NAIH (Hungary) - NAIH-4447-6/2021
From GDPRhub
| NAIH (Hungary) - NAIH-4447-6/2021 | |
|---|---|
 | |
| Authority: | NAIH (Hungary) |
| Jurisdiction: | Hungary |
| Relevant Law: | Article 5(1)(c) GDPR Article 6(1) GDPR Article 12 GDPR Article 17(1)(d) GDPR |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | 12.08.2021 |
| Published: | 22.09.2021 |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | NAIH-4447-6/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Hungarian |
| Original Source: | NAIH website (in HU) |
| Initial Contributor: | Tapir |
The Hungarian DPA held that a data subject was entitled to have their personal data deleted from recordings and transcripts of an open hearing at a Budapest district assembly. In particular, it considered the disclosure of their name and address during those meetings to be in breach of the principle of data minimisation.
English Summary
Facts
A data subject made a request for deletion with the mayoral office of a district in Budapest under Article 17(1)(d) of the GDPR. Previously, the data subject registered to ask a question from the elected representatives during an open hearing of the district assembly, but claimed not to be aware that this would lead to the public disclosure of their name and address.
They argued that disclosing this data during an open (online) hearing of the mayoral assembly, as well as including it in the publicly available meeting recording and transcript, without his explicit consent, was unlawful. The mayoral office refused the request for deletion, arguing that the processing was necessary for the performance of a task carried out in the public interest under Article 6(1)(e) GDPR.
Holding
The Hungarian DPA held that the processing of the data subject's data for the purpose of registering his request to ask a question during the assembly was lawful under Article 6(1)(e).
However, it also held that the disclosure of the data subject's name and address during the meeting, and subsequently in its recording and transcript, was a separate and unnecessary act of processing. As such, it would have required consent under Article 6(1) and was in breach of the principle of data minimisation under Article 5(1)(c).
Finally, the DPA held that the mayoral office has not fulfilled the requirement for providing transparent information under Article 12 GDPR.
However, NAIH held that issuing a reprimand under Article 58(2) was sufficient, without the need for imposing a penalty under Article 83(2).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.
Registration number: NAIH-4447-6 / 2021. Subject: Grant of application
Administrator: […] decision
Before the National Data Protection and Freedom of Information Authority (hereinafter: the Authority)
[…] To the applicant ([…] hereinafter: the Applicant) […] Budapest […] district
Personal to the Mayor's Office (address: […] hereinafter: Applicant)
on 26 April 2021 concerning the unlawful handling and disclosure of personal data
hereinafter referred to as "the Application") in the data protection authority proceedings
decision.
The Authority shall grant the request and
Finds that the Applicant
- Article 6 (1) and Article 5 (1) of the General Data Protection Regulation
has committed an infringement of paragraph 1 (c) by using the online
during a public hearing and on a video of it
and disclosed in the minutes the personal data of the Applicant (name,
address);
- the Applicant is lawful, Article 17 (1) (d) of the General Data Protection Regulation
rejected his request for cancellation based on
- processing of the Applicant's personal data prior to the public hearing
Article 12 of the General Data Protection Regulation
the requirement to provide transparent information.
Obliges the Applicant to fill in the Applicant 's personal identification data (name
and address) can be seen and heard on the video, and
can be found in the minutes of the public hearing
with regard to your personal data as follows:
- […]
- […]
- […]
- […]
The fulfillment of the obligations of the Data Controller according to point 2 from the taking of the measure
in writing within 15 days of receipt of the supporting evidence
together - to the Authority.
In the event of non-compliance with the obligation under point 2, the Authority shall order the decision
implementation.
There is no administrative remedy against this decision, but it is from notification
within 30 days of the application to the Metropolitan Court
can be challenged in a lawsuit. The application shall be submitted to the Authority electronically, which shall:
it forwards it to the court together with the case file. The request for a hearing shall be made to
must be indicated in the application. For those who do not benefit from full personal exemption
…………………………………………………………………………………………………………………………………… ……………. …………………
1055 Budapest Tel .: +36 1 391-1400 ugyfelszolgalat@naih.hu
Falk Miksa utca 9-11. Fax: +36 1 391-1410 www.naih.hu 2
the fee for the court review procedure is HUF 30,000, the lawsuit is subject to the right to record the material fee. THE
Legal proceedings are mandatory in proceedings before the Metropolitan Court.
EXPLANATORY STATEMENT
I. Facts
The Applicant received a letter dated 22 April 2021 and received it by post on 26 April 2021.
In its application, the
Applicant requested that the Authority condemn the Applicant for unlawful data processing
and order the processing of the data in accordance with your request:
“I ask the T. Authority to
(a) initiate the official procedure on the basis of my application by the data controller […] district
Against the Mayor's Office,
b) the data controller deletes my personal data in accordance with the provisions of Annex 2.
The following is a list of my disclosed personal information:
ba) […]
• […]
• […]
• […]
bb) Minutes of the public hearing: […]
I ask that the data management Office do the content available on the indicated links
anonymisation and an online public hearing on 12 November 2020
the information in point […] of the minutes (name and address on page […]) accordingly
delete them or, if this is not possible, remove them from the Internet.
c) My request covers the stored version of the documents as well as the indexing (the Internet
search engine name does not throw a hit).
d) I request the T. Authority, if it is official on the basis of the contents of this application
proceedings are conducted, the decision on the outcome of the proceedings shall be held in a public place
(eg on a website) do not publish; its contents are different, with the exception of the data controller
I do not consent to the knowledge of the
In its submission, the applicant informed the Authority of the following:.
on November 12, he held an online public hearing with “Facebook live,” which was broadcast live by anyone
could follow. Prior to the public hearing, the Applicant shall be contacted by the Applicant's clerk by telephone
contacted him and asked him to send them an e-mail in text format a
the problem to be presented at the public hearing, detailing it. To this Applicant
electronically on November 10, 2020: recommended the deployment of a surveillance camera
on the corner of [….] street, among the reasons of which he listed that on the one hand several crimes
occurred in the area where [….] also operates, and on the other hand at the […] street corner […]
"Phenomenon" (behavior of "consumers" grouped in front of it) is also justified by the
holds the location of the space surveillance chamber.
According to the Applicant's faithful statement: “[The] Office clerk did not call
informed me that anything in connection with the public hearing as a public interest announcement
I will describe it in its entirety in public at the online public hearing
nor has I been informed of the handling of my personal data
my personal data in your submission is also word for word to the public 3
are scanned and displayed on the screen. Personal in my submission
I did not consent to the processing of my data. "
Applicant further submitted that the public hearing is not exclusively online in real time
happened, but there was also a recording of it all, which is still available to anyone on Facebook right now
available, and the minutes of the public hearing are also public, Requested
can be found on its website for anyone.
Text submitted by the Applicant electronically for the referred public hearing
the public interest notice in its entirety, marked with its name and address for reading
was in addition, his name was constantly visible on the screen, and all about the public hearing
also contained in the Protocol. Applicant also finds it offensive that he is alive
and the protocol is already available on the Internet
(i.e. that the complained events take place at the corner of […] and that […]
consume alcohol, etc.) using Google Street View for anyone
his name and address details become clearly identifiable.
In the course of his work, the Applicant's attention was drawn to the fact that it was
by searching your name in a web browser, it becomes fully known
The minutes of the public hearing shall include the name, address,
problem of public interest (notification and proposal in the public interest). Therefore, Applicant January 13, 2021-
contacted the Office electronically on 1 January 2006 and requested that the Office be canceled without delay
illegally disclosed personal data. The Office is electronic within a week
he replied in a way in which his request was rejected. They set out their position in their explanatory memorandum, which
10/2015 on the Organizational and Operational Rules of the Board of Representatives. (IV. 22.)
the rules of a municipal decree (hereinafter: SZMSz) apply to your case: “[…]
summed up at the public hearing, which is a public meeting of the Board of Representatives, is there
published, pre-registered voters personally tell the
comments of public interest. Minutes of the meeting shall be drawn up in accordance with Mötv.
must be made public in accordance with that provision. […] To the question of publicity
also includes the provision of Section 13 (2) of the SZMSZ, according to which “A
audio, film and video recordings of the public meeting of the Board of Representatives may be made. " That way you
cannot be considered a public interest notifier as it has applied for a public event, the
The legislation cited in the letter is not applicable to the present case, as it is contested
by removing the contents of the Mötv. The constitutional principle contained in Section 2 (2)
"Local government in local public affairs in a democratic way,
it expresses and implements the local public will by creating a wide public. […] ”
Before the Authority, at the request of the Applicant, on the right to information self - determination and
CXII of 2011 on freedom of information. Section 60 (1) of the Information Act (hereinafter: the Information Act)
NAIH-4447/2021. data protection authority proceedings were initiated on the case number.
