Bisnode PartnerControl assisted us in collecting the data. The companiesWe were helped by the M&A experts of consulting companies. ”A similar methodological description is described in all similar Forbes publications (printed andonline version). In addition to the declarations and the AuthorityBased on the documents sent, it can be established that the Applicant is the current listsbut in all cases before the publication of the publicationsThe property and value valuation prepared for the Applicants on the basis of the methodology isor in relation to the business, in any case requesting feedback from them, and thatclarify the data if necessary. (Correspondence between the Applicants and the Applicantdetailed in III.4. presented in the context of the rights of the data subject.)Consequently, on the basis of the above, the Applicants' claim thatthey don’t know what logic Forbes journalists use to analyze the data.The Applicant did not specify the legal basis for data processing, although it did not specify itreferred to Article 6 (1) (e) of the General Data Protection Regulationindicated Article 6 (1) (f) of the General Data Protection Regulation. All this to the Applicanton the ground that, in its view, the activity carried out by the Applicant, namely theeconomic journalism and, within this framework, the richest and largest (orabove average) persons with social influence on a regular basis, publicly availabledata collection and a specific methodology for data and informationevaluation, interpretation and archiving of activities in the public interestthe […] receive and have received significant state subsidies, which in itself justifies its citizens(the readership) the identity of the owner behind the investmentbe.The Applicant also referred to the Basic Law of Hungary - which is personal datain addition to the right to the protection of the public, the disclosure of data of public interest and the freedom of the press and thealso protects the diversity of the press - Article 10 of the Smtv, Article 85 of the General Data Protection Regulation,and decisions made by the Constitutional Court that are expressly made by the pressdata management and the exercise of freedom of the press, as well as the expression of opinionsborn in the context of his freedom.The Basic Law of Hungary provides for the right to the protection of personal data, freedom of the press and thealso names freedom of expression as a fundamental right, such as freedom of the press andfreedom of expression as a constitutional fundamental right to the enforcement of personal datamust be accompanied by the protection of the fundamental constitutional right toThe Constitutional Court ruled on the issues of media law 165/2011. (XII. 20.) ABsummarized its views on the establishment of freedom of expression and the press, and
Page 36
36in addition to freedom of expression, stressed the importance of democratic public opinion by citizensthe importance of shaping In its decision, the Constitutional Court stated that “freedom of opinionit simultaneously serves the fulfillment of individual autonomy and the democratic side of the communitythe possibility of creating and maintaining public opinion. [...] The press is about free speechinstitution. Thus, freedom of the press, as far as speech, communication and opinion are concernedits protection is also twofold: subjective subjective lawthe establishment and maintenance of democratic public opinion on the part of the communityserves. [...] By exercising the right to freedom of the press, the holder of a fundamental right is an active shaper ofdemocratic public opinion. In this capacity, the press monitors public actors,the activities of its institutions, the decision-making process, inform the political community,democratic publicity (the role of the “watchdog”). "The Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Oy Satamedia advancein Case C-73/07, REFERENCE for a preliminary ruling under Article 234 EC In case noprotection of individuals with regard to the processing of personal data and on the free movement of such dataArticle 9 of Directive 95/46 / EC of the European Parliament and of the Council of 24 October 1995replaced by journalistic activities within the meaning of Article 85 of the General Data Protection Regulationand in its judgment of 16 December 2008 stated the followingmeg:- "In order to take into account that what freedom of speech is of great importancein all democratic societies, on the one hand, and the concepts involved, on the otherjournalism must be interpreted broadly. On the other hand, and the balance between the two fundamental rightsprotection of the fundamental right to privacyrequires that […] data protection exceptions and limitations to thewithin the limits strictly necessary. " [OJ C C-73/07. s. Case, paragraph 56]- 'The exceptions and derogations provided for in Article 9 of the Directive apply not only to media undertakings,but apply to all persons engaged in journalistic activities. " [EUB, C-73/07. s. Case, paragraph 58]- “The fact that the disclosure of public data is for-profitdoes not preclude, a priori, that it was carried out solely for the purpose of journalismconsidered as an activity. […] Some commercial success is professional journalismessential conditions for its survival. " [OJ C C-73/07. s. Judgment in Case.point]- 'Concerning data derived from public documents in accordance with [national] lawactivities such as those at issue in the main proceedings may be classified as 'journalistic activities',if their purpose is to provide information, opinions or ideasavailable to the public, whatever the mode of transmission. Eactivities are not reserved for media companies and may be linkedfor profit. " [OJ C C-73/07. s. Judgment, paragraph 61]The above findings of the CJEU are Sergei Buivids v. Datu valsts inspekcija preliminary rulingin Case C-345/17. in case no. 14 February 2019also reiterated in its judgment:- 'The Court has already held that, in order to take account of the fact that athe importance of freedom of expression for all democratssociety, relevant concepts, including journalism, need to be interpreted broadly(see in this regard: Satakunnan Markkinapörssi and Satamedia of 16 December 2008Case C-73/07, EU: C: 2008: 727, paragraph 56). ’ [ECR C-345/17. s. Case, paragraph 51]- Thus, it is clear from the travaux préparatoires for Directive 95/46 that Article 9 of that directiveThe exemptions and derogations provided for in Article 1 apply not only to media undertakings but also to:apply to all persons engaged in journalistic activities (seeJudgment of the Court of 16 December 2008 in Case C-73/07 Satakunnan Markkinapörssi and SatamediaEU: C: 2008: 727, point 58). " [ECR C-345/17. s. Case, paragraph 52]- 'It is clear from the case-law of the Court that' journalistic activities' are those aactivities designed to provide information, opinions or ideas
Page 37
