NAIH (Hungary) - 4094-1/2026

From GDPRhub
NAIH - 4094-1/2026
Authority: NAIH (Hungary)
Jurisdiction: Hungary
Relevant Law: Article 5(1)(c) GDPR
Article 6(1) GDPR
Article 58(2)(d) GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided: 04.02.2026
Published: 17.06.2026
Fine: n/a
Parties: n/a
National Case Number/Name: 4094-1/2026
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Hungarian
Original Source: NAIH (in HU)
Initial Contributor: av

The DPA held that a guardianship authority had violated the GDPR by unlawfully disclosing the residential address of a parent and his two minor children to their estranged grandparent. The address information was not necessary for client identification, and the authority lacked legal basis for the disclosure.

English Summary

Facts

A grandfather filed a request with a guardianship authority (the controller) in 2024 in order to get the address information of his son and his two minor children (the data subjects). He wished to obtain visitation rights with the children but had not been in contact with their father in 10 years. The guardianship authority subsequently summoned the parties to a settlement hearing and included the residential address of the data subjects in the summons.

The father filed a complaint with the supervisory authority on behalf of himself and his minor children. The data subjects argued that the disclosure of residential address data to the grandfather had been unlawful under the GDPR.

The controller stated that the processing had been lawful. In addition, including the residential address of the data subjects in the summons had been necessary to arrange visitation rights and assign the case to the competent authority. The controller also pointed out that the data subjects did not request their address information to be treated as confidential, nor was this done ex officio.

Holding

First, the DPA held that the controller had violated Article 6(1) GDPR by failing to demonstrate that there had been an applicable legal basis for disclosing the residential address of the data subjects to the grandfather.

Second, the DPA found an infringement of the principle of data minimization laid down in Article 5(1)(c) GDPR. Applicable national provisions only required that data necessary for client identification be included in official documents. Therefore, the DPA held that the summons should have contained the minimum amount of personal data necessary for client identification, even if no order of confidentiality had been issued. The residential address was unnecessary for identification purposes especially since the guardianship authority had only disclosed the address of the data subjects but remained silent about the address of the grandfather.

The DPA ordered the controller to bring processing operations into compliance with the GDPR pursuant to Article 58(2)(d) GDPR. In particular, it instructed the controller to pay attention to the principle of data minimization by including as little personal data in its documents as possible. Furthermore, the DPA ordered the controller to specifically ensure that a legal basis exists for the disclosure of personal data contained in documents sent to the opposing party in child protection proceedings.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details. 

…………………………………………………………………………………………………………
1055 Budapest Tel.: +36 1 391-1400 naih.hu/adatkezelesi-tajekoztatok
Falk Miksa utca 9-11. KR ID: 429616918 ugyfelszolgalat@naih.hu
Case number: NAIH-4094-1/2026. Subject: decision granting the application
D E C T I O N
The National Data Protection and Freedom of Information Authority (hereinafter: Authority) […]
(hereinafter: Applicant1) and the minor children represented by him, […] (hereinafter: Applicant2) and […] (hereinafter: Applicant3) (hereinafter: Applicants) – submitted on […] and completed on […] 2024 – in the data protection authority proceedings initiated on […] 2024 against the Budapest Metropolitan Government Office […] District Office (seat: 1181 Budapest, Városház u. 16., hereinafter: Applicant) regarding the unlawful processing of their residential address data, makes the following
decisions:
I. The Authority grants the Applicant’s application,
and the natural The Authority hereby orders the Respondent to comply with Article 5(1)(c) and Article 6(1) of Regulation (EC) No 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation (EC) No 95/46/EC (hereinafter referred to as the General Data Protection Regulation or GDPR) by including and transmitting the address details of the Applicants in the summons. II. In view of the infringements established in point I, the Authority ex officio 1. orders the Respondent to bring its data processing operations into line with the provisions of the GDPR by establishing an internal regulator to determine the minimum amount of personal data necessary for customer identification in relation to the decisions it takes. 2. orders that this decision, in addition to the anonymization of the identification data of the Applicants, be published on the Authority's website with the identification data of the Applicant.
The Applicant must prove to the Authority in writing, together with the submission of supporting evidence, that he has fulfilled the obligation specified in point II.1 of the decision, within 30 days of the expiry of the deadline for filing an appeal against this decision.
No procedural costs were incurred in the proceedings.
There is no right of administrative appeal against this decision, but it may be challenged in an administrative lawsuit by filing a claim with the Metropolitan Court within 30 days of its notification. The claim must be submitted to the Authority electronically, which will forward it to the court together with the case documents.1 The request for a hearing must be indicated in the claim. For those who do not benefit from full personal exemption from fees, the administrative lawsuit fee is HUF 30,000, and the lawsuit is subject to the right to record the subject matter fee. Legal representation is mandatory in the proceedings before the Metropolitan Court.
1 The form NAIH_K01 is used to initiate an administrative lawsuit. The form can be filled out using the general form filling program (ÁNYK program). The form is available and can be downloaded from the Authority’s website: https://www.naih.hu/kozig-hatarozat-birosagi-felulvizsgalata
2
JUSTIFICATION
I. R e p o s s i n g the application and the procedure
(1) Applicant1 – on behalf of himself and his minor children – requested the initiation of data protection authority proceedings in his submission received by the Authority on […], 2024, citing that the Applicant had unlawfully and unnecessarily forwarded their residential address data in the authority proceedings initiated on […], 2024, at the request of the Applicant1’s father, at the […] number (hereinafter: main case or main proceedings).
(2) Applicant1 stated that he had severed ties with his father for more than ten years, and therefore did not know his family and their addresses prior to the proceedings resulting in the complained-of data processing. In […] 2024, his father applied to the District Office of the Budapest Metropolitan Government Office [...] (hereinafter: District Office) stating that he would like to maintain contact with his grandchildren, which the District Office transferred to the Applicant, who had jurisdiction based on their addresses, due to lack of jurisdiction, without indicating their addresses.
(3) Applicant1 stated that following the transfer, the Applicant summoned him and his spouse, or his father, to a settlement hearing as parties, simultaneously with the notification of the initiation of the main proceedings, indicating their addresses in the summons, which thus became known to his father.
(4) Applicant1 complained that in the main proceedings he had not had the opportunity to exercise his client rights to submit a request for closed data processing before the summons was sent, which resulted in the unauthorized transfer of data, and that the Applicant had unlawfully and unnecessarily included his residential address in the summons. He stressed that such data processing – in addition to having serious consequences in a child protection proceeding – undermines the legal provisions ensuring the possibility of closed data processing, and therefore he would like it to not happen again in the future.