The Authority has issued NAIH-4447-2 / 2021. No. In its order issued on 17 May 2021 a
He formulated questions for the applicant, for which he made a statement
called.
1) “For what purpose and on what legal basis was it handled and disclosed by the Applicant
personal data (name, place of residence with street sign) of the […] district Municipality
Its Board of Representatives was held online on 12 November 2020
at a public hearing
in the minutes? The purpose of the processing of personal data and the data management
the existence of an appropriate legal basis with a precise legal reference, where appropriate
prove it with a suitable document!
2) Applicant for the processing of personal data of natural persons
the free movement of such data and Directive 95/46 / EC
Regulation (EU) 2016/679 repealing Regulation (EU) No 2016/679 (hereinafter referred to as
data protection regulation) in the exercise of data subjects ’rights under Article 15
deleting your personal information from the published video in any form, or
from the minutes of the public hearing, also made public? If yes,
please be informed of your response.
3) Have they taken, and if so, what measures has been taken by the Applicant's exercise of the rights concerned
in order to If not, please explain the reasons for not taking action.
4) All submissions made for the public hearing in public
will be negotiated or examined in advance of any aspect,
do they value them? If so, which aspect do you discuss submissions in public?
meeting of the board, and which ones are answered in accordance with other procedures?
5) Which submissions are used for complaints and public interest announcements
CIXV of 2013 provisions of the law?
6) Present the personal details of the speakers in connection with the public hearing
management practices! In this connection, send to the Authority:
your current privacy policy and, if you have one, online
public hearing data management information.
7) What is the purpose of citizen submissions submitted to the public hearing with a serial number
? ”
The Applicant is NAIH-4447-2 / 2021. making a declaration in accordance with the order issued on
in its reply of 27 May 2021 to the case
by attaching documents.
After the Applicant did not fully respond to the Authority's request, the facts
Therefore, the Authority addressed issues NAIH-4447-4 / 2021. No. June 2021
In its order of 3 March 2006, it again called on the Applicant to answer the questions,
which the Applicant complied on 14 June 2021. In his reply, he gave the following answers.
„[…] Answer 1: Act CLXXXIX of 2011 on local governments of Hungary. Act (a
hereinafter: Mötv.) “The Board of Representatives shall act at least once a year in advance
holds a announced public hearing in which the local population and the local interest
representatives of non-governmental organizations may make questions and suggestions concerning local public affairs. "
The Mötv. According to the Commentary on this section: “At the public hearing - unlike the
with a meeting of a public representative body - not only to stay there, but also to
The local resident also has the individual right to comment, ask questions and make suggestions
representatives of local interest organizations. "
The Mötv. - also in relation to the explanatory memorandum to that section: 'The legal institution pursues that objective
serves to enable the electorate to speak directly at this open board meeting
questions to the panel, make suggestions. "
In the pre-emergency period at public board meetings, so the annual
Photographs were also taken at public hearings, which are available on the municipality's website
and a public hearing published in a local newspaper issued by the municipality
published as a summary illustration. The issue of publicity also includes […]
10/2015 on the Organizational and Operational Regulations of the Representative Body of its Local Government.
Annex 11 - Complaint submitted by the Applicant by e-mail, containing a statement of opposition and a detailed explanation thereof
starts and is then accompanied by the Applicant's notification to which this complaint relates.
Annex 2 - Signed minutes of the online public hearing on the emergency on 12 November 2020.
the supervisory body did not comment.
Annex 3 - Designed and initiated to address the Local Public Issue raised by the Applicant
Mayor’s response of 20 November 2020 on measures.
Annex 4 - The petition of the Applicant dated 13 January 2021 and the mayor's reply thereto.
Annex 5 - Government Office of the Capital City of Budapest BP / 101 / 001304-3 / 2016. provided in the framework of technical assistance no
resolution on the holding of the public hearing and the minutes of the
rules apply. Budafok-Tétény Budapest XXII. on the Organizational and Operational Regulations of the Local Government of the
10/2015. (IV. 20.) regulates the legal institution of public hearing in § 93. 5
(IV. 22.) of the local government (hereinafter: SZMSZ)
provision that “Audio, film and video recordings of a public meeting of the Board of Representatives
can be made. "
This regulation is in accordance with Mötv. - cited below - shown in § 2
with the requirement of publicity.
In view of the emergency, neither the meeting of the Board of Representatives and thus the public hearing
could be kept in person. The Board of Representatives 23/2019. (XII. 19.) municipal
in its work plan adopted by the Council to hold the 2020 public hearing
in the preparatory phase before a specific date, a resolution (Annex 1) no
was available as to whether or what the public hearing could be held
format, so that the public hearing was conducted online in order to
that the Mötv. Section 2 and Section 3 (1) in full
be realized. „2. § (1) Local self-government is the settlement as well as the county
the right of the community of its constituents, in which the civil right takes effect
sense of responsibility, creative cooperation unfolds within the local community.
(2) Local government in local public affairs in a democratic way is wide-ranging
expresses and implements the local public will by creating publicity.
§ 3. (1) The right of local self-government is the responsibility of settlements (local governments) and counties
(local authorities). ”
To sum up, the public hearing, which is a public meeting of the Board of Representatives,
pre-registered voters who show up there tell the local person in person
their comments on the concept of public affairs. Personal data processed during the public hearing
the lawfulness of the processing is ensured by Article 6 (1) (e) of the GDPR, which states that data processing
in the public interest or in the exercise of a public authority conferred on the controller
necessary to perform the task performed.
As I have explained above and below, Mötv. Fixed in Section 54, annually
a mandatory public hearing to be held at least once for the Board of Representatives
on the other hand, the participation of voters in local government
means the right.
To ensure the smooth running of the public hearing and to ensure that
the municipality fulfills its information obligation properly and thus ensures the
citizens, it is necessary to process certain data of the citizens concerned.
In the case of the Applicant, to indicate his place of residence at street level due to the territorial identification
was necessary, since without it it would not have been possible to give an adequate answer to
to solve a problem in this area.
The disclosure was not for the purpose, but for the public hearing to be there
speakers communicate their names and in order to identify the local public matter they raise
they indicate their narrower living environment and, in some cases, their address.
The public hearing is based on Mötv. mandatory for local governments
a meeting of the House of Representatives, where those present to speak in person, a
later, in connection with his further questions, the minutes will be made public
the legal basis for the adoption of the
[…]
Answer 2: Applicant on 13 January 2021 (approximately two months after the public hearing)
in a request sent to our office by e-mail addressed to the Mayor
pursuant to the Regulation of the European Parliament and of the Council referred to in
deleting your data from the protocol. In his reply of 18 January 2021 (which was the subject of my previous letter 3).
Annex) to the meetings and minutes of the meetings of the Board of Representatives
informed the Applicant that the legislation on public access to
the Mötv. Pursuant to Section 52 (3) “Voters - with the exception of closed sittings - 6
have access to the presentation of the Board and the minutes of its meeting. THE
the possibility of holding a closed meeting to get acquainted with data of public interest and public data of public interest
should also be provided in the case of
In summary, minutes of the meeting will be drawn up, which will be approved by Mötv. provision referred to in
mandatory public within the meaning of From the minutes, subject to the cited Mötv.
available, we are unable to delete the Applicant’s data as it is - an offense
could lead to a legality measure by the supervisory body.