37available to the public, whatever the mode of transmission (seein that regard: Judgment of Satakunnan Markkinapörssi and Satamedia of 16 December 2008, C-73/07, EU: C: 2008: 727, point 61). " [ECR C-345/17. s. Judgment, paragraph 53]Recital 153 of the General Data Protection Regulation also states thatthe right to freedom of expression exists in all democratic societiesIn order to take account of the importance ofjournalism, should be interpreted broadly.From publicly available databases, companies' own communications and reportsprocessing of (personal) data from, as well as the data collected is specifiedfrom the evaluation based on the methodology and the valuation, even newlyactivities concerning the data generated for the journalistic activity of the Applicantare related. The fact that the disclosure of this information is appropriatefor profit (also) does not preclude it from being carried out for journalistic purposesconsidered as an activity.The European Court of Human Rights (ECtHR) has a wealth of case lawin developing the specific benchmarks that have been voiced in the debate on public affairslimitation of opinions. The practice of the ECtHR, however, is alsomade it clear that opinions expressed in the context of public affairs were more protectedit is not limited to political debates and politicians in the narrow sense. On the one hand, party politicsin addition to debates, it also protects the freedom to discuss other issues affecting the community with particular forcethe right to freedom of expression guaranteed by the European Convention on Human Rights (ECtHR: Thorgeirsonv. Iceland, application number: 13778/88, paragraph 64, 1992, decision on the merits and satisfaction) .On the other hand, the ECtHR does not call only in cases where the public affairs dispute is outstandingimportant argument in which the disputed speech is addressed to politicians or officialsbut also if the public interest issue (also) concerns individuals. LatterIn this case, the tolerance threshold for individuals should also increase (ECtHR: Bladet Tromsø and Stensaasv. Norway, application number: 21980/93, 1999, decision on the merits and satisfaction) .Thus, in terms of the application of specific standards, it is not the person concerned per sestatus, but the public nature of the opinion.That is to say, it is not the case with free expression of opinion in public affairsthe significance of whether or not the person covered by the report is a professional public figurenor the question on which the speaker spoke and the communication in questioncontributes to public debate.Although the Applicants' role in business as well as public or other public fundsand the use of factual newspaper articles and reports related to themmay indeed be related to a public debate, the question arises as to whether this is by the Applicantcan also be said for published rich lists.The already mentioned “Markkinapörssi case” was also examined by the ECtHR { Satakunnan Markkinapörssi Oy andSatamedia Oy v Finland [Grand Chamber], 931/13. s. case, 27 June 2017}, whichrecalled in its decision the criteria of the case-law to which it was guidedshould serve the national authorities and the ECtHR itself when facing each otherthey consider freedom of expression and the right to privacy.When it comes to political speech or debate on a matter of public interest, there is littleit is possible to restrict the right to know and communicate information, “and that is a fundamental onelaw in a democratic society ’.Derogations from data protection rules for journalistic purposes allow journalists to:access and collect personal data in order to carry out their journalistic activitiesand deal with them, however, the ECtHR pointed out that the mere fact that
Page 38
38any information available to the public does not necessarily exclude it from Human RightsFrom the protection of Article 8 of the European Convention and to companies as a professional media industryactors had to be aware of the need for large-scale data collection and publicationthe exception rule exclusively for journalistic activities does not necessarily apply. TheThe rights protected by Articles 8 and 10 of the European Convention on Human Rights are reciprocalHowever, with regard to the weighting of documents, the ECtHR has pointed out, on the one hand, thatfree access to information) can indeed help to address issues of public interestdemocratic debate, however, found that the raw data without any analysis, largethere was no public interest in publishing it in the crowd. Taxation data acurious members of the public could allow individuals based on their economic situationcategorization of the privacy of othersdesire for information, which should not be seen as promoting a debate on an issue of public interest.The ECtHR has also transposed the case law of the ECtHR into EU law in the already mentioned ‘Buivids case’ :in that regard, it is clear from that case-law that it is intended to respect privacyin order to strike a balance between the right to freedom of expression and the right to freedom of expressionThe European Court of Human Rights has developed the relevant criteria to be taken into account, inter aliathe contribution to the public interest debate, the awareness of the data subject, the subject of the report, the data subjectpast conduct, content, form and consequences of disclosure, informationthe manner and circumstances of obtaining the information and their appropriateness (see in this sense:ECtHR, 27 June 2017, Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland,CE: ECHR: 2017: 0627JUD000093113, § 165). Similarly, it must be borne in mind thatthe controller may accept a reduction in the scope of the invasion of privacyenabling measures. " [ECR C-345/17. s. Case, paragraph 66]The Constitutional Court ruled in favor of the Mansion Pfv.IV.20.884 / 2017/7. Annuling Judgment IV / 1368/2018.in the Resolution No. Pfv.IV.21.398 / 2017/4 of the Mansion. annulling his judgment noIV / 316/2019. It also stated in its resolution no . in Article 1 (1)due to the special protection of the private and family life, home and contact of the individual aclose relatives of public and non-public actors should also be particularly protected. […] Alone apublic curiosity, gossip is not the basis for a question of public interestnature. The right to privacy of a non-public actor in order to have the right to express an opiniona non-public actor may be constitutionally restricted in a matter of overriding public interestfamily relationships, provided that it is essential to inform the publicnecessary and the information disclosed is a specific, non-publican adequate detail relating only to the matter of public interest. " {IV / 1368/2018. ABDecision, Justification [61]; IV / 316/2019. Decision AB, Justification [54]}In view of the above, the Authority considers that there are no indications thatcompiling rich lists would be a “watchdog” type of activity and that specific public debatewould be related. These lists are published regularly (annually), not for specific eventsthey are related, but precisely to who and to what extent the given has been enrichedregardless of the source of the assets, the lists are based on a specific methodologyare compiled, not on the basis of who or which business received state aidsupport, so that the compilations also include persons and undertakings who, respectivelywhich did not receive state aid. As long as economic journalism can really‘Mission’, while the ‘rich list’ as a product is primarily not directly for public debatebut satisfies a ‘rumor hunger’, as it is not about concrete fact-finding, investigationit is about (which is typical of “watchdog” type journalism) but that the Candidate abased on publicly available information, estimated by businesses according to their own methodologyor, in the case of persons, assets derived from the activities of the undertakingthen ranks companies and individuals on the basis of estimated value or assets.Reference to business journalism as an activity of public interest Data management 1 andData management 2 cannot be accepted as a legal basis for data management either. The reason is that
Page 39