(5) Due to the above, Applicant1 requested the Authority to establish the infringement, to publish the decision establishing the infringement, to prohibit the Applicant from similar infringements in the future and to impose a fine.
(6) In support of the request of the Applicant1, the Applicant attached the summons order dated […], 2024, sent to his father, and – in response to the Authority’s request to rectify the deficiencies – the birth certificates of the Applicant2 and Applicant3 to prove their right to legal representation.
(7) Based on the above request, the Authority initiated data protection authority proceedings against the Applicant based on Section 60 (1) of Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (hereinafter: the Infotv.) regarding the inclusion and transmission of the Applicant’s residential address in the summons order.
(8) In order to clarify the facts, the Authority filed NAIH-[…]/2024. No. 2024, dated […], called on the Respondent to provide – substantiating its claims with documents – written information on its data processing relating to the Applicants, covering all facts and circumstances that may be of significance for the procedure.
(9) In its statement submitted on […], 2024, in response to the Authority’s above call, the Respondent disputed that it had unlawfully processed the Applicants’ data, citing that the processing of these personal data was subject to the relevant legislation and the legal provisions governing the type of case [see: Act XXXI of 1997 on the Protection of Children and the Administration of Guardianship (hereinafter: Act XXXI of 1997 (hereinafter: Act XXXI of 1997 on the Protection of Children and the Administration of Guardianship) and Act 149/1997 on the Guardianship Authorities and the Procedure for the Protection of Children and the Administration of Guardianship].
(IX.10.) Government Decree (hereinafter: Child Protection)], it is necessary for the authority acting in the child protection authority procedure to know and handle them, and with regard to the data transfer, it referred to the fact that, in view of the subject matter of the procedure, it indicated in the summons all the data that are relevant to the case, invoking in this regard the Child Protection Act 29/A. § (5), (6) b) and c) and (7), which provisions require the competent authority to specify, among the content elements of the decision of the guardianship authority on the regulation of contact, the place, time and method of handing over and returning the child (and his/her personal documents, clothing, etc.), the name of the person involved in this, and in the case of supervised contact, the location and frequency of contact, and to indicate whether contact may take place with or without the presence and advice of a specialist supervising contact. (10) In relation to the above, the Respondent highlighted that the place of residence of the children and their parents also determines the competence of the institution providing the location of supervised contact, as this can only be ensured by the competent child welfare centre, and all interested parties in the case must be aware of this relevant information on which the decision made in the course of arranging contact with grandparents is based in order to be able to form their position, clarify their application and make a statement of merit in the case. (11) In his statement, the Respondent further acknowledged, on the one hand, that the father of Applicant1 (hereinafter referred to as the Maternal Grandparent) had learned of the address of the Applicants from the summons to the settlement hearing, since the District Office's order ordering the referral did not include this, and on the other hand, that the Applicants had not received notification from the District Office either of the receipt of the application or of its referral, since the proceedings had not progressed to the point where the authority notified the parties with opposing interests of the commencement of the proceedings, and thus the Applicants in the present case had no opportunity to familiarize themselves with the documents that had been created up to that point (i.e. the application for contact with the grandparents). It stated that, following the receipt of the transferred application, it summoned the Applicant1 and the Applicant1’s spouse to the settlement hearing at the same time as the notification of the initiation of the procedure, for which it sent a summons to the applicant in the main case, i.e. the Maternal Grandparent, simultaneously with these orders, stating the mandatory elements in accordance with Section 81 of Act CL of 2016 on General Administrative Procedure (hereinafter: Act) – identification data necessary for the identification of clients –, thus the address data of the Applicants was necessarily included in it, in addition to the reasoning presented in paragraphs (9) and (10) of this decision. (12) The Applicant further submitted that Applicant1 first indicated to him at the hearing held during the proceedings that his relationship with the Maternal Grandparent was conflictual, therefore he did not provide him with their address earlier, he did not request the confidential treatment of their personal data either when he was informed about the proceedings or in the further stages of the proceedings, and in view of the client statements submitted during the proceedings, he did not consider it ex officio justified to treat the children's address data confidentially, given that when regulating grandparental contact, it is essential to clarify the distance between the children and the grandparents concerned in order to make a decision on the frequency, duration and time of contact. In light of this, he also emphasized that - although this did not happen in the proceedings affected by the grievance, since the grandparent had requested supervised contact from the outset - the basic issue in such proceedings is to clarify the personal living and living conditions of the clients (parents, children, grandparents) and to prepare an environmental study of the given place of residence.
(13) In connection with the failure to order closed data management ex officio, the Applicant also referred to the fact that although the Act on the Protection of Children and [order of the District Office ordering the referral, (dated: 2024.[...], received by the Applicant: 2024. […]) and its annexes: the detailed data of the Applicants and the Applicant1
spouse, as well as the Maternal Grandparent, retrieved from the personal data and
address register on 2024. […], and the basis for it
[…] No. [dated: 2024. [...] notification of the initiation of proceedings and summons to a settlement hearing
to the Applicant1];
- No. […] [dated: 2024. […] notification of the initiation of proceedings and summons to a settlement hearing
to the Applicant1
spouse];
- No. […] [dated: 2024. [...] notification of the initiation of proceedings and summons to a settlement hearing
to the Applicant1
sfather];
- No. […] [dated: 2024. […], minutes of the settlement meeting];
- Applicant1’s submission submitted on […] 2024 via the e-Paper service [comments and motions made in the context of the clarification of the facts];
- […]/2024. [dated: 2024. […], decision granting the request for contact with grandparents].
(15) On […] 2024., the Authority invited the Applicants (NAIH-[…]/2024. order) and the Respondent (NAIH-…/2024. order) to make a statement and make observations pursuant to Section 76 of the Civil Procedure Code.
(16) Both the Applicant1 and the Respondent responded to the Authority’s above call in submissions submitted on […]2024.
(17) In its submission (NAIH-[…]2024.), the Applicant, maintaining its previous statement,
emphasised that, in addition to Section 81 of the Civil Procedure Code and Section 29 of the Child Protection Act, Section 29/A of the Child Protection Act also provides for mandatory content elements with regard to decisions made in matters related to contact, which it takes into account in its decisions, and the significance of which was also emphasised by the Budapest Public Interest Prosecutor’s Office, which regularly examines the activities of the guardianship authority as part of its legality review, indicating that the inclusion of data that is different from or inaccurate than the personal data and address register entails, on the one hand, a prosecutor’s warning,
and, on the other hand, the obligation to correct the decision.