[…]
3. Answer: In preparation for the public hearing, the population was widespread in previous years
In accordance with the Commission 's practice, we were informed of the public hearing by the following means and
ways:
- publication of a call on the website of the municipality
[…]
- publication of a prospectus in the official gazette of the municipality (Annex 2)
- placement of notices in frequented points of the district (Annex 3)
The applicant was informed in advance by e-mail by the clerk of the office
on the traceability of an event in connection with which the Applicant inquired live
opportunities to comment on the broadcast. (Annex 4)
The applicant was affected by the exercise of the right two months after the public hearing
in connection with his request, as explained in the answer to question 2,
that the minutes of the public hearing as a public representative body meeting are public, and a
publication of the minutes is mandatory under the relevant legislation. At the public hearing a
voters and members of the Board of Representatives consult directly on local public affairs,
where those present make their comments in person, taking their names and faces, the public
and you can take a picture, sound and video of the event. From my point of view
the public hearing does not fall into the category of complaints and announcements in the public interest, but
- as I have referred to several times in my present reply - is a public board meeting which I have just
the point is that voters are involved in the management of their common affairs in this particular
through a legal institution.
This and Mötv. provision is the reason for
we did not take action because we could not do so without violating the principle of publicity.
It is the intention of the legislature that the public interest requires local residents to become acquainted with the
minutes of the public board meeting.
Comparing the public and personalized information indicated above, I believe that
it can be stated that the Applicant was aware that he would apply for a public hearing.
[…]
Answer 4: Again, the Art. I can refer to its provision that the year
once at a mandatory public hearing, the local population is local
make questions and suggestions concerning public affairs, to comment, to ask questions,
you have a subjective right to make a proposal. The legal institution serves the purpose of serving the electorate
at this open board meeting to address questions directly to the board, a proposal
do. It follows that no submissions may be made but oral
comments, questions, suggestions. Section 93 (3) of the SZMSZ for the public hearing
“At the same time as requesting the serial number, the
the subject of the speeches. " 7
The purpose of the statement of opposition is to enable the citizen wishing to speak to
we can inform you that at the public hearing - the Mötv. provision cited several times
local public affairs, a personal problem,
an individual case may not be brought before a public hearing. So, to the topic of non-local public affairs
In case of questions belonging to the mayor, the competent office of the Mayor 's Office shall answer, or
in the absence of competence, it shall be forwarded to the competent authority as
it was also brought to the attention of the electorate on the basis of the links indicated above. Nonetheless
Applicant's first submission was not clear, it was stated during the telephone contact
administrator added. (See Annex 1 of my previous letter)
Summarizing the above, it can be concluded that public hearing is like direct democracy
one means, not submissions, but by voters in person, live
discusses issues and proposals concerning local public affairs presented by a public representative body
meeting.
[…]
5. Answer: Act CLXV of 2013 on Complaints and Notices of Public Interest. law
it applies to all submissions that are Section 1 (2) and (3) of this Act
shall be deemed to be a complaint or a notification in the public interest
submitted by the petitioner as such. The Internet and
It is clear from the paper-based prospectuses that the - Mötv. he called several times
In accordance with the provisions of
For this reason, the Petitioner's application does not fall within the scope of the above Act, considering that
the municipality does not call for a complaint and a public interest notification.
[…]
6. Answer: Paragraphs (2) - (3) of Section 93 of the SZMSZ, cited above, provide as follows:
"2. No later than 15 days before the date of the public hearing, the citizens of the district
by publication of a notice - the mayor shall notify. The announcement should be made as follows
publish:
a) on the notice board of the mayor's office,
(b) by publication in the district written and electronic press; and
c) on the website of the municipality.
(3) At the public hearing, the order of speeches shall be given in sequence. The serial number
the subject of the opposition shall be indicated at the same time as the request. The serial numbers are a
can be requested in person, by telephone or from the 15th day before the day of the public hearing
electronically as set out in the notice. By 12 noon on the day of the public hearing
serial number may be requested. "
Residents can therefore request a serial number in person, by phone or by e-mail,
indicating the local public affairs of their post. On the phone and in person
the mayor's office is responsible for preparing the public hearing
will be issued to the applicant immediately by the civil servant, while in the case of comments indicated by e-mail
it shall inform the applicant shortly of the serial number and whether his post is local
whether it is a public matter. Name and contact details of the commenter (address, telephone number, e-mail address)
are included in a database only and exclusively for two reasons which are indicated by the citizen
to solve a problem.
On the one hand, if it is not raised or not fully raised during the public hearing
answer, so that we can send you an appropriate reply within the legal deadline 8
on the action taken in response to its comments, either on its own initiative or
resolved by referral to a competent authority.
On the other hand, if your argument does not fall into the category of local public affairs, then your case is
The competent office of the Mayor's Office can arrange it individually.
As the Mötv. rules of procedure, the public hearing shall normally be established
it is not realized online, but through personal participation, ensuring the voter
and elected representative direct meeting, so online public hearing data management
no prospectus has been prepared.
I find it important to note that overall it is traditional and online
public hearing data management is no different and in my opinion is in line with the current one
our data protection policy, which is available on the website of the municipality at the following link:
[…]
[…]
7. Answer: Pursuant to the provision of the SZMSZ already referred to - Section 93 (3) - the serial number
The sole purpose of the request is to ensure that the order in which the speeches are made at the public hearing (and not the
submissions!) follow the order of application to avoid on-site
any misunderstanding that may arise from the application.
[…]
8. Answer: Due to the epidemic situation, by filling in a form instead of a personal application,
We provided the opportunity to apply with your name, phone number and email
We requested an indication of title in order to comply with the relevant provision of the SZMSZ
which in this case is not the opposition but the problem
indicated to the citizen, on the other hand, the written answer
and to deal with non-local public affairs.
I enclose the form originally submitted by the Applicant, from which it is not clear
neither the nature nor the content of its proposal. (Annex 5)
The administrator contacted the Applicant by telephone in order to clarify the problem (which
it turned out that the indicated case did not fall into the category of local public affairs, cf. previous letter 1.
Annex).
The Applicant also sent his proposal by e-mail, in which he voluntarily provided his address by
that it was not related to the indicated problem. (Appendix 6) Not in this email
provided that he would ask for his name to be withheld, for his data to be kept confidential, although he was acting
the administrator explained in detail by telephone the legal institution of the public hearing
Mötv. and SZMSZ rules.
Subsequently, Applicant re-submitted by e-mail another, now local public case
a proposal belonging to the category (Annex 7) in which he re-entered his address, and
it still did not provide for its closed treatment.
I would also like to inform you that, in view of the epidemic situation, it is personal
application forms replacing the application are the rules for file management
received, filed by the Office, the file in accordance with the general records management rules
stored and filed. " 9
II. Applicable legal provisions
On the protection of individuals with regard to the processing of personal data
and the free movement of such data and repealing Directive 95/46 / EC
Regulation (EU) 2016/679 (hereinafter referred to as the General Data Protection Regulation)
Pursuant to Article 2 (1), the General Data Protection Regulation applies to personal data
for the automated processing of data in whole or in part, and their
processing of personal data in a non-automated manner which is one of the
are part of a registration system or are part of a registration system
they want to do.
According to recital 60 of the General Data Protection Regulation, “Fair and
the principle of transparent data management requires that the data subject be informed of the data processing
fact and purposes. The controller shall also provide any additional information to the data subject
necessary to ensure fair and transparent data management,
taking into account the specific circumstances and context of the processing of personal data. The
the data subject shall also be informed of the fact of profiling and its consequences. If the
personal data are collected from the data subject, the data subject shall also be informed that he or she is obliged to
to communicate personal data and the nature of the non-disclosure
consequences. This information can also be displayed with standardized icons
supplemented so that the data subject is clearly visible about the planned data management, easily
receive general information in a comprehensible and legible form. When the icons
in electronic format, they must be machine-readable. "
According to recital 61 of the General Data Protection Regulation, “To the data subject
information related to the processing of personal data concerning the collection of data
to the data subject at the time of the request or if the data are not from the data subject but from the data subject
collected from other sources within a reasonable time, taking into account the circumstances of the case
made available. If personal data can be lawfully communicated to another recipient, a
the data subject shall be informed at the time of the first communication to the addressee. If the data controller a
personal data for a purpose other than the original purpose for which they were collected, further
prior to the processing of the data subject for this different purpose and all other necessary
you must inform. If the controller is unable to provide information to the data subject
the origin of personal data, as they come from different sources,
general information shall be provided. "
According to recital 65 of the General Data Protection Regulation: “The data subject is entitled
to request the rectification of his personal data and is entitled to it
"Right to be forgotten" if the retention of the data in question infringes this Regulation or
Union or Member State law which extends to the controller. The affected
in particular, shall have the right to have his or her personal data deleted and no longer processed if
collecting or otherwise processing personal data for the original purposes of data processing
context is no longer necessary or if the data subjects have withdrawn the data for processing
their consent or if the processing of their personal data is not otherwise responsible
this Regulation. This right is particularly relevant if it has been granted by the person concerned as a child
when he was not yet fully aware of the risks of data processing,
and later wants to remove the personal data in question, especially from the Internet.