39the legal basis under Article 6 (1) (e) of the General Data Protection Regulation is a piece of legislationmay be related to a data management activity related to a public task classified as such by the THEAlthough economic journalism is an activity in the public interest, it is not a public task (the General Data Protection Act)a public interest task in the wording of the Regulation), just as a journalist cannot be consideredto a person performing a public task [cf. Section 459 (1) of Act C of 2012 on the Penal Codeparagraph 12].Thus, in the case of Data Management 1 and Data Management 2, as well as similar “rich lists”, the Applicant does notperforms a task in the public interest, not least because these lists - by their nature andsince this is not their purpose either - they do not give a thorough picture of a dubious or perceived transaction.Journalism is not covered by Article 6 (1) (e) of the General Data Protection Regulation itself.within the scope of the legal basis set out in This is borne out by Article 17 (3) (b)follows closely the terms also used in Article 6 (1) (e) [or the Union legislatorin Article 17 (3) (b), it essentially merged what is already close to each otherPleas in law pursuant to Article 6 (1) (c) and (e)]. Related to the expression of opinionhowever, the deletion of data cannot be avoided by this point but by Article 17 (3) (a)included.It follows that Data Management 1 and Data Management 2, similar “rich lists”,and, in general, all data processing related to business journalism, which is notArticle 6 (1) (f) of the General Data Protection Regulationlegitimate interest may occur on a legal basis.In his statements made during the proceedings, the Applicant also referred to the legal basis of the legitimate interest.According to recital 47 of the General Data Protection Regulation, if the data processinglegal basis is a legitimate interest, it must be preceded by a balance of interestsit must specify, inter alia, the legitimate interest, the effect on the person concerned and whether:whether the processing is necessary or proportionate and whether it is a legitimate interest or notwhether the right of the data subject is superior.Thus, data processing based on a legitimate interest can only take place if the data controller has done so in advanceperforms the interest balancing test and, as a result of the test, the data controller or a third partylegitimate interests outweigh the possible disadvantages to the data subject through the processing.The balancing test is a three-step process in which thethe legitimate interest of the controller as well as the interest of the data subject as opposed to the weighting and the data subjectfundamental right, and finally, on the basis of the weighting, it must be determined whether it is personaldata. On this basis, it falls under Article 6 (1) (f) of the General Data Protection Regulationreference may be appropriate and thus data processing may be lawful if itthe conclusion of the balancing test is that the controller or a third party has a legitimate interesttakes precedence over the data subject's legitimate interest in protecting his or her personal dataand the limitation of the rights of the data subject is proportionate to whether the controller or a third partywith a legitimate interest in the restriction.In doing so, the controller must consider, inter alia, that the data subject is concernedwhether it is a public actor (if so, this strengthens the data controller’s interest in data management) or thatwhether the journalistic activity in question is of an investigative nature (again, this only strengthens the data managementinterest) or only to satisfy a rumor hunger (in this case, personalstronger interest in data protection). Balance of interests is also successful if it isthis article is about public subsidies and otherwise public data in the public interest(e.g. company data).
Page 40
40The balancing test shall be properly documented in accordance with the principle of accountability,and data subjects must be duly informed in accordance with the General Data Protection Regulationthe legitimate interest of the controller, whether or not personal data are collected from data subjects [Article 13].Article 14 (1) (d)] or have not been obtained from the person concerned [Article 14 (1) (d)]. Article 2 (2) (b)point].In its statements made during the proceedings, the Applicant set out its position and arguments on its own andthe existence of a legitimate interest of a third party (the public) and thus the rights of the Applicants andhowever, this is not in line with the general data protection regulation (47).the requirements relating to the balancing of interests set out in recital THEThe applicant did not carry out the balance of interests properly and, as set out in Article III.4 of the Decision.is not explained in detail in point (a)information to the Applicants and only to the Applicants' legal representativeinformed the Applicants in its replies.In connection with the balance of interests, it should also be emphasized what a data management is likeand to what extent it may adversely affect a data subject cannot be generalized becausethe data subjects and their circumstances are different in each case, so this is a subjective value judgment,which means the same data management that one considers acceptable in one casedata subject, in another case another data subject may find it offensive.Freedom of information and the right to information self-determination must be taken into accountit must be taken into account whether the disclosure of the data does not disproportionately infringe thethe right to privacy. In the present case, however, it can be stated that the ApplicantThe content of the data processing carried out by the Company and the public communications based on them is not the responsibility of the Applicantsprivate or family life, but also the activities of the undertaking in which they have an interest,and the economic results that can be derived from it. Obviouslyit can be stated that the data processed in this circle, as well as the communications, are not theIt is for applicants ’family and private lives, but also for their achievements in economic and business lifeto do.Given that the compilations of the Applicants are available to anyone in the public interestpublic personal data, the estimated amount of assets generated by the economic activity,or contain no additional personal data beyond the estimated value of the business, andThe content of the articles is based on […] 's reports and public announcements, so data management does not go beyondnecessary and proportionate, and archiving the lists is compatible with data managementFor its original purpose, the Authority notes that the requested Data Management 1 and Data Management 2Article 5 (1) (b), (c) and (d) of the General Data Protection Regulation.and (e), data economy, accuracy and limited storageprinciple.Based on the principle of accountability, data controllers throughout the data management process sothey must implement data management operations to be able to protect datato demonstrate compliance with the rules. The principle of accountability is therefore not onlyprocess level can be interpreted, but all specific data management activities, a specificthe processing of the personal data of the data subject.In the opinion of the Authority, the legitimate interest indicated by the Applicant is acceptableand Data Management 2, however, with the Applicant failing to weigh the interestsduly carried out, or in their own or the public's legitimate interests, and by the Applicantsdid not inform the Applicants in advance of the outcome of theinfringed Article 6 (1) (f) of the General Data Protection Regulation and the Generalthe principle of accountability under Article 5 (2) of the Data Protection RegulationAlso for data management 2.