(18) The Respondent, repeating its previous argument regarding closed data management, explained that the previously cited legal provisions clearly indicate to the authority when closed data management must be ordered, while contact matters (such as contact with grandparents) although falling within the competence of the guardianship authority, do not qualify as child protection proceedings according to the Child Protection Act, and in their regard, neither the Child Protection Act nor the Child Protection Act provide clear regulations as to whether or not, upon receipt of a request, or otherwise – ex officio in the absence of a request – any part of the data relating to the clients, including address data, should be treated as closed data. Moreover, even if there is a request, in many cases the circumstances specified in the legal provisions do not emerge, since it is not in the interest of the requesting client for the authority to become aware of them. In addition, it maintained its position that, while maintaining the basic principles and procedural rules applicable to the authority, it was not justified in the case to order ex officio the closed processing of the personal data of the minors concerned and their legal representatives, and therefore its procedure was lawful. 5 (19) In its submission (NAIH-[…]/2024.), Applicant1, while maintaining their original request, emphasized that the disclosure of their residential address was neither a necessary nor a proportionate measure on the part of the Applicant, and that it was not supported by the legal provisions cited by the Applicant. He pointed out that it should have been obvious to the Respondent from the request for grandparental contact that the Maternal Grandparent – with obvious reason
– did not know their address, and that the District Office was able to resolve the issue of jurisdiction and the referral of the case without revealing their address to the requesting Maternal Grandparent. He described that as soon as they received the summons, they contacted the Respondent by telephone and protested against the disclosure of their address, but at the same time – in addition to not receiving a reasonable response to their protest – they were clearly helpless in this situation and the submission of a request for closed data processing also became pointless for them.
He explained that the Respondent was mistaken in its argument that in order to regulate contact, the distance between the parties and thus the precise indication of the parties’ addresses were necessary. On the one hand, because in their case only supervised contact could be considered, in which, to his knowledge, distance does not determine jurisdiction, and on the other hand, the district of residence is sufficient to determine any distance or jurisdiction. He emphasized that the correctness of his statement is also supported by the judgment of the Budapest Metropolitan Court No. […]/2024., announced at the hearing held on […] 2024 – but not yet received – by which the court annulled the Respondent’s final decision and ordered the Respondent to a new procedure. (20) In order to clarify the issue raised on the basis of the observations submitted by the Applicant1 to the order (NAIH-[…]/2024.), the Authority Pursuant to Section 62(1), Section 63 and Section 65(1)-(2), the Authority invited the Respondent to make a statement and attach documents in its order No. NAIH-[…]/2025. The Respondent did not comply with the order and responded with a request (NAIH-[…]/2025.) issued by its order No. […]/2025 and submitted on […] 2025, requesting information on the purpose for which the requested documents are requested, with reference to which legislation, and why the Authority is not requesting them from the Applicants. (21) The Authority responded to the request by NAIH-[…]/2025. By order No. 2025. [...], the Court of Appeals repeatedly called on the Applicant to comply with the provisions of order No. NAIH-[...]/2025., which the Applicant complied with with the submission No. NAIH-[...]/2025., which was downloaded on 2025. [...] and submitted on 2025. [...], enclosing the letter sent to the Applicant by the Budapest Metropolitan Court's judgment No. ... dated 2024. [...] (hereinafter: Judgment), the Judgment, as well as the final decision made in the new proceedings on 2025. [...] ([...]/2025.), and the decision No. […]/2025. amending it – at the request of the parties.
I I. F a n t i c a l s (22) The Authority has established the following – relevant – facts based on the application and the evidence obtained in the framework of the evidentiary procedure presented above. (23) In a letter dated [...], 2024, the Maternal Grandparent submitted an application for grandparental contact to the District Office. According to the application for contact, the relationship between the Maternal Grandparent and Applicant1 was severed 10 years ago, Applicant1 is not in contact with the Maternal Grandparent, so he does not know his grandchildren (i.e. Applicant2 and Applicant3) who were born in the meantime and are aged [...], and he is not familiar with the Applicants' addresses. (24) On the day the application was received (2024. [...]), the District Office determined that it lacked jurisdiction based on the personal data and address register data and transferred the application to the Respondent with jurisdiction. The order ordering the transfer did not include the residential address data of the Applicants in the present case, which determined the Applicant’s jurisdiction. The District Office notified the Applicant and the applicant in the main proceedings, namely the Maternal Grandparent, of the transfer. The District Office therefore did not communicate the residential address data of the Applicants to the Maternal Grandparent. (25) Based on the transferred request for contact received on […], 2024, the Respondent set a settlement hearing for […], 2024, with its orders dated […] ([…]/2024., […]/2024. and […]2024.), to which it summoned Applicant1, Applicant1’s spouse, and the Maternal Grandparent as parties. In the summoning orders, it simultaneously notified Applicant1 and Applicant1’s spouse that proceedings had been initiated on […], 2024, on the subject of the settlement of grandparental contact based on the request of the Maternal Grandparent. All of the summoning orders include the residential address of the Applicants, while the residential address of the Maternal Grandparent is not included in the orders sent to the Applicant1 and the spouse of the Applicant1. The Applicant therefore communicated the residential address of the Applicants to the Maternal Grandparent, while the residential address of the Maternal Grandparent was not communicated to the Applicants. (26) Applicant1 and his spouse filed a lawsuit against the substantive decision of the Applicant in the official procedure for maintaining contact with the grandparents. The lawsuit did not contain a request for a violation of procedural law regarding the processing of the Applicant’s data; in it, Applicant1 and his spouse requested a review of the basic decision, citing the Applicant’s lack of clarification of the facts and unreasonable assessment. The Metropolitan Court found the action well-founded, therefore annulled the basic decision and ordered the Applicant to conduct new proceedings, and in its judgment – in relation to the motion for a grandparent environmental study, which was lawfully ignored by the Applicant – it explained that only supervised contact could be ordered in the case. In the final substantive decision made in the new proceedings, the Applicant regulated the grandparent contact within the framework of supervised contact at the contact duty of the child welfare center competent for the children’s place of residence, the location of which was modified at the request of the parties to the contact duty of the child welfare center competent for the children’s place of residence in view of the Applicants’ move. The amending decision does include the Applicants’ place of residence, but does not include the address of the place of residence (except for the name of the settlement).