The data subject may exercise this right even if he or she is no longer a child. However, personal
further retention of data shall be considered lawful if the expression of opinion and
exercise of the right to freedom of information is a legal obligation
compliance or the performance of a task in the public interest or entrusted to the controller
exercise of public authority or in the public interest in the field of public health,
for archiving purposes in the public interest, for scientific and historical research purposes or for statistical purposes
or for the purpose of bringing, enforcing or defending legal claims. " 10
According to recital 69 of the General Data Protection Regulation, “Any data subject
should also be granted the right to have information on their individual situation
protest against the processing of personal data if the personal data can be lawfully processed because it
data processing in the public interest or the exercise of a public authority conferred on the data controller
the controller or a third party
based on its interests. The controller shall prove that you are in the interests of the data subject
his overriding legitimate interests against his fundamental rights and freedoms
priority. "
Pursuant to Article 2 (1) of the General Data Protection Regulation, the General Data Protection Regulation
Regulation should apply to personal data in a partially or fully automated manner
non-automated processing of personal data
which are part of a registration system or which
they want to be part of a registration system.
According to Article 4 (1) of the General Data Protection Regulation, "personal data" means identified or
any information relating to an identifiable natural person ("data subject"); identifiable
a natural person who, directly or indirectly, in particular any
ID, such as name, number, location data, online ID, or natural
physical, physiological, genetic, mental, economic, cultural or social identity of a person
identified by one or more relevant factors.
According to Article 4 (2) of the General Data Protection Regulation, "processing" means personal data
performed on data or files in an automated or non-automated manner
an operation or set of operations, such as collecting, recording, organizing, sorting, storing,
modification or alteration, query, insight, use, transmission of communication,
by distribution or otherwise making available, coordination or
linking, restricting, deleting or destroying.
According to Article 4 (7) of the General Data Protection Regulation: "controller" means the natural person
or a legal person, public authority, agency or any other body which:
the purposes and means of the processing of personal data, alone or in association with others
define; if the purposes and means of the processing are determined by Union or Member State law
the controller or the specific aspects of the appointment of the controller
may be determined by Union or Member State law.
According to Article 5 (1) of the General Data Protection Regulation, personal data
1. Personal data shall:
(a) processed lawfully and fairly and in a manner which is transparent to the data subject
(legality, due process and transparency);
(b) collected only for specified, explicit and legitimate purposes and not
be treated in a way incompatible with those objectives; Article 89 (1)
is not considered incompatible with the original purpose
for archiving, scientific and historical research purposes or for statistical purposes
further data processing ("purpose limitation");
(c) be appropriate and relevant to the purposes of the processing; and
they should be limited to what is necessary ("data saving");
(d) be accurate and, where necessary, kept up to date; all reasonable measures
should be done in order to be inaccurate for the purposes of data processing
personal data are deleted or rectified without delay ("accuracy");
(e) be stored in a form which permits identification of the persons concerned only
allows the time necessary to achieve the purposes of the processing of personal data; the
personal data may be stored for a longer period only if
where the processing of personal data in accordance with Article 89 (1) 11
for archiving purposes in the public interest, for scientific and historical research purposes or for statistical purposes
the rights and freedoms of data subjects in this Regulation
appropriate technical and organizational measures to protect
(‘limited storage capacity’);
(f) be handled in such a way as to be technically or organisationally appropriate
measures to ensure that personal data are adequate
unauthorized or unlawful processing of data, accidental loss,
including protection against destruction or damage to
confidentiality ”)
According to Article 5 (2) of the General Data Protection Regulation, the controller is responsible for
shall be able to demonstrate such compliance
(“Accountability”).
Pursuant to Article 6 (1) of the General Data Protection Regulation, personal data only
can be lawfully managed if and to the extent that at least one of the following is met:
(a) the data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes
treatment;
(b) processing is necessary for the performance of a contract to which the data subject is party
at the request of the party concerned or before the conclusion of the contract
necessary to do so;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) the processing is vital for the data subject or for another natural person
necessary to protect its interests;
(e) the processing is in the public interest or a public authority conferred on the controller
necessary for the performance of the task carried out in the exercise of
(f) processing for the legitimate interests of the controller or of a third party
necessary, unless those interests take precedence over such interests
interests or fundamental rights and freedoms which constitute the protection of personal data
especially if the child concerned.
Pursuant to Article 17 (1) of the General Data Protection Regulation, the data subject is entitled to:
at the request of the controller, without undue delay, delete the personal data concerning him
data, and the controller is obliged to provide personal data concerning the data subject
delete it without undue delay if one of the following reasons exists:
the. personal data are no longer required from the steel from which they were collected or
treated differently;
b. Article 6 (1) (a) or Article 9 (2)
the consent on which the processing is based pursuant to paragraph 1 (a), and
there is no other legal basis for data processing;
c. the data subject objects to the processing pursuant to Article 21 (1) and does not
overriding legitimate reason for the processing or the data subject concerned in accordance with Article 21 (2).
protests against data processing pursuant to paragraph
d. personal data have been processed unlawfully;
e. personal data are required by Union or Member State law applicable to the controller
must be deleted in order to fulfill a legal obligation;
f. the collection of personal data referred to in Article 8 (1)
the provision of social services.
Pursuant to Article 17 (2) of the General Data Protection Regulation, if the controller
has disclosed personal data and is required to delete it in accordance with paragraph 1,
taking into account the available technology and the cost of implementation
reasonably foreseeable steps, including technical measures, to:
inform the controllers that the data subject has requested an oral request from them 12
links to rotating personal data or a copy of such personal data, or
delete a duplicate.
Pursuant to Article 17 (3) of the General Data Protection Regulation, paragraphs 1 and 2 do not
applicable if data processing is required:
the. exercising the right to freedom of expression and information
for the purpose of
b. the EU or
fulfillment of an obligation under the law of a Member State or in the public interest or to the controller
performance of a task performed in the exercise of a delegated power of public authority
for the purpose of
c. Article 9 (2) (h) and (i) and Article 9 (3)
on the basis of the public interest in the field of public health;
d. in accordance with Article 89 (1) for archiving purposes in the public interest
and for historical research or statistical purposes, where provided for in paragraph 1
that right would be likely to make it impossible or seriously jeopardize that
data management; obsession
e. to file, enforce or defend legal claims.
Pursuant to Article 77 (1) of the General Data Protection Regulation, other administrative
or without prejudice to judicial remedies, any person concerned shall have the right to lodge a complaint
at a supervisory authority, in particular at the place of residence, employment or
in the Member State of the alleged infringement, if it considers that the person concerned
processing of personal data relating to personal data infringes this Regulation.
2. Act CLXXXIX of 2011 on the local governments of Hungary. Act (a
hereinafter: Mötv.) pursuant to Section 2 (2), local self-government in local public affairs
in a democratic way, creating and implementing a wide public
public will.