Page 41
41III.4. Rights of the data subject and limitations on the exercise of rightsIn connection with the rights of the data subject, the Applicants in their application Data Management 1 and Data Management 2Article 13 (2) of the General Data Protection Regulation(f) and Article 14 (2) (g), Article 14 (1) to (2), Article 15 (1)for infringement of Article 21 (1) (h) and Article 21 (1)unlawful processing and order, pursuant to Article 18 (1) (a) and (d),personal data and then personal data in accordance with Article 17 (1) (c)deletion.The duality already detailed above - that certain personal data is also in the public interestpublic company data - it cannot, of course, mean that the person concerned is completely affected by this circumstancewould lose its right to self-determination over the data and the disclosure of personal data aunrestricted and complete loss of the right to privacy.Rights of data subjects (including the right to information, protest and cancellation)data controller obligations related to the exercise ofArticle 12 of the Data Protection Regulation.Based on the statements and available documents Applicants (or their legal representative)The following exchanges of letters took place between the Applicant (and its journalists) during the period under review:- An e-mail from the journalist employed by the Applicant on 16 August 2019contacted the company related to the Applicants in connection with Data Management 1,attached to which letter was used to compile the compilationThe following is a brief description of the methodology:“We evaluated the companies based on the methodology of our US parent company. Wherewe knew, we calculated on the basis of EBIDTA and we took into account company court data. THEaccording to international company valuation practice, we used an industry multiplier. This is AswathWe used Damodaran, a professor at New York University, as a starting point, buttogether with our domestic company valuation experts and our regional siblingstailored to the region and the Hungarian market, where necessary. To the value thus obtainedwe added the cash stock available to the company and subtracted theloans. You can find our detailed calculation in the attached Excel file. ”In addition to the methodological description, as an attachment to the e-mail in the form of an excel spreadsheeta calculation (estimate) based on […] data was also sent.Based on the above, it can be concluded that the Applicants, contrary to their claim, did not apply in 2019.on August 26, 2019, but on August 16, 2019, were informed that aApplicant wishes to be on Forbes ’list of most valuable family businessesto be indicated in the […] Following a journalistic request, 22-26 August 2019. betweenThe following exchanges of letters took place between […] and the Applicant during the period:• Applicant on August 22, 2019 - to an e-mail unknown to the Authorityin his reply, informed the person acting on behalf of […] (or the Applicants)person that the company name and surname will be included in the list for everyone, aabove the article the owners in the company registration are indicated,as when […] was last on this list.• On 26 August 2019, […] addressed a request to the Applicant that aAs in previous years, it was requested to exclude the […] and […] familiesData Management 1 and should not be used in any compilationthe term “[…] family”.• The Applicant provided information in its reply sent on 26 August 2019that […] had not been listed in the Forbes family business in previous yearsbecause of the data for that year and the estimates based on themin their opinion, they did not fit into the top 25 companies. For three years the family and
Page 42
42the company was on the list at the time because it was calculated at the time to fit into the 25thamong the largest companies. On other Forbes lists - for example, the 100 largest Hungariansowned private company ranking - in recent years has also been included in the […], then formention of the family was omitted because it was not justified.- In their letter dated 30 August 2019, the Applicants referred to the General Data Protection RegulationArticle 14 of the General Data Protection Regulation.Article 16 of the General Data Protection Regulationthe right to rectification (as regards the term ‘[család] family’) and the generalincluding the right to object under Article 21 of the Data Protection Regulationa request for the exercise of a right was made to the Applicant. The right to protestThe Applicants did not explain in sufficient detail in their application for the exercise of thereasons for the protest, they merely indicated that in their view there was no such coercionlegitimate reason on the basis of which the Applicant would be entitled to process their personal data.- In its reply to the data subject's request for the exercise of the right, the Applicant• indicated the purpose of data management (informing the public, for freedom of the pressexercise of the right of access), indicated the categories of personal data (names of owners,name of their mother, names of senior executives) and personal or […]sources of information on the results of (Information in the Company Database, the e-reports downloaded from beszamolo.im.gov.hu , previous announcements of […],public announcements);• provided information that, although external experts were consulted, they did sotypically only industry multipliers are negotiated with them, external experts are preparedspecific estimates only in exceptional cases, in personbut does not provide the Requested Data during the personal consultation,but only the company name, the balance sheet data used for the estimates, the multiplier and thethe final result of the estimate is shared with them, but neither [[] nor […]in the case of other family interests;• marked the person involved in compiling the list and thus the data managerstaff, with the special reference to being a trainee on the listdid not have access to the database created to create the list - so did the data for […]and his work was covered by a traineeship contract supplemented by a confidentiality clauseperformed on the basis of;• in connection with the duration of the data processing, provided information that aavailable company data were used to verify the criteria for a family businessbut not recorded by the Applicant; required for estimationdata were used to compile the list and then deleted after the material was completed;• Finally, he mentioned that […] and the name of the control family were included in the magazine(no separate family member was mentioned) and the estimated goodwill was included;the same data are included on the forbes.hu page, where an extract of the list was placedfor communication.- The Applicant in November 2019 (according to the Applicants' statement on 6 November,according to the Applicant's statement on November 14 - the exact date before the Authorityunknown) contacted the Applicants (who exactly is, it is also not possible to determineon the basis of declarations and documents received by the Authority) in relation to Data Management 2,attached to which letter was used to compile the compilationThe following is a brief description of the methodology:“We evaluated the companies based on the methodology of our US parent company. Wherewe knew, we calculated on the basis of EBIDTA and we took into account company court data. THEaccording to international company valuation practice, we used an industry multiplier. This is AswathWe used Damodaran, a professor at New York University, as a starting point, buttogether with our domestic company valuation experts and our regional siblingstailored to the region and the Hungarian market, where necessary. To the value thus obtained
Page 43
43we added the cash stock available to the company and subtracted theloans. The above methodology is most applicable to production companies. Financialfor service providers and real estate developers, it is also a U.S. parent fund guideWe act on the basis of: here the value accumulated in the company (mostly from assets)we start and deduct all liabilities. You will find our detailed calculationin the attached Excel file. "In addition to the methodological description, as an attachment to the e-mail in the form of an excel spreadsheeta calculation (estimate) based on business data was also sent.- The Applicants' lawyer sent to the Applicant on 15 November 2019letter of formal notice pursuant to Article 21 of the General Data Protection Regulationprotested against the data processing carried out by the Applicant concerning Applicants andthey were prohibited from accessing any personal data concerning themcollect and perform other data processing activities, includingdisclosure. Applicants were also prohibited from doing so - either by name ormentioned as a family, appear in the statement, either directly or indirectly,and called on the Applicant to provide the Applicants ’personal details without delaydelete them and do not carry out any data processing operations on them or on them.The Applicants are Article 18 (1) (a) and (d) of the General Data Protection Regulationalso requested a restriction on data processing and strongly called on theApplicant to refrain from publishing data concerning Applicants in generalcircumstances set out in Article 18 (1) (a) and (d) of the Data Protection Regulationas well as in the wake of the protest. The Applicants also called on theApplicant's attention is drawn to the fact that the data contained in the company register of the Applicants andthe conclusion reached regarding the financial situation of their family is inaccurate or erroneous, aThe data on the financial situation of the applicants differ significantly from the actual onesnotarised by a notary public. For the exercise of the right of objectionIn this application, the Applicants did not explain in sufficient detail the reasons for the protest,they merely indicated that, in their view, the data processing was seriously prejudicial toApplicants' rights and legitimate interests.