I I I. APPLICABLE LAW
(27) Pursuant to Article 2(1) of the General Data Protection Regulation, the GDPR shall apply to the data processing in the present case.
(28) Pursuant to Article 2(2) of the Infotv., the GDPR shall apply to the data processing falling within the scope of the General Data Protection Regulation, as amended by the provisions set out therein.
(29) Pursuant to Article 4(1) of the General Data Protection Regulation, personal data shall mean any information relating to an identified or identifiable natural person (the “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, a number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
(30) According to Article 4(2) of the General Data Protection Regulation, processing means any operation or set of operations which is performed upon personal data or upon sets of data, whether or not by automated means, such as collection, recording, structuring, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. 7
(31) According to Article 4(7) of the General Data Protection Regulation, the controller is the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of the processing are determined by Union or Member State law, the controller or the specific aspects relating to the designation of the controller may also be determined by Union or Member State law.
(32) Pursuant to Article 5(1) of the GDPR, personal data must:
a) be processed lawfully and fairly and in a manner transparent to the data subject (‘lawfulness, fairness and transparency’);
b) be collected only for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; in accordance with Article 89(1), further processing for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes shall not be considered incompatible with the initial purpose (‘purpose limitation’);
c) be adequate and relevant in relation to the purposes for which the processing is carried out and limited to what is necessary (‘data economy’);
d) be accurate and, where necessary, kept up to date; every reasonable step shall be taken to ensure that personal data which are inaccurate, having regard to the purposes of the processing, are erased or rectified without delay (‘accuracy’);
(e) stored in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for a longer period only where the personal data are processed for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes in accordance with Article 89(1), taking into account the implementation of appropriate technical and organisational measures to protect the rights and freedoms of data subjects in accordance with this Regulation (‘storage limitation’);
f) processed in such a way that appropriate technical or organisational measures ensure the appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage (‘integrity and confidentiality’).
(2) The controller shall be responsible for compliance with paragraph 1 and shall be able to demonstrate such compliance (‘accountability’).
(33) Pursuant to Article 6(1) of the GDPR, the processing of personal data shall be lawful only if and to the extent that at least one of the following is met:
a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
b) the processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
c) the processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (f) of the first subparagraph shall not apply to processing carried out by public authorities in the exercise of their tasks. 8
(34) Without prejudice to other administrative or judicial remedies, each data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or the place of the alleged infringement, if the data subject considers that the processing of personal data concerning him or her infringes this Regulation.
(35) Pursuant to Section 60(1) of the Data Protection Act, in order to exercise the right to the protection of personal data, the Authority shall, at the request of the data subject, initiate a data protection procedure and may initiate a data protection procedure ex officio. The request for the initiation of a data protection procedure may be submitted in the cases specified in Article 77(1) and in Section 22(b) of the General Data Protection Regulation.
(36) According to Article 61(2)-(5):
Article 61(2) the Authority may order the publication of its decision – by publishing the identification data of the controller or the processor – if
a) the decision affects a wide range of persons,
b) it was made in connection with the activities of a body performing public tasks, or
c) the gravity of the infringement of rights that occurred justifies the publication.
(3) The use of a warning in the proceedings of the Authority is excluded if the Authority establishes the need to impose a fine based on the provisions applicable to its assessment.
(37) According to Article 58(2) of the GDPR, the supervisory authority, acting within its corrective powers,
b) shall:
condemn the controller or the processor if its data processing activities
infringe the provisions of this Regulation;
d) instruct the data controller or data processor to bring its data processing operations into compliance with the provisions of this Regulation - in a specific manner and within a specific period of time, as the case may be;
(38) Pursuant to Section 60/A. (1) of the Infotv., the processing deadline in the data protection authority procedure is one hundred and fifty days, which deadline does not include the time from the invitation to provide the data necessary for the clarification of the facts until its fulfillment.
(39) The rules of the Ákr. shall apply to the data protection authority procedure with the additions specified in the Infotv. and the deviations according to the general data protection regulation.
(40) The Ákr. According to Section 10 (1), a client is a natural or legal person or other organization whose rights or legitimate interests are directly affected by the case, who is included in the official register or who has been subject to official control.
(41) According to Section 17 of the Act, the authority shall examine its competence and jurisdiction ex officio at every stage of the procedure. If it detects any deficiency and the competent authority in the case can be established beyond doubt, it shall transfer the case, failing which the application shall be rejected or the procedure shall be terminated.
(42) According to Section 35 (1) of the Act, an application shall be a statement by the client requesting the conduct of an official procedure or a decision by the authority in order to enforce its rights or legitimate interests.
(43) According to Section 17 of the Act, According to Section 51(1)(b), if the authority exceeds the administrative deadline, it shall pay the applicant an amount corresponding to the fee payable for the conduct of the procedure or the administrative service fee paid for public administrative procedures or for the use of administrative services in accordance with the Act on Fees, or, failing that, ten thousand forints, who shall also be exempt from paying the procedural costs.
9
(44) Act CIII of 2023 on the Digital State and Certain Rules for the Provision of Digital Services
Act (hereinafter referred to as the Dáptv.) Section 19 (1) a) aa) 
based on the obligation arising from an international treaty, unless otherwise provided by a law, an international treaty or a directly applicable legal act of the European Union, all economic operators acting as clients are obliged to conduct electronic administration in respect of digital services provided by an organisation providing digital services.
(45) According to Section 19 (5) of the Dáptv., if a law makes electronic communication – or the method of electronic communication – mandatory in relation to the making of a declaration, a declaration that does not comply with this requirement – except in cases specified in a law or a government decree – is invalid.
(46) The Ákr. According to Section 81(1), the decision shall contain all data necessary for the identification of the proceeding authority, the parties and the case, with the exception of confidential and protected data, the operative part – the decision of the authority, the position of the specialized authority, information on the use of legal remedies and the procedural costs incurred – and, in the event of a transition to full proceedings, the grounds for the transition, the facts established together with the confidential and protected data made unknowable, the evidence, the justification for the position of the specialized authority, the reasons for the consideration and the decision, and the indication of the legal provisions on which it is based. According to Section (3) of the same Section, a simplified decision may be made on an order that cannot be challenged by an independent legal remedy, only including the indication of the legal provisions on which it is based in the justification.