Mötv. § 13. (1) Among local public affairs and public tasks that can be provided locally
local government tasks to be performed in particular:
1. settlement development, settlement planning;
2. settlement operation (construction and maintenance of public cemeteries, from public lighting
care, provision of chimney sweep service, local roads and
design and maintenance of its accessories, design and maintenance of public parks and other public spaces
maintenance of motor vehicles);
3. the name of the public areas as well as the public institution owned by the local government;
4. basic health care, services to promote a healthy lifestyle;
5. environmental health (public cleanliness, ensuring the cleanliness of the urban environment,
insect and rodent control);
6. kindergarten care;
7. cultural services, in particular the provision of public library services; movie theater,
support for a performing arts organization, local protection of cultural heritage; the local
support for public cultural activities;
8. child welfare services and benefits;
8a. social services and benefits under municipal support
can be established;
9. housing and premises management;
10. the care and rehabilitation of persons who have become homeless in its territory; and a
ensuring the prevention of homelessness;
11. local environmental and nature protection, water management, water damage prevention;
12. national defense, civil defense, disaster management, local public employment; 13
13. tasks related to local taxation, economic organization and tourism;
14. for small producers, primary producers - their products specified by law -
providing sales opportunities, including weekend sales;
15. sports, youth affairs;
16. nationality issues;
17. contribution to ensuring the public safety of the settlement;
18. providing local public transport;
19. waste management;
20. district heating service;
21. water utility service, if the Water Utility Service Act
according to its provisions, the local government is considered to be responsible for care.
Mötv. § 46. (1) The meeting of the representative body shall be public.
Mötv. § 52. (1) Minutes shall be prepared of the meeting of the representative body, which shall contain:
(a) the location of the board meeting;
(b) the date;
c) the names of the municipal representatives who appeared;
d) the names of the guests, the fact of their appearance;
(e) proposed, adopted and discussed items on the agenda;
(f) the submissions;
(g) the names of those who have contributed to each item on the agenda, the reasons for their participation;
their comments and the substance of what was said at the meeting;
(h) the exact content of the proposal for a decision put to the vote;
(i) the number of participants in the decision-making process;
j) the name of the local government representative excluded from the decision and the reason for the exclusion;
(k) the notary's indication of an infringement;
(l) the numerical result of the vote;
(m) the decisions taken; and
(n) those specified in the rules of organization and operation.
Mötv. § 53. (1) The representative body shall determine the detailed rules of its operation in the organizational and
Regulation on its rules of procedure. The representative body is the organizational
and the Rules of Procedure provide:
a) the official name and registered office of the local government;
(b) a list of the delegated powers of the representative body;
c) convening, chairing and deliberating the meetings of the representative body;
d) the rules of conduct for municipal representatives, the order of the meeting
and the measures that can be taken to achieve this;
(e) ensuring publicity;
f) the decision-making procedure, the method of voting;
(g) regulation and decision-making;
(h) the minutes of the Board meeting;
(i) the public hearing;
j) the bodies of the local government, their legal status and tasks;
k) the obligation of the notary to indicate unlawful decisions and operations;
(l) the committees of the representative body.
Mötv. § 54. The Board of Representatives shall hold a public hearing at least once a year in advance
held by representatives of the local population and local interest groups on local public affairs
make questions and make suggestions. On the proposal and question made a
a public hearing or a response within fifteen days at the latest.
3.
évi CXXVIII. Pursuant to Section 46 (4) of Act No. 14 Coll
the representative body of the local government, the capital and county assemblies
its powers are exercised by the mayor or the mayor, the chairman of the county assembly.
In this context, it may not take a position on the reorganization of a municipal institution,
the areas of supply and service, if the service also affects the settlement.
4. Decree 478/2020 on the declaration of a state of emergency. (XI. 3.) of the Government of the Republic of Hungary a
Government on SARS
Elimination of the consequences of the CoV-2 coronavirus pandemic, Hungarian citizens
in order to protect the health and life of the whole territory of Hungary
declared a state of emergency.
5. Unless otherwise provided in the General Data Protection Regulation, the request was initiated
for data protection authority proceedings under Ákr. provisions of the Infotv
with certain deviations.
The Acre. Pursuant to Section 103 (1), the Ákr. Initiated ex officio proceedings at the request of the Ákr
provisions of the Act on With the derogations provided for in §§ 103 and 104
apply.
Infotv. Pursuant to Section 61 (1) (a), it was taken in a data protection authority proceeding
In its decision, the Authority Data management specified in Section 2 (2)
in accordance with Article 58 (2) of the General Data Protection Regulation
may apply legal consequences.
Pursuant to Article 58 (2) (b), (c) and (d) of the General Data Protection Regulation
the data controller or the
a data processor if its data processing activities have infringed the provisions of this Regulation; instructs
the controller or the processor to comply with the data subject's obligations under this Regulation
request for the exercise of his rights; instructs the controller or processor to:
data processing operations, where appropriate in a specified manner and within a specified
comply with the provisions of this Regulation.
Infotv. 75 / A. § pursuant to Article 83 (2) to (6) of the General Data Protection Regulation
exercise the powers set out in paragraph 1 in accordance with the principle of proportionality,
in particular by complying with the law on the processing of personal data
For the first time in a binding act of the European Union
Article 58 of the General Data Protection Regulation
primarily by alerting the controller or processor.
Infotv. According to Section 38 (2), the task of the Authority is to protect personal data,
and the right of access to data of public interest and public interest
monitoring and facilitating the enforcement of personal data in the European Union
facilitating the free movement of According to paragraph 2a of the same section, the general
the tasks and powers laid down for the supervisory authority in the Data Protection Regulation
general data protection in respect of legal entities under the jurisdiction of Hungary
exercised by the Authority as defined in this Decree and in this Act.
Infotv. Pursuant to Section 60 (1), the enforcement of the right to the protection of personal data
To that end, the Authority shall, at the request of the data subject, initiate a data protection authority procedure.
Unless otherwise provided in the General Data Protection Regulation, the application was initiated
CL of the General Administrative Procedure Act 2016 on data protection authority proceedings.
(hereinafter: Ákr.) shall be applied as specified in the Information Act
with differences.
The Acre. Under Section 17, the authority has the powers and jurisdiction of the proceedings in all
ex officio. If you notice any of these deficiencies and you have no doubt 15
the competent authority in the matter can be determined, the matter shall be referred to it
failing that, it shall reject the application or terminate the proceedings.
The Acre. Pursuant to Section 36, the application is submitted by the customer in writing or in person
a statement requesting the right to conduct an official procedure or a decision of the authority
or in order to assert a legitimate interest. Infotv. Pursuant to Section 60 (2), the
an application to initiate an official data protection procedure under Article 77 of the General Data Protection Regulation.
may be submitted in the case provided for in Article 1 (1).
The Acre. Section 46 (1) (a) states that the Authority shall reject the application if
the condition for initiating the procedure specified in the law is missing, and the Ákr. to that
it has no other legal consequences.
Infotv. Pursuant to Section 60 (5), in the case specified in Section (2) a
application contains more than those specified in the Act
the. an indication of the alleged infringement,
b. a description of the specific conduct or condition that led to the alleged infringement,
c. to identify the data controller or processor implementing the alleged infringement
necessary data available to the applicant,
d. the facts and arguments in support of the allegations of alleged infringement
evidence, and
e. a firm request for a decision to remedy the alleged infringement.
III. Decision
In the present case, in the light of all the facts available to the Authority, its decision
it is necessary that
- the personal data indicated by the Applicant during the data processing
what legal basis and purpose did you deal with it?
- disclosure of personal data provided by the Applicant
is it necessary during the public hearing?
- whether the personal data indicated by the Applicant can be lawfully deleted from the public
from video or documents you brought?
III.1. Publicity of the operation of the representative body, for the public hearing
applicable rules
Transparency of municipal operations
The Mötv. Section 46 provides for the publicity of the meeting of the representative body, the closed session
conditions for keeping it. The Mötv. § 2 declares as a principle the meetings of the Board of Representatives
publicity, which the Mötv. Section 46 (1) is confirmed by the legislator.
Infotv. According to § 32, the bodies performing public tasks - such as local governments and their bodies
They must facilitate and ensure the accurate and prompt provision of information to the public, and
they must allow the data of public interest in their processing - as defined by law
with exceptions - anyone can find out. Accordingly, Mötv. Pursuant to Section 48 (1)
the meeting of the Board of Representatives is, with certain exceptions, public. The Mötv. § 2 (2)
also provides in a general way for local public affairs to be democratic, comprehensive
publicity.