- In its reply of 20 November 2019, the Applicant• Article 6 (1) (f) of the General Data Protection Regulationas a legal basis for data management; the Applicant justified this on the grounds that onean economic newspaper such as Forbes has a legitimate interest in Hungarian entrepreneursto inform the public and to refer to the State aid used by […]and to participate in the bond program of the Magyar Nemzeti Bank;• requested a proposal to change the name regarding the accuracy of personal data;• Concerned the discrepancy with the actual data, noted that earlierone of the purposes of the email sent was precisely to the Applicantshave the opportunity to comment on the valuation and the information sent by themdata and results for correction - if professionally justified andacceptable - taken into account in making estimates; the Requestedfurther noted that their professional opinion formed an approximationestimates for the publicly available fiscal year ended December 31, 2018at the same time informed the Applicants thatif there is a business decision, any other circumstances that make the assessmentaffected, the Applicant shall consider or agree to take this into accountwith the Applicants;• to inform and inform the public for the purpose of drawing up and publishing the list; andmarked the exercise of the right to freedom of the press; the position of the Candidateaccording to the presentation of whether the recipient of state mandates or stateor other public subsidies (and their owners)how the Hungarian entrepreneurial layer uses these resources
Page 44
44relevant information for taxpayers and, on the other hand, important for taxpayers,information of public interest;• indicated the categories of personal data (names of owners) and the personal,and the sources of data on the results of […] (available in the company databasedata and reports downloaded from e-beszamolo.im.gov.hu ​​and the […]previous announcements, public announcements); it is not included in the article […]detailing what other assets the family has;• informed that although the Applicant consults external experts,in doing so, typically only industry multipliers are negotiated with them by external expertsspecific estimates are made only in exceptional cases, by personal consultationhowever, the Requested Data will be known during the personal consultationit does not provide, but only the company name, the balance sheet data used for the estimates, the multiplierand the final result of the estimation is shared with them, but neither […] nor[…] In the case of other family interests did not take place;• marked the person involved in compiling the list and thus the data managerstaff;• in connection with the duration of the data processing, provided information that athe data needed for estimation are used to compile the list and then the substancedeleted after completion.Articles 13-14 of the General Data Protection Regulation. Articles contain that the controlleras a minimum, which data processing conditions should be communicated to data subjects, depending on whethercollects personal data from data subjects or has not obtained it from data subjects. Given thatthat the Applicant did not use the data used to compile the lists directly from the Applicantscollected, but also in various public databases, reports and […] publicused the information contained in its communications, the Applicant's preliminaryArticle 14 of the General Data Protection Regulationcontained shall apply. Consequently, Article 13 of the General Data Protection Regulation , whichcontains the minimum information that the controller must inform the data subject if thecollects personal data from data subjects - in this case it is not relevant and thereforeNor can the alleged infringement be established.The publications examined during the procedure (Data Management 1 and Data Management 2) can be said to be becausethey are periodically published on the one hand, and the methodology applied by the Applicant on the otheryou can determine exactly who you want to include in the current list,publication - that is, it practically implements profiling - the Requested general data protectionobligation under this Regulation to provide prior information for this limited number of staffprovide information covering Article 14 (1) to (2) of the General Data Protection Regulationwith particular attention to them- the purpose and legal basis of the processing,- the categories of personal data concerned,- data processing based on Article 6 (1) (f) of the General Data Protection Regulationthe legitimate interests of the controller or of a third party,- the data subject's rights (rectification, erasure, restriction of data processing, protest),- the data subject's right to complain,- the source of the personal data and that the data are from publicly available sourcesdo they come from- the importance of profiling and for stakeholdersmay have consequences.Although it can be stated that before the lists appear, the Applicant (through his journalists) alwayscontacted the Applicants and informed them that the Applicant intended to be includedthem on that list and sent them a brief description of the methodology used andan excel spreadsheet containing a value or asset estimate based on a methodology, and
Page 45
45provided the Applicants with comments and, if necessary, commentsto clarify the data, the Applicant did not properly comply with the prior informationas it did not provide information on the purpose and legal basis of the data processing, thethe legitimate interest of the controller or third party and the outcome of the balance of interests, profilingthe expected consequences, all the rights of the Applicants concerned and the Applicantsthe right to complain.As the Applicant did not provide adequate prior information to the Applicants, the Authorityfinds that the Applicant has infringed Article 14 of the General Data Protection Regulation.According to recital 60 of the General Data Protection Regulation, transparent and athe principle of fair data management requires that the data subject be informed of the data processingand information that is fair and transparentnecessary to ensure the processing of personal data, taking into account the specific nature of the processing of personal datacircumstances and context.The legal predecessor of the European Data Protection Board (hereinafter "the Board"), Article 29 of Directive 95/46 / ECadopted by the Data Protection Working Party established by the General Data Protection RegulationWP260 on Transparency, which facilitates the application and interpretation ofmaintained by the EDPS after the entry into force of the General Data Protection Regulation- available to data subjects in accordance with Articles 13 and 14 of the General Data Protection Regulationas set out in the Annex on the information to be providedinformation should make it clear that they may receive information on request at their discretioninvestigation. This is essential for effective transparency when involvedthey have doubts as to whether the discretionary test was fair or ifthey wish to lodge a complaint with the supervisory authority. "As the Applicant did not properly comply with this requirement, the Authority concludes that:the Applicant has infringed Article 5 (1) (a) of the General Data Protection Regulationthe principle of transparency with regard to Data Management 1 and Data Management 2.Articles 13-14 of the General Data Protection Regulation. prior information pursuant to Article 15the information provided at the request of the data subject shall be distinguished. While 13-14. in accordance with Articleinformation is intended to provide the data subject with a general, comprehensive picture of his or her personal datauntil then, the purpose of the right of access under Article 15 is specifically toreceive information on the lawfulness of the processing of your personal datain order to establish and controlIn exercising the right of access, the controller shall be required to comply with Article 15 (1) of the General Data Protection Regulation.shall provide the data subject with the information referred to in The Applicantsin its replies to its requests for the exercise of its right of accessthe purpose of the data processing, the categories of personal data and the source of the data and the listsstaff involved in the preparation of the report, and provided information on how to make the estimaterequired data will be deleted after the list is completed. Data management 2in addition, the Applicant indicated the legal basis for the processing [Article 6 of the General Data Protection RegulationParagraph 1 (f)]. It can be determined that the Applicant has access to the Applicantsits replies to its requests for the exercise of its rights do not fully comply with theArticle 15 (1) of the General Data Protection Regulation, as in his replies theon the expected consequences of profiling, on the rights of all stakeholders of the Applicants aIt did not provide information on the applicants' right to complain.As the Applicant's request to exercise the Applicants' right of accessdid not provide adequate information to the Applicants in this context, the Authorityfinds that the Applicant has infringed Article 15 of the General Data Protection Regulation.