(47) According to Section 27 (1) of the Act on the Protection of Personal Data, the authority shall process the personal data necessary for the identification of the client and other participants in the proceedings, and the personal data specified in the act regulating the type of case, and – unless otherwise provided by law – other personal data essential for the successful conduct of the proceedings.
(2) The authority shall ensure that secrets protected by law and other data protected by law (hereinafter collectively: protected data) are not made public or become known to an unauthorized person, and that the protection of these protected data specified in the act is also ensured in the proceedings of the authority.
(3) In the course of its proceedings, the authority shall process – in the manner and to the extent specified in the law – the protected data that are related to its proceedings or whose processing is necessary for the successful conduct of the proceedings.
(48) Pursuant to Section 28(1), the authority shall, upon request or ex officio, order the confidential treatment of the personal identification data and address of the client or other participant in the proceedings if: a) he or she may suffer serious adverse consequences due to his or her participation in the proceedings, or b) the confidential treatment of the data of the client or other participant in the proceedings has been ordered in another court or official proceeding that has been legally or finally concluded or is taking place in parallel and is known to the authority on the basis of the same facts. (49) Act V of 2013 on the Civil Code (hereinafter referred to as the Civil Code) 4:179. According to § (1)
, the grandparent, sibling and – if the parent and grandparent are not alive or are permanently prevented from maintaining contact, or do not exercise their right to maintain contact through their own fault – the sibling and spouse of the parent of the child are also entitled to maintain contact.
(50) According to § 17. (1) n) of the Gyvt., the tasks related to the child protection system regulated by this Act – in order to promote the child’s upbringing in the family, prevent and eliminate the child’s vulnerability – are performed by the capital and county government offices acting within the scope of their child protection and guardianship duties within the framework of the basic activity specified in the Act.
10
According to paragraph (2a) of the same section, the child welfare service provider
and the guardianship authority shall handle the data of the institution or person who has reported or initiated a complaint regarding child abuse or neglect in a confidential manner, even in the absence of a separate request to this effect.
(51) Pursuant to paragraph (2) of Section 8/C of the Act on Children, the guardianship authority shall ex officio ensure that the data of the institution or person who has reported or initiated a complaint regarding child abuse or neglect is handled in a confidential manner. The guardianship authority shall reject the client’s request for access to that part of the document containing the data to be handled in a confidential manner, from which a conclusion can be drawn about the institution or person who has reported or initiated the complaint.
(52) Act on Children According to Section 28 (1), the parent, the grandparent, the sibling, and – if the parent and the grandparent are not alive or are permanently prevented from maintaining contact, or do not exercise their right to maintain contact through no fault of their own – the sibling of the parent of the child and the spouse of the parent are also entitled to maintain contact with the child.
(53) According to Section 29 (1) of the Child Act, in the event of a dispute, the guardianship office – taking into account the provisions of Section 4:181 (2) of the Civil Code – shall decide on the maintenance of contact or its change at the request of either party, unless the determination of the maintenance of contact between the parent and the child falls within the competence of the court pursuant to Section 4:181 (1) or (4) of the Civil Code.
(54) According to Section 29/A. Pursuant to Section (1), the guardianship office shall primarily endeavour to arrange contact during a hearing, with an agreement between the parent or other person caring for the child (hereinafter referred to as: the person obliged to maintain contact) and the person entitled to maintain contact. Pursuant to Section (5) of the same section, in the absence of an agreement, the guardianship office shall decide in the best interests of the child, taking into account the fair interests and circumstances of the person entitled to maintain contact and the person obliged to maintain contact, as well as the child’s age, health and educational progress, based on the criteria specified in Section 4:181. (2) of the Civil Code, in accordance with the purpose of the contact. (55) In accordance with Section 29/A of the Children’s Act, According to Section (6), the operative part of the decision on the regulation of contact shall, in addition to the provisions of Section 14, include: a) the frequency and duration of continuous, periodic and supervised contact, the taking of the child abroad for a specified period of time, b) the place, time and method of handing over and returning the child, his/her personal documents, clothing and other items necessary for contact, c) – in the event of a request to this effect – the name of the person who will assist in the handing over and taking over of the child for contact pursuant to Section 29 (5), (56) According to Section 29/A (7) of the Act on Children, in the case of supervised contact, the guardianship office shall determine the location and frequency of contact and whether the meeting at the place of contact may take place in the presence and with or without the advice of a specialist supervising the contact. (57) According to Act XX of 1996 on the methods of identification replacing the personal identification mark and on the use of identification codes (hereinafter referred to as the Act),
Section 4 (1) A citizen shall be identified
a) by his/her natural personal identification data,
b) by data selected from the natural personal identification data in a necessary and appropriate manner according to the purpose of the data processing, or
c) in cases specified by law, by his/her family name and first name, and by the identification code specified in this Act
(hereinafter referred to as the methods of identification).
11
(2) A citizen may be required to use only one method of identification for the purpose of self-identification.
(4) Natural personal identification data shall be the citizen's
a) family name and first name, his/her birth family name and first name,
b) his/her place of birth,
c) his/her date of birth and
d) his/her mother's birth family name and first name.
I V. D ecision
(58) In the proceedings, the Applicants complained that the Respondent, in the official proceedings it conducted regarding the settlement of grandparent relations, unnecessarily and unlawfully disclosed their residential address data, which had been previously concealed from the Applicant1 and his spouse by the Maternal Grandparent, to the applicant in the main case, the Maternal Grandparent, and moreover, that it did not provide them with the possibility of requesting closed data processing, since in its outgoing documents informing about the commencement of the proceedings and also summoning the settlement hearing – the first – it had already – unlawfully – indicated the personal data affected by the infringement, with which, in their opinion, an unlawful data transfer was carried out.
(59) The residential address is considered personal data pursuant to Article 4(1) of the GDPR, and its transmission to a third party is considered data processing pursuant to Article 4(2) of the GDPR.
(60) It was not disputed in the proceedings that the Respondent could be considered a data controller in accordance with Article 4(7) of the GDPR in relation to the alleged unlawful data processing operation, nor that the Respondent was otherwise entitled to process the personal data of the Applicants – including their residential address – by law, or that the breached data disclosure was actually carried out by the Respondent. However, with regard to the processing of the Requested data, in accordance with the principle of being bound by the request, the Authority exclusively examined during its proceedings whether the inclusion and transmission of the Applicants’ residential address in the summons sent to the Maternal Grandparent was lawful.