The right of access to data of public interest, based on the democracy of local governments
therefore, both Infotv. and Mötv. rules of publicity of municipal operations, 16
they want to guarantee the transparency and related data and information
declared public. It is only in a narrow circle, in cases specified by law
possibility to restrict the public. 2
In several decisions of the AB [19/1995. (III. 28.) AB and 57/2000. (XII. 19.) AB decision]
stressed that anyone in the public meeting (i.e. even any member of the audience) is there
the panel may also record without the express permission of other persons present
deliberations of Members and any non-illegal purpose
you can use.
In the opinion of the Authority expressed in several resolutions, the Board meeting is anyone
(municipal representative, citizen present)
online public hearing - is also included in the scope of the AB decision. The law
the consent of the persons concerned is not required - however, those present are informed
required for recording or live streaming.
The activities of the public self-government or the representative body include the public
the right to take video and audio recordings of meetings and the right to
making a sound recording of a participant in a meeting of a public representative body or committee
persons are required to tolerate. Attending a public board meeting is more
can also take the form of: most often a personal presence, but more and more
local government employs live coverage of board meetings for public implementation
as a way. The live broadcast in these cases is local / municipal television, or
available on the radio channel or on the Internet (on the website of the municipality, on Facebook)
for citizens. They took place at the meetings of the public representative body and the committee, the
protocols and recordings made about them are of public interest or public data of public interest
considered to be covered by Infotv. Pursuant to Section 28 (1), anyone can get to know.
The Authority emphasizes that, subject to the data principle,
the documents of the public board meeting also contain data that is not data of public interest,
and not public data in the public interest. In this case, of course, it must be unrecognizable
put the protected data in all relevant documents. The Data Protection Commissioner
889 / K / 2006-3. a state or municipal body, or
incurred in the performance of his duties but addressed to a private individual
letters with the consent of the addressee, failing which the relevant procedural or closed
may be made public in accordance with the rules governing meetings of the Board of Representatives.
The minutes of a meeting of a local representative body shall not be considered as documents
which, by its nature, contains only data of public interest. After the public hearing
a special form of public representative body meeting where the discussion
pre-filed speeches themselves contain personal data.
In the Authority's view, the fact that a person is personal is in itself a circumstance
data is delivered at a public board meeting does not yet result in a
personal data would become public in the public interest as a result of this circumstance. The personal
obligation to protect data in spite of and in addition to the public
will remain. In each case, the Authority emphasizes the importance of privacy, privacy and
taking into account and fully ensuring the protection of the rights of the individual a
both in public meetings and in their preparation and recording.
3799 / P / 2007-4. Resolution of the Data Protection Commissioner
457/2000. (XII. 19.) AB decision
BH1996.581 17
Subject to the requirements of the GDPR, data controllers must implement personal
data protection. Thus, inter alia, the processing of personal data is defined,
for a clear and legitimate purpose, for the time necessary to achieve the pre-determined objective. The
appropriate technical and organizational measures
in which the personal data processed are guaranteed to be adequate
security.
The public hearing
The public hearing was dedicated to discussing issues and suggestions related to local public affairs
forum, a deliberation aimed at the representative body living in the municipality
citizens ’questions through information that affects their daily lives
their living conditions, the state and quality of public services and to listen to them
also the proposals, which are also based on the knowledge and experience of the residents of the given settlement
are based.
As a result of the public hearing being held by the House of Representatives (in times of emergency
the mayor), all the provisions laid down in Art. the
order to apply to meetings within the scope of the functioning of the representative body.
The Mötv. Section 54 regulates the general rules for public hearings. THE
public hearing is a specific form of the functioning of the representative body, a special body meeting,
where no decisions are usually taken, but the issues raised there are recorded in minutes
must be recorded and answered within 15 days. Not only there at the public hearing
but also the right to comment, to ask questions and to make suggestions
there for the local resident and representatives of local stakeholder organizations.
7
The Authority and the Data Protection Commissioner have previously explained this in their resolutions
opinion that it did so in the context of a public board meeting or a public hearing
When asking questions, it is not necessary to provide the personal data of the contributors (name, personal
signature, address in case of presence).
The Data Protection Supervisor ABI-1332 / A / 2006-5. In its resolution No
the recording of personal data of interested parties appearing at the board meeting; and
disclosure is not justified by their (formal) consent,
whereas the processing of data does not comply with the purpose limitation principle. Data management is a a
possible future event (the person concerned will have the floor at the board meeting)
in a stock-like manner. On the other hand, the commenter concerned
if you get the floor - you have the right to decide whether to post with or without a name
whether you wish to tell or be informed in advance of your comment
shall be entered in the minutes. […] If the reply is sent in writing, it is not appropriate to
"record and store" the name and address of the data subject in a published protocol.
In the Authority's view, the public hearing is open to the public body
subject to the same assessment as the meeting. Consequently, the private sector, private secrets and
with due regard for the protection and full protection of the rights of the individual
an obstacle to this live form of the Board of Representatives not being available live
broadcast either on the official website of the municipality or on the community site.
5Mötv. § 4 Local public affairs are basically for the provision of public services to the population, as well as for local self-government and
related to the creation of organizational, personal and financial conditions for cooperation with the population.
6Explanation of the Act on Local Governments of Hungary, Edited by: Marianna Nagy, István Hoffmann 212-
Page 214
7ABI-1332 / A / 2006-5., NAIH / 2020/809/2. 18
III.2. The Authority 's position on the present case
478/2020 on the declaration of a state of emergency. (XI. 3.) of the Government Decree 2020.
from the 4th of November in the declared emergency, as a special legal order, § 46 of the Cat.
(4) defined the rules for the exercise of local government tasks and competences by
Mötv. by way of derogation from the relevant provisions of
exercised by the mayor, the representative body has no decision-making power in an emergency.
In the present case, therefore, Mötv. public hearing within the remit of the Board of Representatives
in the event of an emergency was within the duties and powers of the mayor.
Legal basis for data management
8
Article 6 (1) (a) to (f) of the General Data Protection Regulation contains those a
legal bases, at least one of which can be considered lawful in the personal case
data management.
According to the applicant's statement received by the Authority on 14 June 2021, “[a] a
at a public hearing, which is a public meeting of the Board of Representatives, published there, in advance
registered voters personally say they belong to the concept of local public affairs
their comments. The lawfulness of personal data processed during a public hearing is governed by Article 6 of the GDPR.
Article 1 (1) (e) ensures that the processing is in the public interest or in the public interest
task performed in the framework of the exercise of a public authority delegated to a data controller
necessary for its implementation. […] For the smooth running of the public hearing, respectively
in order for the municipality to properly fulfill its information obligation
and thereby ensure the right of citizens to participate, it is necessary for the citizens concerned to be certain
data management. In the case of the Applicant, the street level indication of his place of residence is territorial
was necessary for identification, as without it it would not have been adequate
to provide an answer to a problem affecting the area.
The disclosure was not for the purpose, but for the public hearing to be there
speakers communicate their names and in order to identify the local public matter they raise
they indicate their narrower living environment and, in some cases, their address. […] ”
In the present case, the Authority requested the Applicant to present it at the public hearing
related to the handling of speakers' personal data. The Authority
With regard to the issue, the Applicant provided the following information: “[…] The SZMSZ has already
Paragraphs (2) to (3) of Article 93 provide:
(2) The citizens of the district shall be notified of the date of the public hearing no later than 15 days in advance -
by publication of a notice - the mayor shall notify. The announcement should be made as follows
publish:
a) on the notice board of the mayor's office,
(b) by publication in the district written and electronic press; and
c) on the website of the municipality.
8Data Regulation Article 6 1. The processing of personal data shall be lawful only if and to the extent that it is lawful
one of the following is met:
(a) the data subject has consented to the processing of his or her personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which one of the parties is a party or of a contract
necessary to take action at the request of the data subject prior to its conclusion;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) the processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(e) the processing is carried out in the public interest or in the exercise of a public authority conferred on the controller
necessary for the performance of the task;
(f) processing is necessary for the protection of the legitimate interests of the controller or of a third party, unless
the interests or fundamental rights and freedoms of the data subject which:
protection of personal data, especially if the child concerned. 19
(3) the order of the speeches at the public hearing shall be in the order of the serial numbers. The serial number
the subject of the opposition shall be indicated at the same time as the request. […] On the phone and
personally requested serial numbers for the Mayor’s Office to prepare for the public hearing
the responsible civil servant will immediately issue to the applicant, while the comments indicated in the e-mail
inform the applicant shortly of the serial number and of his / her submission
whether it is a local public matter. The name and contact details of the commenter (address, telephone number, e-mail
title) is included in a database only and exclusively for two reasons provided by the citizen
to solve the indicated problem. On the one hand, if raised in a public hearing
may not be answered, or may not be answered in full, within the statutory time limit
be able to send an appropriate reply on the action taken following your post, which
either on its own authority or to a body competent and competent
solved by transmission. On the other hand, that provided a raise that does not belong to the local
public affairs category, consider your case to the competent office of the Mayor's Office
can handle it tailored. […] I consider it important to note that overall a
traditional and online public hearing data management is no different, and in my opinion
complies with our current data protection regulations, which can be found on the website of the municipality
available at the following link: [...] '
In his statement, the Applicant further explained that “[…] The Applicant’s submission was also sent by e-mail.
sent in which he voluntarily provided his address so that it was not related to the indicated
problem. In this email, he did not say that he was asking for his name to be withheld, his details
privately, although the acting clerk explained the details of the public hearing by telephone
Mötv. and SZMSZ rules. Subsequently, Applicant by e-mail
re - submitted another proposal, now in the local public affairs category, in which
re-entered his address and still did not provide for its closed treatment. […] '
The Authority has repeatedly emphasized in its resolutions that the publicity of the public hearing a
is subject to the same assessment as a meeting of a public representative body, with the result that it is not
an obstacle to this live form of the Board of Representatives not being available live
broadcast either on the official website of the municipality or on a community site,
of course, the protection of privacy, privacy and the right to privacy
full protection of personal data.
A 11/2019. Joint Action No. […] Data Protection and
Data Security Policy (hereinafter: Policy)
The Regulations are based on 6/2020. by Joint Action No
entered into force on 5 March 2020 in a single structure following an amendment.
According to the Regulations, the data controller […] (hereinafter: the Local Government) and […]
hereinafter referred to as "the Office"). The purpose of the Regulations is: “[…] The data controller's customers, prospective customers and
intended to be transparent to its employees by electronic or traditional means
the data management procedures followed in using the services provided by
relating to the protection of individuals with regard to the processing of their personal data
principles and rules regardless of the nationality and place of residence of natural persons
prevail. The basic purpose of the Data Controller is to respect this in all cases
fundamental rights and freedoms of natural persons, in particular with regard to their personal data
their right to protection. " [Regulation 1.1.1.]
In the Regulations, as the data protection officer of both the Local Government and the Office, a
Perfectus Consilium Kft. Article 3.2 of the Regulations. according to the data protection
The official's duties include assisting and assisting with data management
making related decisions and ensuring the rights of data subjects.
The Regulations provide for the organization of data protection, the data management register, the relevant 20
rights, principles on the processing of personal data, data protection impact assessment and
prior consultation, management of data protection incidents, data processors,
data transmission, data security measures, cooperation with the supervisory authority,
and on appeal. Annex 2 of the Regulations is a blank data management
information leaflet, after filling in the information on specific data management
applicable.
The last three paragraphs of point 5 of the Rules are relevant to the present case
provisions:
'[…] For the management of claims relating to the exercise of the rights of data subjects, the rights of data subjects
and to record the measures taken in this connection
The head of the Office of Public Administration Development and Organization is responsible.
Records of claims and measures related to the exercise of data subjects' rights
on the appropriate sheet of the data management register. (Annex 5)
The exercise of the rights of the data subjects in accordance with the Data Provision /
by completing a data processing request form or other written request
(electronically) and submitted to the Data Controller
initiated. The application shall be submitted in electronic form to the […] e-mail address on paper
It can be submitted to the head of the Office of Public Administration Development and Organization. The
After examining the content of the application, the Head of the Office shall decide on the further measures to be taken,
if necessary, seeking the opinion of the Data Protection Officer. […] '.
Section 6 of the Regulations, which details the principles governing the processing of personal data
the last three paragraphs of the regulation govern the process prior to data processing: '[t] he
Office manager before the start of data management is required to comment on the data protection
all relevant information on the planned processing
information. The opinion of the Data Protection Officer is required within 5 working days of the organization
to the head of unit. If, in the opinion of the Data Protection Officer
the prior consent of the data subject, the head of the organizational unit, is required for the data management
ensure the data management consent of the data subject in accordance with Annex 3
as well as the data management information according to Annex 2
information.
The person receiving the data shall be required to submit a consent form or
attach an original copy of the declaration to the file on paper or electronically; and
handled in accordance with the Data Controller's Records Management Regulations.
In the event of refusal of the data subject 's consent, the data subject shall:
record the consequences of refusing consent and inform the data subject accordingly.
[…] ”.
Following a review of the Code, the Authority concluded that it did not include
Indication of the task groups performed by the local government or the Office, which
personal data may or may not be processed in the course of its care, so it is lawful
effective implementation of data management requires the Data Protection Officer
contribution.
The Authority, after reviewing the rules, found that the Office nevertheless
treated as unaffected by the Applicant on 13 January 2021
complaint about the processing of your data and did not involve the data protection in the proceedings
official in his submission in support of the Applicant's enforcement
specifically Article 12 (3) and Article 17 (1) of the General Data Protection Regulation.
referred to in paragraph 1 (d).
It is clear from the Applicant's replies that he treats Article 21 as a unit
the preparatory, conducting, and documenting phases of the public hearing; and the public hearing
does not differentiate between the data processing performed in the process of the Mötv.
considers it lawful under its public disclosure rules.
The Authority is involved in the complaint and its administration indicated in the opposition
in the case of data management, accepted the statement of the Applicant, in which the performance of his public duties
Article 6 (1) of the General Data Protection Regulation as the legal basis for
indicated point (e) of paragraph.
However, the personal data (name and address) of the Applicant provided by the Applicant a
by recording the public hearing in live, video or written form, and a
video recording or separately with the publication of the minutes
In the case of data processing, the Authority is of the opinion that in the present case the Applicant is personal
for the processing of data by recording and publishing their data, only the
Applicant 's appropriate, informed consent [general data protection
Article 6 (1) (a) of that Regulation] could have been the appropriate legal basis
Applicant did not have.
The Authority shares the Applicant's view that the traditional (attendance)
and the data management of the online public hearing are not fundamentally different, however, the
The Authority attaches great importance and emphasizes its position that
the citizen attending the public hearing in person
exercise its right to information self-determination, ie its consent where appropriate
you can give or object to the display of your personal data in the minutes, and
with regard to their publication.
In this regard, the Authority emphasizes that the complainant is in online form
in the case of a public hearing, for a video currently available on the community portal
with regard to the disclosure of personal data
protests show that the applicant for the public hearing and the
citizens participating in the form of their speeches did not know in the online space
enforce their right to information self-determination. The online public hearing
With regard to data management, the Authority is of the firm opinion that the information
the controller needs to be more careful about the exercise of the right of self-determination
act as citizens in terms of their personal data in the online space much
are in a more vulnerable position than in the case of traditional public hearings,
as a result, it is more important and more important in relation to data management
information to the controller.
In relation to the Applicant's statement in point 8, the Authority emphasizes that the
ensuring the lawfulness of data processing at all stages of data processing
data controller, ie the obligation of the Applicant. Article 5 (2) of the General Data Protection Regulation
sets out the principle of accountability, according to which the controller is responsible for personal
lawful processing of personal data and must be able to demonstrate such compliance.
In view of the above, the Authority notes that during the preparation of the public hearing, the
identification of a local public matter has been lawfully made to the Applicant’s personal data
however, during the online public hearing and to the public
personal data of the Applicant in the video recording and the report made about it
the aim would have been achieved without addressing it: to present the problem raised by the Applicant,
its management. The Authority considers that Article 5 (1) of the General Data Protection Regulation
In view of the principle of data saving under paragraph 22 (c), it would have been sufficient to
To refer to the serial number issued by the Applicant is the local public matter raised by the Applicant
when describing.
An overview of the privacy policy identified and referenced in the Applicant's statement
Following that, the Authority found that its details were not regulated in the
during the publication of documents related to the operation of the local government
data processing - making personal data unrecognizable.
The Authority draws the Applicant's attention to the online public hearing
by reviewing their data management in accordance with their Regulations, or by the Applicant
with the proper handling of your request and with the involvement of the Data Protection Officer
an infringing situation could have been avoided.
Exercise of the right concerned - right of cancellation
Pursuant to Article 17 (1) of the General Data Protection Regulation, the data subject is entitled to
that, at the request of the controller, delete the personal data concerning him without undue delay
data, and the controller is obliged to provide personal data concerning the data subject
delete it without undue delay if one of the following reasons exists:
(a) personal data are no longer required for the purpose for which they were collected
or otherwise treated;
(b) the data subject withdraws the information referred to in Article 6 (1) (a) or Article 9 (2);
the consent on which the processing is based pursuant to paragraph 1 (a), and
there is no other legal basis for data processing;
(c) the data subject objects to the processing pursuant to Article 21 (1) and does not
overriding legitimate reason for the processing or the data subject concerned in accordance with Article 21 (2).
protests against data processing pursuant to paragraph
(d) personal data have been processed unlawfully;
(e) personal data are required by Union or Member State law applicable to the controller
must be deleted in order to fulfill a legal obligation;
(f) the collection of personal data referred to in Article 8 (1)
the provision of social services.
Pursuant to Article 17 (3) (b) of the General Data Protection Regulation, paragraphs 1 and 2
Paragraph 1 shall not apply where the processing is the processing of personal data
obligation under Union or Member State law applicable to the controller
public authority or a power of attorney conferred on the controller in the public interest
necessary for the performance of its task.
In the present proceedings, the Applicant approached the Applicant in the framework of the exercise of the rights concerned
in order to have his personal data disclosed in the way he has infringed
ask. To that end, he made it clear that it was about an online public hearing
in which parts of the video you can see and hear based on your personal data or the recording
where your personal data is included in the report.
He requested in his answer to Question 2 in order to clarify the facts
explained the reason for rejecting the Applicant's request to delete his personal data.
The Authority draws attention to the General Statement requested
pursuant to Article 15 (1) of the Data Protection Regulation, without requesting a time limit,
is entitled at any time to receive feedback from the Applicant as data controller
whether the processing of your personal data is in progress and if such processing is taking place
pending, shall have the right to have access to personal data and data processing
access information and request the deletion of your personal data.
With regard to the data management of public board meetings, the Authority shall: a
takes the consistent view that the fact that
personal data at a public hearing, including a public hearing,
does not yet result in the data arising from this circumstance
would be made public in the public interest. The public has a duty to protect data
despite or in addition to remaining. In each case, the Authority shall emphasize the
taking into account the protection of privacy, privacy and the rights of the individual; and
full provision in public meetings and their preparation and
during the recording of the contract.
It follows from the above that data controllers must comply with the requirements of the GDPR
implement the protection of personal data. Thus, among other things, it is that personal
processing data for a specific, clear and legitimate purpose is a pre-determined purpose
for the time necessary to achieve it. Data management is also carried out in such a way - the right way
technical and organizational measures, during which it is guaranteed
adequate security of the personal data processed.
With regard to the processing of the Applicant 's personal data, the Authority considers the
He made his statement in point 1 and his last statement in point 8. According to point 1, a
the disclosure of personal data was “not for a purpose but for a public hearing
it is unique that the speakers there communicate their names and the local public affairs they raise
in order to be identifiable, their narrower living environment and, in some cases, their address
shall be marked. " However, as described in Section 8, “[K] it is sent by e-mail repeatedly
submitted another proposal, now in the local public affairs category, in which it reiterated
gave his address and still did not provide for its closed treatment. "
In the Authority's view, the burden of an infringement committed with inadequate data management
it may not be transferred by the Requested Data Controller to the data subject, in this case to the Applicant. The
it is the responsibility of the controller to examine it at all stages of data processing; and
considering the extent to which the personal data provided by the data subject are necessary and
are sufficient for the given data management (principle of data saving, proportionality of necessity
principle) or what is of greater interest is the narrower one raised by the Applicant
disclosure of your personal data in connection with a local public matter concerning your living environment
or, depending on the nature of the problem, that the Applicant
may become the target of insults by disclosing your personal data - the Applicant
exercise of his right to the protection of his personal data and privacy.
The statement made to the Requested Authority did not cover the fact that in the present case the Applicant
At the request of the data subject, the Applicant would have subsequently carried out a balancing test, and
He would have sought the opinion of the Data Protection Officer under the Rules.
On the basis of the above, the Authority finds that the Applicant has unlawfully denied the
Applicant for the deletion of his personal data submitted in the framework of the exercise of the data subject's rights
application.
ARC. Legal consequences
Pursuant to Article 58 (1) (b) of the General Data Protection Regulation, the Authority shall:
He has convicted a data controller of committing a data breach. 24
In the course of the procedure leading to the request, the Authority examined whether a
Imposition of a data protection fine on the applicant. In this respect, the Authority is general
Article 83 (2) of the Data Protection Regulation and Infotv. 75 / A. § considered the case
all the circumstances and, in its view, for the purposes of the General Data Protection Regulation
no further sanction is required against the Applicant in the present case
application.
In the Authority's view, the condemnation contained in the General Data Protection Regulation
sufficient and proportionate to the infringement suffered by the Applicant.
Based on the above, the Authority has decided in accordance with the operative part.
V. Other issues
The competence of the Authority is limited by the Infotv. Section 38 (2) and (2a), its jurisdiction is
covers the whole country.
The decision is based on Ákr. 80-81. § and Infotv. It is based on Section 61 (1). The decision is based on Ákr.
Pursuant to Section 82 (1), it becomes final with its communication.
The rules of administrative litigation are laid down in Act I of 2017 on the Procedure of Administrative Litigation (a
hereinafter: Kp.). A Kp. Pursuant to Section 12 (1) by a decision of the Authority
The administrative lawsuit against the court falls within the jurisdiction of the court. Section 13 (3)
Under subparagraph (a) (aa), the Metropolitan Court has exclusive jurisdiction. A Kp. Section 27 (1)
legal representation in litigation falling within the jurisdiction of the General Court under paragraph (b) of this Article
obligatory. A Kp. Pursuant to Section 39 (6), the filing of an application is administrative
has no suspensive effect on the entry into force of the act.
A Kp. According to Section 124 (6), if in the case of a set of actions permitted by law a
part of the claims under the simplified procedure and another under the general rules
should be adjudicated, the court will act in accordance with the general rules.
A Kp. Section 29 (1) and with this regard Pp. Applicable in accordance with § 604, electronic
CCXXII of 2015 on the general rules of administration and trust services. law
(hereinafter: E-Administration Act) According to Section 9 (1) (b), the legal representative of the client
obliged to communicate electronically.
The time and place of filing the application is set out in the Act. Section 39 (1).
On the reintroduction of certain procedural measures in the event of an emergency
112/2021. (III. 6.) of the Government, unless this decree provides otherwise, a
stricter defense does not affect the running of time limits. A Veir. Pursuant to Section 36 (1) - (3) a
during the period of enhanced defense, the court shall act out of court, including appellate
procedures. If a hearing were to be held, either at the request of either party, or
hearing has already been scheduled, the trial court will notify the parties out of turn of the hearing
and give the parties the opportunity to make their statements in writing
put forward.
If the trial were to take place outside the time of the enhanced defense, the plaintiff would then
you can ask the court to try an extrajudicial trial instead of a hearing
postpone until the end of
the. the court did not order the suspensory effect of the administrative act at least in part
el,
b. the bringing of an action has suspensory effect and the court does not have a suspensory effect
ordered
c. no interim measure has been ordered. 25
The amount of the fee for an administrative lawsuit is set out in Act XCIII of 1990 on Fees. law
(hereinafter: Itv.) 45 / A. § (1). From the advance payment of the fee
the Itv. Section 59 (1) and Section 62 (1) (h) shall exempt the person initiating the proceedings
half.
Budapest, August 12, 2021
Dr. Attila Péterfalvi
President
c. professor