Page 46
46If the processing is in the public interest or in the legitimate interest of the controller or a third partydata subjects may object under Article 21 of the General Data Protection Regulationagainst the processing of their personal data. In this case, the data controller does not provide personal dataunless the controller proves that the processing is so compellingjustified by legitimate reasons which take precedence over the interests, rights and interests of the data subjectfreedoms or which are for the purpose of bringing, exercising or enforcing legal claimsrelated to the protection ofAccording to Article 21 (4) of the General Data Protection Regulation, the controller is obliged to the data subjectsdraw their attention explicitly to their right to protest at the latest at the latestcontact and information on this clearly and everything elseshould be displayed separately from the information.Given that the first arising in relation to the Requested Data Management 1 and Data Management 2did not draw the attention of the Applicants to the protest to which they were entitledand did not present the relevant information clearly and everything elseseparate from the information, the Applicant did not comply with Article 21 of the General Data Protection Regulation(4).This is significant because, under Article 21 (1) of the General Data Protection Regulation, aAn applicant may at any time object to the processing of his personal data in accordance with Article 6 (1) of the General Data Protection Regulation.based on points (e) and (f) of paragraph 1, which, however, is only appropriatecan live in the knowledge of information. In this case, the result of the protest is not automatic, butdepends on the process of weighing up the interests, the controller shall, upon request, prove thatother coercive force arising on his side against the rights and freedoms of the data subjectinterests take precedence.If the data subject objects to the data processing - for example, a newspaper article containing his personal datapersonal data may not be further processed by the controller, unlessif the controller proves that the processing is justified by compelling legitimate reasonswhich take precedence over the interests, rights and freedoms of the data subject. On thisconsideration of the interests and rights of the data subject exercising his or her right to objecton a case-by-case basis.From the correspondence between the Applicants and the Applicant, it can be stated that although the ApplicantsThe right to protest was also exercised with regard to Data Management 1 and Data Management 2, the specific reasons for this(namely information on the security situation of the Applicants and their families)For the exercise of the rights of the data subjects dated 30 August 2019 and 15 November 2019, respectivelythey were not indicated in their applications either, instead they referred to the Civil Code in general. and Mvtv.and that, in their view, the Applicants cannot be consideredto public actors. The position presented to the Applicants Authority that the September 2019The Forbes list drew the attention of criminal circles to the family, so it is unknown to the Applicantwas, so the Applicant was not - could not - be in possession of the information whichcould have carried out an individual balance of interests for the Applicants.The Authority notes in this regard that although the investigation is in business for a long timeApplicants and their families who are active and put their company in a market-leading position are the publicationswould have come within the scope of criminal circles as a result of its appearance, does not belong to the Authorityhowever, the Authority shares the position of thethat it was not substantiated that the actions of the criminals were (solely) the publication of the publicationwould be a consequence.In view of the above, the Authority concludes that the Applicant has not committed any infringement,when it did not carry out an individual balance of interests following the Applicants' protest. Nevertheless, thecircumstance raised by the Applicants (but not communicated to the Applicant) in connection with the protest
Page 47
47the data subject may be relevant for the subsequent data processing of the Applicant"Reason relating to one's own situation" and any "compelling legitimate reason"in connection with its consideration. However, to the Applicant after the protest is second, uniquebalance of interests can be properly performed, it is expected and necessary that the Applicants are adequateexplain in detail why, for what reason they object to the processing.It should be emphasized that these data are only an application for the exercise of the right to protestmay be handled and used for the purpose of assessing individual interests.The Applicant's replies to the Applicants' requests for the exercise of the rights concernedcontain data relating to the data processing objected to by the Applicantsin which it refers, inter alia, to the public interest nature of the data processing and to […]subsidies from public or other public funds.However, in its replies to the Applicants, the Applicant did not specifically address theApplicants seek to exercise their right to protest and to restrict data processingnor did it provide information on the decision taken in relation to themit did not address the remedies available to the Applicants, i.e. to make a complaintthey may do so before the Authority or have recourse to the courts. For the exercise of the rights of the data subjectunder the General Data Protection Regulationmandatory information element is information on enforcement options. The circumstance thatthe Applicants approached the Applicant through a legal representative and that ForbesThe general data management information available on the website contains the methods of enforcement, noexempts the Applicant from providing the necessary information. Based on all this, the AuthorityFinds that the Applicant has infringed Article 12 (1) and (4) of the General Data Protection Regulationparagraph.Under the General Data Protection Regulation, data subjects have the right to be deleted (forgotten)However, the general data protection regulation also provides for exceptionsfor which this right cannot be exercised. This includes cases where it isdata management the exercise of the right to freedom of expression and informationnecessary for this purpose [17. Article 3 (3) (a)] or where the public interest so requiresthe need for data management [17. Article 3 (3) (b) to (d)] or where the processing takes placenecessary for the submission, enforcement and defense of legal claims [Article 17 Article 3paragraph (e)].Data related to the Applicants or the company in the interest of the ApplicantsTreatment by the applicant (including publication) is one of the exceptions which:the right of erasure (and the erasure of personal data) cannot be exercisedArticle 17 (3) (a) of the General Data Protection Regulationhaving regard to the fact that the processing of these data is subject to freedom of expressionand necessary to ensure the right to information.In the present case, therefore, Article 17 (3) (a) of the General Data Protection Regulation createsbalance between the right of erasure and freedom of expression and the right to informationensuring freedom of the press, as well as listing onlineversion, also the freedom of the Internet.In view of the above, the part of the Applicants' application in which the Applicants request that theAuthority may order the restriction of data processing, the deletion of the personal data of the Applicants, and theThe Authority shall refuse to refuse the requested processing.
Page 48
48III.5. Request for suspension of the requested procedureIn its statement issued at the invitation of the Authority, the Applicant Section 48 (1) (a)(referring to a preliminary ruling within the jurisdiction of the court) requested that the proceedings be stayedAuthority, given that there is a personal relationship between the Applicants and the Applicantthe processing of your data is subject to legal proceedings, in which case the court will make a decisionwhether the data processing carried out by the Applicant is lawful.The Authority waived the requested procedure due to the following:- In order to examine and decide on the lawfulness of data processing, the Infotv. Section 38 (2) - (2a)provide the Authority with explicit tasks and powers, the courtprocedure is not a preliminary issue that would be absolutely necessary to resolvefor an objective, fair decision of the Authority, and without which the decision of the Authoritywould be unfounded.- The Acre. makes it clear that in general - merely the Acre. according to its rules - there is no placesuspension on the grounds that the Authority is aware of anotherpending proceedings which may affect its proceedings, unless otherwise provided by lawprovision does not allow for suspension. The question referred is not the same asthat the decision of another body may “affect” the legal interpretation of the Authority.- Available under Article 79 (1) of the General Data Protection Regulationadministrative or non-judicial remedies, including with the supervisory authoritywithout prejudice to the right to complain under Article 77 , all parties concerned shall be effectiveshall be entitled to a judicial remedy if, in his opinion, his personal data are covered by this Regulationtheir rights under this Regulation have been infringed as a result of improper handling.- The Authority may not be a party to any proceedings suspending the proceedingsat the request of a client, but makes an ex officio decision.III.6. The applicants' application for interim measures and for the imposition of a fineThe Applicants' application for an interim measure was submitted by the Authority to the Ákr. Pursuant to Section 46 b)rejects it, given that it is a civil lawsuit running in parallel with the data protection authority proceedingsIn the proceedings, the Applicants' application for the same right had already been examined by [ír].The Authority rejects the Applicants' request for a data protection fine, as ethe application of a legal sanction does not directly affect the rights or legitimate interests of the Applicants,for them, such a decision of the Authority does not create a right or an obligation, and therefore does notAs regards the application of a sanction falling within the scope of the public interest,with regard to the imposition of fines, the Applicants do not qualify as customers in accordance with Ákr. Section 10 (1)pursuant to paragraph Furthermore, since the Acre. Does not comply with Section 35 (1) in this regardthere is no place to file an application, so this part of the petition cannot be interpreted as an application.III.7. Data management before May 25, 2018The Applicants also objected to the lawfulness of the data processing for the period before Data Management 1.During the procedure, it was established that in the period before Data Management 1, the Applicant onlyOn one occasion, in the August 2015 issue of Forbes, it included “[…]family ”in the“ Largest Hungarian Family Enterprises ”compilation.This part of the request therefore concerns data processing for which, before 25 May 2018,took place before the date of application of the General Data Protection Regulation, to which thethe rules of this Regulation shall not apply. In view of this, Ákr. Section 47 (1) (a)the Authority will terminate the procedure as this part of the application does not comply with Infotv. 60.§ (2), as the general data processing period is general
Page 49
49data protection regulation was not yet applicable. For this reason, in terms of privacyno application for an administrative procedure may be made or an examination of the Authority 's own motion; andnor does it initiate official proceedings.The circumstance is that the Applicant is also in the period from August 2015 to September 2019collected data on the company in the interest of the Applicantsfrom publicly available databases accessible to anyone or from […] 's own public communications, andshall not be considered as unlawful data processing.III.8. Legal consequencesThe Authority granted the Applicants' request in part and Article 58 of the General Data Protection RegulationCondemns the Applicant under paragraph 2 (b) because Data Management 1 andHis activity in relation to Data Management 2 violated Article 5 of the General Data Protection RegulationArticle 5 (1) (a), Article 5 (2), Article 6 (1) (f), Article 12 (1) and (4)Article 14, Article 15 and Article 21 (4).Pursuant to Article 58 (2) (c) of the General Data Protection Regulation, the Authority shall instruct:Within 15 days of the decision becoming final (ex post)fully comply with its obligation to provide information to Applicants, includingthe considerations taken into account in the balance of interests and the outcome of the balance of interestsinformation.The Authority also instructs pursuant to Article 58 (2) (d) of the General Data Protection Regulationto shape the Applicant in accordance with the applicable legislation and the provisions of this decisiontransfer prior information practices as well as whether in the futurein the course of data processing, he intends to use the legitimate interest as a legal basis, then the lawcarry out a balance of interests in accordance with the provisions of this Decision,including a second, individual consideration of interests following the protest.The Authority's request to impose a data protection fine on the Applicants is set out in Section III.6. pointhowever, it examined of its own motion whether the infringements found had been establishedwhether it is justified to impose a data protection fine on the Applicant. In this context, the Authority isArticle 83 (2) of the General Data Protection Regulation and Infotv. 75 / A. § - the followingconsidered all the relevant circumstances of the case of its own motion and found that the present caseIn the case of infringements detected during the procedure, the warning is not in itself proportionate and dissuasivetherefore a fine is justified.By imposing a fine, the Authority’s specific deterrent objective is to encourage the Applicant toto carry out his / her data management activities consciously and not to the data subjects as objects and / ortreat it as an obstacle but as a genuine right holder, ensuring that their rights arising therefrom,information necessary to exercise control over the processing of their personal data, otherconditions. And it is usually required for all data controllers in a similar situationto make it clear that the processing of personal data requires increased awareness cannot benegligently trust that the data subjects will not be disadvantaged by personal dataactually uncontrolled treatment. Such conduct disregards the rights of those concernedleave and, as such, cannot go unpunished.The Authority considers that the practice, which is also present on the Hungarian market, according to which thevarious rich lists, publications listing the richest Hungarians, if enoughthey do not always include the name of the data subject and / or the data subjectbut in them, for example as a result of a well-founded protest by the data subject.instead of the full name, only one letter, and instead of an article describing the activity of the person concernedminimum information (eg name of the sector, amount of assets associated with the data subject)
Page 50
50will be indicated.By imposing a fine, the Authority also aims to encourage the Applicant to investigatein addition, it lists the richest Hungarians and the largest Hungarian family businessesdata management practices related to its publications. The Authority shall determine the amount of the finein addition to the specific preventive purpose, the fine sought to be achieved was taken into accountalso for general preventive purposes, with which, in addition to deterring the Applicant fromHe wants his requested data management practice to move towards full legalityto reach.In determining the need to impose a fine, the Authority considered the infringementsaggravating and mitigating circumstances as follows:The Authority considered as an aggravating circumstance that:- violations related to the exercise of the fundamental and affected rights committed by the Applicantpursuant to Article 83 (5) (a) and (b) of the General Data Protection Regulationmaximum amount (up to EUR 20 000 000 or, in the case of undertakings, the previous amount)up to 4% of the total annual world market turnover for the financial yearconstitute an infringement;the Applicants have tried several times to achieve proper data management than the Applicant, butfinally, official involvement was required [Article 83 (2) of the General Data Protection Regulationparagraph (a)];- the violations found, taking into account all the circumstances of the case, the Applicantconscious and determined attitude to data management and the exercise of data subjects' rightssubstantiated [i.e., Article 83 of the General Data Protection Regulation].Article 2 (2) (b)];- data management activities related to publications Indicated by ApplicantsDespite its shortcomings, a business transaction took place (published in December 2019)publication containing the richest Hungarians) and by the Applicants - in their opinionThe mitigation of the damage suffered took place only as a result of [általános] [general data protectionArticle 83 (2) (c) of the Regulation];- transparent to the Applicant on the lawfulness of the data processing and on the data processingfor information on Forbes worldwide recognition and recognition, as well as in the media markethas a special responsibility due to its role [Article 83 of the General Data Protection Regulation.Article 2 (2) (d)].The Authority took into account the special nature of personal data as a mitigating circumstancedata belonging to this category was not processed by the Applicant. The Applicantspersonal data entered in the company register is public data in the public interest as well as at the same timecompany data, and the data indicated in connection with the valuation of assets or values ​​aexercise of the right to freedom of expression, based on a defined methodology for the datashall be considered as a conclusion drawn from the evaluation of the data protection [Article 83 of the General Data Protection RegulationParagraph 2 (g)].The Authority also noted that the Applicant had cooperated in the proceedingsAuthority, however, this behavior - as compliance with legal obligations did not gonot specifically assessed as an attenuating circumstance [Article 83 (2) of the General Data Protection Regulationparagraph (f)].The Authority further noted that although it had not previously established against the Applicantbreach of the processing of personal data against the ApplicantNAIH / 2019/7972 at the same time as this decisionNAIH / 2020/838/2, in part, the infringements found in this decisionalso condemned and instructed the Applicant to take similar measures,
Page 51
51and imposed a fine on him [Article 83 (2) (e) of the General Data Protection Regulationand (i)].Article 83 (2) of the General Data Protection Regulation applies to the imposition of fines.reviewed the other aspects of paragraph 1, but did not take them into account becauseconsidered that they were not relevant in the present case.Report of the Applicant for the general business year from 1 January 2019 to 31 December 2019was not yet available at the time of this decision and the Authority therefore set the finetook into account the business years 2018 and 2017:- Closing the General Business Year for the Applicant from 1 January 2018 to 31 December 2018,based on its publicly available report in 2018 of total salesHad net sales of HUF 727,702,000 (HUF seven hundred and twenty-seven million seven hundred and two thousand), andtaking into account both revenues and expenditures - HUF 115,194,000 (one hundred and fifteen millionone hundred and ninety-four thousand forints) with pre-tax profit.- Closing the general business year for the Applicant from 1 January 2017 to 31 December 2017based on its publicly available report in 2017 of total salesHad net sales of HUF 681,029,000 (six hundred and eighty-one million twenty-nine thousand forints), andthe year - taking into account both revenues and expenses - HUF 156,095,000(one hundred and fifty-six million to ninety-five thousand forints) with pre-tax profit.The amount of the fine is neither the net sales revenue nor the pre-tax profitless than 4% of total world market turnover. Based on the above, the amount of the fine imposedproportionate to the gravity of the infringement.ARC. Rules of procedureThe competence of the Authority is limited by the Infotv. Section 38 (2) and (2a) defines the jurisdiction of the countrycovers its entire territory.The Acre. Pursuant to Section 37 (2), the procedure is the submission of the application to the acting authoritystarts the day after your arrival. The Acre. Pursuant to Section 50 (1), unless otherwise provided by lawthe administrative period shall begin on the day on which the proceedings are instituted.The Acre. Pursuant to Section 112 (1), Section 114 (1) and Section 116 (1), respectively aThere is an administrative remedy against the decision.The operative part II. The right of independent appeal against the order contained in Art. § 112, § 114(1) and Section 116 (1) and Section 116 (4) (d).* * *A Ptk. 6:48. § (1), in the case of a debt owed, the debtor is in arrearsvalid on the first day of the calendar half-year affected by the delayshall pay default interest at the same rate as the basic interest.The rules of administrative litigation are laid down in Act I of 2017 on the Procedure of Administrative Litigation (ahereinafter: Kp.). A Kp. Pursuant to Section 12 (1) by a decision of the AuthorityThe administrative lawsuit against the court falls within the jurisdiction of the court. Section 13 (3) a)The General Court has exclusive jurisdiction under subparagraph (aa) of A Kp. Section 27 (1)(b), legal representation is mandatory in litigation within the jurisdiction of the tribunal. A Kp. § 39Pursuant to paragraph 6, the application of the application has suspensory effect on the entry into force of the Decisionno.
Page 52
52A Kp. Section 29 (1) and with this regard Pp. Applicable pursuant to Section 604, electronicCCXXII of 2015 on the general rules of administration and trust services. Act (ahereinafter: E-Administration Act) pursuant to Section 9 (1) (b), the legal representative of the clientobliged to communicate electronically.The time and place of filing an action against the decision of the Authority shall be determined by the Public Procurement Act. Section 39 (1)defined in paragraph Information on the possibility to request a hearing can be found in Kp.It is based on Section 77 (1) - (2). The amount of the fee for an administrative lawsuit shall be determined in accordance with the 1990 Fees Act.évi XCIII. Act (hereinafter: Itv.) 45 / A. § (1). The fee is preliminaryfrom the payment of the Itv. Section 59 (1) and Section 62 (1) (h) exempt the proceedingsinitiating party.The Acre. Pursuant to Section 135 (1) (a), the debtor is entitled to the statutory interest ratehe is obliged to pay a late payment allowance if he fails to meet his payment obligation on time.If the Applicant does not duly prove the fulfillment of the required obligation, the Authority shallconsiders that it has not fulfilled its obligation within the prescribed period. The Acre. According to Section 132, if the Applicanthas not complied with the obligation contained in the final decision of the authority, it is enforceable. The Authoritydecision of the Ákr. Pursuant to Section 82 (1), it becomes final upon notification. The Acre. Section 133implementation, unless otherwise provided by law or government decree, the decisionordered by the issuing authority. The Acre. Section 134 of the Enforcement - if law, government decreeor in the case of a municipal authority, a local government decree does not provide otherwise - thecarried out by a state tax authority. Infotv. Pursuant to Section 61 (7) in the decision of the Authorityto perform a specific act, conduct or tolerate a specific actenforcement of the decision in respect of the standstill obligationimplements.Budapest, July 23, 2020Dr. Attila PéterfalviPresidentc. professor