(61) The fundamental condition for the lawfulness of data processing is the existence of an appropriate legal basis. The legal bases applicable to data processing are specified in Article 6(1) of the GDPR, from which the controller must choose the one to be applied for each data processing operation in order to ensure the lawfulness of the data processing. This provision therefore requires the controller to consider, before starting the data processing, which legal basis will be the most appropriate for the various data processing operations and, in accordance with the principle of accountability, to document the legal basis applied to each data processing operation in order to demonstrate lawfulness. However, the fact that the controller has an appropriate legal basis for accessing and storing personal data does not mean that the data must be included in a decision or forwarded on the basis of the same legal basis, and therefore it will be lawful. The lawfulness of data processing also requires that the data controller has an appropriate legal basis for the latter data processing operations.
(62) The Respondent referred to the indication of the applicant's residential address data in the summons order,
or its disclosure, in connection with the fact that in the official procedures initiated for the purpose of regulating the relationship, the residential address data of the clients plays a decisive role both in general (e.g. for establishing the competence, and as a mandatory decision element pursuant to Section 81 of the Civil Procedure Code,
as data necessary for identifying the client) and specifically (e.g. in designating the place of contact in the issue of the distance between the clients' places of residence), its indication in the documents is a mandatory content element, knowledge of which is also essential for the 12 clients with opposing interests, since they cannot make a substantiated substantive statement during the procedure without precise knowledge of it - as relevant information that grounds the decision.
(63) The Authority does not dispute that the guardianship authority is entitled to access and process the client's residential address data, nor that it is significant as a factor influencing the substantive decision in a guardianship authority proceeding in relation to the provisions invoked by the Applicant, in addition to determining the competence of the proceeding authority, and it agrees that the data included in the decisions must be accurate and up-to-date, as well as that it is essential that clients are aware of the relevant information on which the authority's decision is based.
(64) The Authority notes, however, that none of the provisions invoked by the Applicant
requires the authority to include all relevant data arising in the case
in all decisions or to forward it to all clients.
Section 81 (1) of the Ákr. requires the inclusion of data necessary for the identification of clients and the case
among the content elements of the decision, and does not specifically mention the residential address data.
In this regard, the Authority draws attention to the fact that in addition to the Ákr. and
other legal acts governing the case, the authorities must also take into account the provisions of the GDPR,
and therefore, based on Article 5 (1) c) of the GDPR – i.e. the principle of data minimization –
they must also ensure that the least possible personal data for client identification is included in the decision, as this interpretation is provided for in the Ákr. The Great Commentary on § 81 also confirms this. It should be emphasized that the principle of data economy requires the proceeding authority to indicate the narrowest possible range of personal data, even if the closed data management is not ordered either upon request or ex officio during the proceeding. (65) In relation to the argument that the residential address is a client identification data and thus a mandatory decision element, the Authority further states that it does not fall within the scope of natural personal identification data under the Personal Data Protection Act, although it can indeed help to identify the client. In the present case, however, other natural personal identification data already known to both client sides were available for identification, so indicating the residential address of the Applicants for this purpose was clearly unnecessary for the Respondent. This argument of the Petitioner cannot be accepted either because the petitioner in the main proceedings, the Maternal Grandparent, was also a client in the main proceedings, but with regard to the identification of the client concerned, the Petitioner did not consider it necessary to indicate the same data set in the summons sent simultaneously to the opposing clients, in which it also notified Petitioner1 and Petitioner1's spouse of the commencement of the proceedings. In these decisions, the Petitioner – although Section 81 of the Civil Procedure Code is also applicable to the petitioner in the main proceedings – considered the indication of the name and degree of kinship sufficient to identify the Maternal Grandparent as a client [“….-…. proceedings were initiated on … 2024. …,…”]. (66) In relation to the Applicant's argument that the residential address is a mandatory content element of guardianship authority decisions due to the type of the underlying case, the Authority also came to the position that the indication of the residential address of minors or their parents, which is undoubtedly of paramount importance to the authority in contact matters, is neither necessary nor an essential mandatory content element of procedural decisions issued as the first measure in the proceedings, and this cannot be concluded from the legal provisions invoked by the Applicant. (67) In the present case, the residential address of the Applicants was indicated in the summons issued immediately at the start of the proceedings. At the start of the proceedings, the guardianship authority aimed to attempt to reach an agreement between the opposing parties and to clarify the facts, so the residential address does not yet appear as a circumstance taken into account for the substantive decision, and therefore it is not significant in terms of establishing the other party's position. Among the provisions invoked by the Applicant, the residential address may be significant in determining the place of the child's transfer or return within the framework of contact, or the location of contact, but in this case, the necessity of this in the first summons to the settlement hearing is not justified. (68) In relation to the role of the residential address in determining jurisdiction, the Authority is of the opinion that it is sufficient to indicate in a procedural decision, including the present summons order, that the Respondent acts as the competent authority based on the place of residence of the parent exercising parental supervision of the children concerned, as the District Authority has already informed the Maternal Grandparent of in the order ordering the transfer, and in accordance with the principle of data economy, it is not necessary to indicate the exact residential address details – more detailed than the name of the settlement or the district of the capital – in the decision sent to the opposing party. (69) In the present case, in order to identify the case and the clients in the summons to the Maternal Grandparent, in accordance with the principle of data economy, the Authority considers that it would have been sufficient to indicate the names of the parties and one of the natural person identification data already known to the Maternal Grandparent in other ways, in accordance with the Personal Data Protection Act (an obvious choice in this regard would have been, for example, the name of his mother), especially considering that the opposing parties were notified of the proceedings at the same time as the summons, so that the Applicants had no opportunity to request the confidential treatment of the address previously unknown to the Maternal Grandparent, or to present a circumstance that would raise the question of the ex officio order for confidential data management. (70) Furthermore, the Authority considers that the Act on the Protection of Personal Data Protection Section 81 may be an appropriate legal basis for indicating the client's residential address in the decision, and thus indicating data beyond the data necessary for client identification "at most" violates the principle of data economy. However, in connection with the communication of the decision - if it is communicated not only to the data subject but also to the opposing client - not only the aforementioned principle may arise, but also the issue of harm due to the lack of legal basis, since the requirement of legality must be met at all stages of data processing. (71) The Authority notes that the subject of the case, the settlement of contact, requires special attention from the acting guardianship authority regarding the personal data disclosed to the opposing parties, especially if – as in the present case – it can be clearly established from the application itself that the relationship between the parties has been broken, the opposing party involved in the settlement of contact “does not speak” with the applicant for contact, in some cases they do not know each other’s addresses, and in this case the Maternal Grandparent does not know his own daughter’s family, and thus the children involved in the settlement of contact. The Authority also points out that the institution of the settlement of contact by the authority itself presupposes that the relationship between the parties involved in the procedure is conflictual, since otherwise there would be no need for the authority to proceed. In view of this, the Authority is of the opinion that the disclosure of personal data indicated in official decisions, such as the address, should not be decided solely on the basis of whether a request for closed data management has been received or whether circumstances have arisen that would give rise to its ex officio order. (72) Taking the above into account, the fact that no request for closed data management was submitted in the main case, or that no further circumstances giving rise to the ex officio order of closed data management are revealed from the request for contact (also due to the fact that it is not in the interest of the person requesting contact to report such information, as the Respondent itself pointed out), cannot fundamentally mean that the minors or the address of the parent(s) exercising parental supervision may be communicated to the
14
requester for contact without consideration, especially not in such a way that the guardianship authority only communicates the address in relation to one client side, while remaining silent about the address of the other client.
If the submission of the application for closed data management, or the possible reference to the circumstances giving rise to it, cannot take place in the first place because the acting guardianship authority has made the submission of the application for closed data management by its own measure ineffective, or has not provided the opportunity for the Applicants to refer to such circumstances that may exist and should be taken into account ex officio,
then, in the Authority's opinion, it is expressly undesirable to refer to the absence of these.
In view of this, the Respondent's defence that the disclosure of the Applicants' residential address data was lawful because they did not request closed data processing during the proceedings, neither when they were informed of the proceedings nor later, nor did they refer to any other circumstances to be taken into account ex officio in the context of closed data processing, in light of the fact that the Respondent itself admits that they did not have the opportunity to do so, because by the summons issued at the same time as the notification of the proceedings, it had already communicated the maternal grandparent's residential address data, which he had not known until then, cannot be upheld. (73) The Authority further notes in relation to the judgment rendered in the main proceedings that although the Judgment does not address whether it is necessary to indicate the residential address in a procedural decision, it does state that in the main case only a decision on supervised contact could be considered. In the Authority's view, in view of this, the Respondent had to take the children's residential address data into account – ex officio – in terms of the competence of the institution to be designated as the place of contact for the substantive decision, and the necessity of communicating the children's residential address data to the Maternal Grandparent could not have arisen as an issue a priori, and it was not relevant in relation to the Maternal Grandparent's right to make a statement as a client. (74) Given that the Respondent itself had already referred in its basic decision that it had to decide on supervised contact in the main case, its argument presented to justify the necessity of indicating the children's residential address data in the decisions made during the proceedings – although it may be valid in other cases – is not adequate in the present case. It should be further noted that although the Respondent argued that the relevant address information in the summons was necessary to determine its own jurisdiction, when amending the substantive decision made in the repeated proceedings due to the change in jurisdiction due to the applicants' move, it deemed the designation of the place of contact to be sufficient to determine jurisdiction, and omitted the indication of the children's precise and complete address information.
(75) According to the Authority, the Respondent failed to prove during the proceedings that it had an appropriate legal basis for communicating the Applicant's residential address data indicated in the summons order to the Maternal Grandparent, i.e. for the transfer of the data.
(76) In view of all this, the Authority could not accept the Respondent's argument that the indication of the Applicant's residential address data was necessary as a mandatory content element and - in the absence of a request or circumstance for closed data management - was therefore lawful in the summons order sent to the Maternal Grandparent. In this regard, the Authority shared the Applicant's position and concluded that the indication of the disputed data in the decision was unnecessary and their transfer to the opposing party was unlawful in the absence of an appropriate legal basis.
(77) Based on the above, the Authority granted the Applicants’ request and condemned the
Applicant, because by indicating the Applicants’ residential address in the summons sent to all clients for the settlement
negotiation, the
Applicant violated the principle of data protection under Article 5(1)(c) of the GDPR, and by
15 transmitting it in its entirety to the applicant in the main proceedings, it violated Article 6(1) of the
GDPR.
V. Other requests of the Applicants:
V.1. The Applicants requested that the Authority impose a data protection fine on the
Applicant and order the publication of its decision due to the above infringement.
(78) The application of these legal consequences does not directly affect the rights or legitimate interests of the Applicants, such decisions of the Authority do not create any rights or obligations for them, therefore, with regard to the application of these legal consequences, which fall within the scope of the enforcement of the public interest, the Applicants are not considered clients pursuant to Section 10 (1) of the Act. Since they do not comply with Section 35 (1) of the Act, there is no place to submit an application in this regard, these parts of the submission cannot be interpreted as an application. (79) C-768/21 of the ECJ. According to paragraph 41 of the judgment in case 41, neither Article 58(2) nor Article 83 of the GDPR can be inferred from that the supervisory authority is obliged to adopt corrective measures, in particular to impose an administrative fine, in every case where it finds an infringement, since in such circumstances it is obliged to react appropriately in order to remedy the deficiency found. A person who has lodged a complaint and whose rights have been infringed does not have a subjective right to have the supervisory authority impose an administrative fine on the controller.
V.2. The Applicants requested that the Authority prohibit the Applicant from committing a similar infringement in the future.
(80) A decision prohibiting any processing or transfer of data at any time in the future, without any reason, cannot be requested from the Authority in a general manner.
(81) Such a decision would not be possible because it would be contrary to the General Data Protection Regulation. According to the General Data Protection Regulation, the controller may not only transfer the personal data of the data subject to a third party with the consent of the data subject, but also on other legal grounds, in some cases on the basis of legitimate interests or on the basis of a statutory provision, and a data protection authority cannot prohibit, for example, mandatory data processing based on the law. (82) With regard to the prohibition of the processing of personal data for the future, the Authority has established that the request is directed at an uncertain future event, in relation to which neither the scope of the data to be processed in the future nor its legal basis can be determined, so it cannot be excluded that their processing would be carried out lawfully with an appropriate legal basis, just as it cannot be said that it would be carried out unlawfully and without a legal basis. Therefore, the prohibition of this cannot be the subject of an official procedure, and no substantiated decision can be made in this regard.
VI. Legal consequences
(83) The Authority, on application pursuant to Article 58(2)(b) of the General Data Protection Regulation, condemns the Respondent because it included the Applicants’ residential address in the summons to the settlement hearing in a manner contrary to the principle of data economy and communicated it to the Maternal Grandparent without legal basis, thereby violating Article 5(1)(c) and Article 6(1) of the General Data Protection Regulation.
(84) Pursuant to recitals (148) and (150), Article 58 and Article 83(2) of the General Data Protection Regulation, the Authority is entitled to decide, ex officio 16 , in its discretion, on the effective, proportionate and dissuasive measures to be taken against the controller in order to protect personal data, and whether, instead of or in addition to such measures, a sanction, such as an administrative fine, should be imposed, and, if so, on the amount thereof. (85) The Authority nevertheless examined ex officio whether it was justified to impose a data protection fine on the Applicant, to publish the decision or to apply another legal consequence in order to prevent future infringements. (86) Regarding the applicable sanctions, the Authority considered all the circumstances of the case on the basis of Article 83(2) of the General Data Protection Regulation and concluded that in the case of the infringement revealed during the present proceedings, considering that the Applicant committed the infringement for the first time, the condemnation, or rather the publication of the decision with the identification data of the Applicant, while redacting the identification data of the Applicants, is a proportionate and sufficiently dissuasive legal consequence, therefore, in accordance with Section 61(1)(a) of the Data Protection Act, it refrained from imposing a fine and decided to publish the decision on the basis of Section 61(2)(b) and (c) of the Data Protection Act. The publication is justified on the one hand by the fact that the decision was made in connection with the activities of a body performing a public task, and on the other hand by the following circumstances assessed as aggravating factors in terms of the gravity of the established infringement:
- the data processing in question concerns minors;
- although the residential address is not special personal data, at the same time, considering the nature of the main case, its disclosure to the opposing party may entail a high risk, depending on the nature and depth of the conflict between the parties and the habits of the parties;
- the infringement cannot be reversed by disclosing the residential address, as long as the person concerned does not change the disclosed residential address, it will be known to the recipient of the data disclosure.
(87) The Authority assessed the fact that in the amending decision taken in the repeated procedure, the Respondent did not indicate the place of residence of the Applicants, and included only the place of residence already known to all parties as the address data, and the name of the settlement as part of the place of residence data, in the Applicant's favour from the perspective of legal consequences. However, taking into account that it could be concluded from the Respondent's statement that it generally applies the data processing practice resulting in the data transfer complained of in this case, the Authority, in order to avoid future infringements, ex officio orders the Applicant to bring its data processing into line with the provisions of the General Data Protection Regulation, paying particular attention to compliance with the principle of data economy, i.e. to ensure that the decisions it makes are as include the least personal data in its decisions, considering in each decision which data from the data at its disposal and otherwise lawfully processed by it is necessary and appropriate to include in the document, and separately examines the existence of a legal basis for transmitting the data included in the copies of documents sent to the opposing party. To this end, the Authority expects the Applicant to create internal regulations. (88) During the procedure, the Authority exceeded the one hundred and fifty day administrative deadline set out in Section (1) of the Information Act, therefore, pursuant to Section 51 b) of the Administrative Procedure Act, it will pay the Applicants ten to ten thousand forints – according to the Applicant’s choice to be indicated in writing – by bank transfer to their bank accounts or by postal order. VII. Other issues (89) Pursuant to Section 38(2), the Authority is responsible for monitoring and facilitating the exercise of the right to the protection of personal data and to access data of public interest and made public in the public interest, and for facilitating the free flow of personal data within the European Union. Pursuant to Section (2a) of the same Section, the tasks and powers assigned to the supervisory authority in the General Data Protection Regulation 17 shall be exercised by the Authority in respect of legal entities under the jurisdiction of Hungary in accordance with the provisions of the General Data Protection Regulation and this Act. The Authority’s competence shall extend to the entire territory of the country.
(90) The decision is based on Sections 80-81 of the Act on the Protection of Personal Data and Section 61(1) of the Information Act. The decision shall become final upon its publication pursuant to Section 82(1) of the Act on the Protection of Personal Data.
(91) The Act on the Protection of Personal Data Pursuant to Section 112, Section 116(1) and (4) d) and Section 114(1)
, the decision and the termination order may be appealed through administrative litigation.
(92) The rules of administrative litigation are determined by Act I of 2017 on the Code of Administrative Litigation (hereinafter: the Kp.). Pursuant to Section 12(1) of the Kp., administrative litigation against the decision of the Authority falls within the jurisdiction of the court, and the Metropolitan Court has exclusive jurisdiction over the lawsuit pursuant to Section 13(3)(a) aa) of the Kp.
. Pursuant to Section 27(1) b) of the Kp., legal representation is mandatory in lawsuits falling within the jurisdiction of the court. The Kp. According to Section 39 (6), the filing of a claim does not have a suspensive effect on the entry into force of the administrative act.
(93) Pursuant to Section 29 (1) of the Code of Civil Procedure and, in view of this, Section 608 of the Code of Civil Procedure, the legal representative of the client is obliged to maintain electronic communication in accordance with Section 19 (1) (b) of the Civil Procedure Act.
(94) The time and place of filing a claim are determined by Section 39 (1) of the Code of Civil Procedure.
The information on the possibility of requesting a hearing is based on Section 77 (1)-(2) of the Code of Civil Procedure. The amount of the administrative litigation fee is determined by Section 45/A. (1) of Act XCIII of 1990 on Fees (hereinafter: Itv.). The party initiating the proceedings is exempted from the advance payment of the fee by Section 59 (1) and Section 62 (1) h) of the IT Act. (95) If the Applicant fails to provide adequate proof of compliance with the prescribed obligation, the Authority shall consider that the obligation has not been fulfilled within the deadline. According to Section 132 of the Act, if the Applicant has failed to comply with the obligation set out in the Authority’s final decision, it shall be enforceable. The Authority’s decision shall become final upon its notification pursuant to Section 82 (1) of the Act. Pursuant to Section 133 of the Act, enforcement shall be ordered by the authority that made the decision, unless otherwise provided by law or government decree. Pursuant to Section 134 of the Act, enforcement shall be carried out by the state tax authority. The Infotv Pursuant to Section 61 (7)
of the Act, the Authority shall implement the decision in respect of the obligation to perform a specific act, to conduct a specific act, to tolerate or to cease it.
Budapest, “according to the electronic signature and time stamp”
Dr. habil. Attila Péterfalvi
President
c. university professor
Retrieved from "https://gdprhub.eu/index.php?title=NAIH_(Hungary)_-_4094-1/2026&oldid=51961"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki