NAIH (Hungary) - NAIH-10362-1/2025
From GDPRhub
| NAIH - NAIH-10362-1/2025 | |
|---|---|
 | |
| Authority: | NAIH (Hungary) |
| Jurisdiction: | Hungary |
| Relevant Law: | Article 5(2) GDPR Article 6(1) GDPR Article 21(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 15.04.2026 |
| Fine: | 1,000,000 HUF |
| Parties: | n/a |
| National Case Number/Name: | NAIH-10362-1/2025 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Hungarian |
| Original Source: | Nemzeti Adatvédelmi és Információszabadság Hatóság (in HU) |
| Initial Contributor: | dt |
The DPA fined a company HUF 1,000,000 (approximately €2,750) for contacting a data subject on their phone number (which was provided by their employer) for debt collection purposes despite the data subject’s prior objection to such processing.
English Summary
Facts
An individual (the data subject) filed a complaint with the Hungarian DPA for the unlawful storing, processing and use of their phone number by a company (the controller).
The data subject claimed that the controller obtained the phone number during a call to the controller’s customer service despite the data subject’s objections to the use of the phone number as contact information since it was provided by the data subject’s employer. Despite all of this, the controller contacted the data subject on this phone number.
The data subject objected to the processing of their phone number by the controller. The controller informed the data subject that it complied with the request and deleted the phone number.
However, the controller also stated that it retained the phone number for the purposes of handling complaints under Article 6(1)(c) GDPR and the recording of customer service calls under Article 6(1)(f) GDPR.
The controller explained that it contacted the data subject on the phone number due to the data subject’s claim that they did not receive the controller’s letters by mail. The controller’s representative sought to obtain contact information from the data subject in order to ensure that the debt collection process for which they contacted the data subject would not have negative consequences for the latter.
Holding
The DPA held that the controller violated the principle of accountability in Article 5(2) GDPR by providing inconsistent and contradictory statements regarding the processing of the phone number and having an unclear processing procedure, thus making it impossible to clarify the facts of the situation.
Furthermore, the DPA held that the controller violated Article 21(1) GDPR by failing to inform the data subject about the processing of the phone number for debt collection purposes on the legal basis of legitimate interest, as well as failing to inform them of the data subject rights they may exercise.
Therefore, the DPA fined the controller HUF 1,000,000 (approximately €2,750) and ordered future compliance with Article 5(2) GDPR and Article 21(1) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.
……………………………………………………………………………………………………………………………………………………………………….
1055 Budapest Tel.: +36 1 391-1400 naih.hu/adatkezelesitajekoztatok
Falk Miksa utca 9-11. KR ID: 429616918
ugyfelszolgalat@naih.
hu
Case number:
History:
NAIH-10362-1/2025.
NAIH-2533/2024.
NAIH-6610/2023.
Subject:
decision in a data protection authority procedure initiated upon request
Administrator: […]
DECISION
The National Authority for Data Protection and Freedom of Information (hereinafter: Authority) makes the following decision in the data protection authority procedure initiated on 17 July 2023, based on the request of the applicant […] (address: […].; hereinafter: Applicant), against […] (registered office:[…].; hereinafter: Applicant) regarding the unlawful processing of the Applicant’s telephone number data and - the right to object pursuant to Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR or General Data Protection Regulation):
I. In its decision, the Authority grants the Applicant’s request
and establishes that the Applicant negligently violated
Article 6(1) of the GDPR,
Article 5(2) of the GDPR, and
Article 21(1) of the GDPR during its data processing of telephone number data.
II. In its decision, the Authority obliges the Applicant to pay a data protection fine of
1,000,000 HUF, i.e. one million HUF, for its violations under Article 5(2) of the GDPR and Article 21(1) of the GDPR.
The data protection fine must be paid within 30 days of the decision becoming final to the Authority’s centralized revenue collection account (10032000-01040425-00000000 Centralized collection account IBAN: HU83 1003 2000 0104 0425 0000 0000) within 30 days of the decision becoming final. When transferring the amount, reference must be made to the NAIH-10362/2025. BÍRS. number.
2
If the Respondent fails to comply with its obligation to pay the fine by the deadline, it shall be obliged to pay a late payment surcharge. The rate of the late payment surcharge shall be the statutory interest, which shall be equal to the central bank base interest rate valid on the first day of the calendar half-year affected by the delay. In the event of non-payment of the fine and the late payment fee, the Authority shall order the enforcement of the decision.
There is no administrative remedy against this decision, but it may be challenged in an administrative lawsuit by means of a statement of claim addressed to the Metropolitan Court within 30 days of its notification. The statement of claim must be submitted to the Authority, electronically1, which shall forward it to the court together with the case documents. The request for a hearing must be indicated in the statement of claim. For those not entitled to full personal exemption from fees, the administrative lawsuit fee is HUF 30,000, and the lawsuit is subject to the right to record the subject-matter fee. Legal representation is mandatory in the procedure before the Metropolitan Court.
JUSTIFICATION
I. Procedure
(1) At the request of the Applicant, Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information Act (hereinafter: Infotv.) on the basis of Section 60 (1), a data protection authority procedure was initiated against the Applicant on July 17, 2023, after the Applicant sent the additional statement and document necessary for its application in response to the order NAIH-6610-2/2023. sent with reference to Section 44 of Act CL. of 2016 on General Administrative Procedure (hereinafter: Ákr.) calling for the correction of deficiencies.
(2) The Authority called on the Applicant to make a statement with reference to Section 63 of the Ákr. for the first time in the document filed under number NAIH-6610-5/2024., to which the Applicant responded within the deadline in the document filed under number NAIH-6610-6/2023.
(3) In order to clarify the facts, the Authority called on the Respondent to make a statement for the second time - in the document filed under NAIH-2533-1/2024. - to which the Respondent responded within the deadline in the document filed under NAIH-2533-2/2024.
(4) In order to clarify the facts, the Authority called on the Respondent to make a statement for the third time - in the document filed under NAIH-2533-4/2024. - to which the Respondent responded within the deadline in the document filed under NAIH-2533-8/2024.
(5) In the order No. NAIH-2533-4/2024., the Authority decided on the treatment of the documents sent by the Respondent in copies as business secrets or on the refusal to treat them as business secrets.
(6) The Authority notified the parties in documents NAIH-2533-11/2024. and NAIH-2533-12/2024. of the completion of the evidentiary procedure and that they could make a statement. The Respondent exercised its right to inspect the documents, and none of the parties exercised their right to make a statement.
1 The form called NAIH_KO1 is used to initiate the administrative lawsuit: NAIH KO1 form (2019.09.16) The form can be completed using the general form-filling program (ÁNYK program). The form is available and can be downloaded from the Authority’s website: https://www.naih.hu/kozig-hatarozat-birosagi-felulvizsgalata
3
II. Clarification of the facts
II.1. The Applicant’s request (NAIH-6610-1/2023.) and its correction (NAIH-6610-3/2204. and NAIH-6610-4/2024.)
(7) On 30 June 2023, the Applicant initiated data protection authority proceedings and requested a declaration that the Applicant had violated the provisions of the General Data Protection Regulation by storing, processing and using the Applicant’s mobile phone number 0670 […] without his consent and despite his express request. The Applicant was granted the right to use this phone number by a company (his employer/employer).
(8) According to the Applicant, the Applicant could not have accessed the mobile phone number 0670 […] during the enforcement data collection, as it is a company phone number. According to the Applicant, the Applicant obtained the mobile phone number 0670 […] during a customer service telephone consultation initiated by the Applicant. The Applicant highlighted that from March 28, 2022, during every telephone consultation, he indicated to the Applicant that he would not store his company telephone number under any circumstances, but at the same time, the Applicant’s administrator called the Applicant on this number at 9:29 on June 15, 2022.
(9) The Applicant attached the following documents to the application in copies:
- transcripts of the telephone conversations between the Applicant and the Applicant with reference “2022. 05.12. 12:20 minutes” and “2022.06.15. 9:29 minutes” (both telephone conversations took place on the Applicant’s business telephone number 0670 […]),
- the Applicant’s letter of 30 November 2022, registration number […], on the results of the investigation of the complaint made by the Applicant.
(10) The Applicant attached a copy of the usage agreement concluded with the employer of the business telephone number 0670 […] in its submissions with file numbers NAIH-6610-3/2204 and NAIH-6610-4/2024.
(11) The excerpt of the telephone conversation between the Applicant and the Respondent on 2022. 05.12. 12:20 regarding the handling of telephone number data:
“[…] Respondent: OK, thank you very much, your identification has been successful.
I don’t see a telephone contact marked. Would you like to provide contact information?
Applicant: I don’t want to provide a telephone contact information.
Respondent: Okay, this debt is related to a current account […]”
(12) The excerpt of the telephone conversation between the Applicant and the Respondent on 2022. 06.15. The part of the telephone conversation extract at 9:29 regarding the handling of telephone number data:
ˇ”[…]
Requester: Good day, I am … calling from […]. Is it convenient for you for a few minutes now, can we make an appointment?
Requester: It is convenient, but I did not provide this telephone number for an appointment.
Requester: Here you go?
Requester: The time is convenient, but I did not provide this number for an appointment.
4
Requester: Yes, yes, uh, we will arrange this right away. First of all, I would like to inform you that the call will be recorded, the audio recording will be kept for 5 years, and upon request, we will ensure that it can be listened to. (…)”
“[…] Requester: Okay, thank you very much, yes, this address has been given. I have a number 20 given […].
Requester: I will not provide any contact information, okay?
Requester: However, this is not good phone number.
Applicant: But I did not give my consent to this phone number that we are talking about now.
Applicant: No, it is not recorded as a contact number, I was just trying to reach you somehow, because I received the letter, you did not give a phone number in it. […]”
“[…] Applicant: You do not give a phone number either, if there is any such problem, so that I can reach you.
Applicant: I will call you, I am very happy about it, but legally you have crossed a line and therefore I could report you. You know about it, I ran a Call Center.
Applicant: Sir, your phone number is not recorded in the case, I tried to catch up with you because I saw that you called about it last time.
Applicant: But then you have no right to it either. But you know that you have no right to it, you know! I do not like these unsolicited things and I do not ask for them and thank you very much for your administration.
Applicant: I will not record your phone number. […]”
(13) Section III of the Applicant’s letter dated 30 November 2022, registration number […], contains the following in relation to the Applicant’s objection to the processing of his telephone number data:
“[…] Our Company examined your request containing the objection to the processing of your telephone number in accordance with the General Data Protection Regulation. As a result of the examination, our Company concluded that our Company can also comply with the obligation to cooperate by using other available means of contact, therefore, in view of this, our Company, fulfilling your request, deleted your telephone number data in both cases.[…]”
II.2. The Applicant’s first statement (NAIH-6610-6/2023.)
(14) The Applicant stated that as a result of the Applicant’s objection, it deleted the telephone number 0670 […] as contact information, and informed the Applicant of this in its response letter dated 30 November 2022 and 5 January 2023, and drew the Applicant’s attention to the availability of its data processing information. At the same time, the Applicant stated that it continues to record the Applicant’s telephone number data in connection with complaint handling and conversations with the telephone customer service. The processing of data for the purpose of complaint handling is subject to the legal obligation pursuant to Article 6(1)(c) of the GDPR, Section 288(2) of Act CCXXXVII of 2013 on credit institutions and financial undertakings, and to Regulation (EC) No. 46/2018. (XII.17.) MNB Decree. The recording of telephone conversations is carried out on the basis of Article 6 (1) f) of the GDPR. The Applicant has attached the relevant balancing test.
(15) The Applicant informed the Authority that in the case of telephone numbers processed for the purpose of contact, the Applicant applied the legitimate interest legal basis before 2 May 2023. From 2 May 2023, the Applicant will process telephone numbers based on consent after the first contact, if the customer consents to the processing of the telephone number.
5
(16) The Applicant also attached a copy of the transcripts sent by the Applicant – cited in paragraphs (11) and (12). In this regard, the Applicant stated that, based on the transcript of the telephone conversation of 15 June 2022, the administrator called the Applicant because the Applicant indicated that he had not received the letters sent by the Applicant by post. During the telephone conversation, the administrator wanted to discuss contact details with the Applicant. The Applicant's contact number was a telephone number with a prefix of 20, but the clerk could not reach the Applicant on that telephone number ("I have a number with a prefix of 20, the [...]". However, this is not good, this is the telephone number." - says the clerk). The clerk then called the Applicant on the number 70.
(17) The Applicant stated that in the Applicant's case No. […]28 (overdraft agreement), no telephone number was recorded. In the case No. […]67 (personal loan agreement), two telephone numbers were recorded on 10.10.2015 and 19.02.2018, which came from the assigning bank. The Applicant stated in the same statement that the two numbers received from the assigning bank were deleted in November 2022, about which the The Applicant was informed in the letter with the registration number […].
(18) The Applicant stated that it does not manage a telephone number for the purpose of maintaining contact with the Applicant and attached the screenshots taken in this regard to its statement.
II.3. The Applicant’s second statement (NAIH-2533-2/2024.) and the Authority’s order on treatment as a business secret (NAIH-2533-4/2024. no.)
(19) The Applicant stated, at the express request of the Authority, that it requested the following documents to be treated as business secrets:
•
balance of interests test for recording telephone conversations,
•
screenshot of a professional system,
•
management of telephone numbers for the purpose of managing claims, balance of interests test for telephone inquiries and call reception,
•
data protection regulations,
•
instruction No. 15 on the procedure for handling complaints Appendix,
•
the balancing test for the processing of the data subject's telephone number for the purpose of contacting.
(20) The Authority granted the following documents from the above-mentioned documents to be treated as business secrets:
•
a screenshot of the professional system,
•
Appendix 15 of the instruction on the procedure for handling complaints.
(21) The adequacy of the documents sent by the Applicant is not the subject of the present proceedings.
II.4. Third statement of the Applicant (NAIH-2533-9/2024.)
(22) The Applicant stated that on 15.06.2022. he called the Applicant on the telephone number 0670 […]. The Applicant further stated that the aforementioned call was preceded by the Applicant's announcement - made on the Applicant's telephone customer service - that the
6
Appendix did not receive his letters sent by post. According to the Applicant, the administrator wanted to agree on the contact details with the Applicant during the telephone conversation in order to ensure that the claims management process would not have any negative consequences for the Applicant. The Applicant emphasized that since the Applicant’s 0670 […] telephone number data, which was processed for claims management purposes, was deleted as a result of his protest, it is no longer possible to reconstruct the source of this data. However, the Applicant assumes that it was used from the documentation recorded during the previous complaint management process. The Applicant also indicated in its statement that it continues to process the Applicant’s 0670 […] company telephone number for complaint management purposes.
(23) In connection with the telephone conversation with the Applicant on 15.06.2022, the Applicant highlighted that an individual administrator error had occurred in the case, a systemic there is no error, the administrator attempted to contact the Applicant in order to fulfill the obligation of cooperation, taking into account the interests of the Applicant. The Applicant submitted that it processes personal data for which it has an appropriate legal basis under the GDPR, that no telephone number data was processed for a different purpose, and that no relevant procedure was established.
(24) The Applicant further submitted that the Applicant’s 0620[…] telephone number, mentioned by the Applicant’s administrator, was processed for the purpose of claim management on the legal basis of legitimate interest. In relation to the 0620[…] telephone number, the Applicant submitted that as a result of the Applicant’s objection to data processing, the telephone number data was deleted, therefore it is not possible to reconstruct the source of the data. The Applicant assumes that the Applicant’s 0620[…] telephone number was transferred during the assignment of the claim.
(25) The Applicant submitted that that the case forming the basis of the present proceedings falls within the same period as the data processing examined in Decision No. NAIH-4783-1/2022 dated 19 April 2022. In this decision, the Authority condemned the Respondent for its practice in relation to the processing of telephone number data and found that telephone number data may only be lawfully processed for the purpose of claim management on the basis of Article 6(1)(a) of the GDPR. The Respondent subsequently changed its practice and, from 2 May 2023, it will only use the legal basis under Article 6(1)(f) of the GDPR for the processing of telephone numbers for the purpose of claim management until the first contact (180 days after the assignment), and will only process this data thereafter if the data subject has expressly consented to it.
II.5. The Respondent submitted as Annex 3 to its Declaration No. NAIH-6610-6/2023 balance of interests test for the processing of telephone number data (dated: 30 March 2021)
(26) “The purpose of the data processing is therefore to contact the data subjects by telephone, to receive telephone calls […] for the purpose of collecting and enforcing claims against the data subject, and to maintain contact.”
(27) “The legitimate interest of […] as a data controller is to enforce its existing claims and to successfully collect them, which requires the registration of the data subject’s telephone number and contacting them by telephone, as well as receiving incoming telephone calls, given that without their management, claims management would not achieve its purpose. Without data management, the efficiency of claims management may decrease, the lack of contact and information due to the lack of a telephone number may lead to consumer complaints, and in the absence of an accurate telephone number, […] would be hindered in enforcing its rights and
7 in fulfilling legal obligations. In order to enforce the claim, it is necessary for […] to have an appropriate and accurate telephone number. In the absence of a telephone number, the claims management process could be disproportionately prolonged and costly. […]”
(28) […] “Without the management of the telephone number, the claims management process would be hampered, and in many cases, contact with the data subject, and thus ultimately the collection of the claim, would not be achieved purpose. If the data subject is proven to be unreachable at his known address (receipt of return is returned as “addressee has moved”, “address not identifiable”, “delivery obstructed”, “addressee unknown”), then contacting the data subject cannot be ensured otherwise. In the absence of appropriate address data, […] would not be able to contact the data subjects. It is important to highlight that in many cases the data subject can intentionally prevent a visit to the address, thereby making the collection of the claim impossible.[…]”
(29) […] “Contact by telephone allows lay persons who are less experienced in claims management activities, do not know the relevant terms, and who are not able to read or write, to receive immediately tailored, understandable information and guidance. […]”
(30) In addition to the above, the Respondent emphasized in its balancing of interests that it makes all important information available to the data subjects during telephone contact, as well as the obligation of cooperation under civil law, which is incumbent on both parties. The Respondent also emphasized that the obligation of cooperation also applies to contact.
(31) The Applicant referred to the recommendation and guidelines of the Hungarian National Bank (hereinafter: MNB) and highlighted that, as stated in Recommendation No. 2/2019 on debt management activities towards consumers and Recommendation No. 1/2016 (III.11.) MNB on the recovery of residential mortgage loans in arrears, contacting by telephone is a method of contact accepted by the MNB. The Applicant further highlighted that Recommendation No. 10/2016 on the application of consumer protection principles and Recommendation No. 9/2020 MNB repealing it generally set expectations regarding the financial institution system, including the correct information of customers, which, in the Applicant’s view, also justifies the processing of telephone number data, as this facilitates efficient and rapid information and direct communication.
(32) Following the above, the Respondent also emphasizes that since this data processing is a common practice in debt management, the Respondent would be at a market disadvantage if it did not follow this.
(33) In connection with the interests of the data subjects, the Respondent emphasizes that this data processing is also in the interests of the data subject, since the purpose of the data processing is also to reach an agreement between the parties. If this does not take place in the “legal phase”, it may even be subject to enforcement proceedings, which is lengthy and costly. The Respondent notes in its balancing of interests that “the data processing adversely affects the rights of the data subject in that their right to dispose of their personal data is restricted. However, this is done proportionately, to the extent necessary to achieve the purpose.”
(34) The Respondent also emphasizes in its balancing of interests that “the data subjects can count on the data processing because such data processing can be considered as usual in the event of non-payment of an outstanding debt.”
8
(35) The Respondent further highlighted that the data subject is entitled to exercise the data subject rights specified in the GDPR in relation to data processing. In this regard, the balancing of interests does not contain a description of when the data may be deleted in such a case, the balancing of interests only contains the provisions of the GDPR.
(36) In the balancing of interests, the Applicant states that “during the telephone inquiry, it indicates to the data subject that if he/she does not wish to be contacted by telephone, he/she should end the call and choose to deal with the matter in person or by post.” Furthermore, data processing is only carried out for a “limited period”, 8 years, in accordance with Section 169 (2) of Act C of 2000 on Accounting, and employees refrain from exerting psychological pressure on the data subjects when making contact.
II.6. Resolution No. NAIH-4783-1/2022 (dated: 2022. 04. 19.) and the balancing of interests sent in the course of its implementation (dated: 2022.09. 29.)
(37) NAIH-4783-1/2022 referred to by the Applicant. In its decision no. the Authority found that the Respondent had infringed Article 5(2) and Article 6(1) of the GDPR by processing the personal data of the data subject, including his/her telephone number, on an inappropriate legal basis. In the course of the execution of the decision, the Respondent notified the Authority that it had prepared the balancing of interests – inter alia – in connection with the processing of telephone number data, which it attached and referred to in the present case.
(38) The Authority established the following in relation to the balancing of interests of the Respondent regarding the processing of telephone number data for the purpose of debt management, about which the Respondent was informed on 29. 09. 2022 by NAIH-4783-14/2022. no. notified in a document:
“According to the balancing test submitted by […], the processing of the telephone number is necessary for debt collection in order to prevent the initiation of legal proceedings, the aim is to determine the debtor’s ability to bear the burden and to develop a solution acceptable to the debtor.
If the debtor requests that calls be omitted, withdraws his consent for this purpose, the telephone number transferred during the assignment – previously provided during the loan application and processed by the assignor based on consent – can no longer be used for telephone contact and must be deleted because its processing has become purposeless and without legal basis.
The Authority does not share the position described in the balancing test of […], since, taking into account the principle of data economy set out in Article 5(1)(c) of the GDPR, the fundamental question is whether the telephone number is necessary for debt collection or not. In this regard, the Authority’s opinion is as follows:
-
The rights of natural persons with regard to the processing of personal data Pursuant to Article 5(1)(c) of Regulation (EU) 2016/679 on the protection of the personal data of individuals and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the GDPR), only personal data that is strictly necessary for the enforcement of the claim may be processed by debt collection companies. The telephone number does not constitute such personal data.
9
-
On the one hand, there is no sectoral legislation that would specify in detail the scope of personal data that can be processed/used in the debt collection procedure, the conditions for processing, receiving and transmitting the data.
-
Based on Act L. of 2009 on the payment order procedure and Act LIII of 1994 on judicial enforcement, referred to in the balance of interests prepared for the initiation and conduct of non-litigious proceedings and the processing of data during the conduct of enforcement proceedings, the telephone number (and the e-mail address), as this requires the debtor's identification and address data, as well as data ensuring the existence of the claim.
-
[…] claims in its balance of interests that the telephone number managed on the basis of legitimate interest is necessary to prevent the initiation of legal proceedings against the debtor, i.e. the lack of a telephone number (and thus telephone contact) is a direct consequence of their company having to initiate legal proceedings. The Authority does not consider this to be correct, as they can also contact the debtor by post, and legal proceedings can also be prevented in this way, given that any settlement must be documented and concluded on paper. The interest of the data controller is in any case preceded by the debtor's right to choose written contact - including unofficial postal communication - and therefore to consider written communication appropriate, and therefore to object to the management of the telephone number.“
(39) Based on all of this, the Authority did not accept the balancing of interests and the legal basis of legitimate interest, and did not consider the decision to be fulfilled. The Applicant then stated on 11.10.2022 that it would review its practice regarding the management of telephone numbers. The Authority accepted this statement in its response sent on 16.2.2023.
II.7. The established facts
(40) The Applicant is the user of the telephone number 0670[…] subscribed by his employer. An agreement was reached between the Applicant and his employer on this. The Applicant called the referenced telephone number during the telephone contact with the Applicant on 15.06.2022.
(41) It can be established from the transcripts of the telephone conversations that during the telephone conversation initiated by the Applicant on 12.05.2022, the Applicant inquired about future telephone contact - to which the Applicant indicated in response that he did not wish to provide telephone contact information -, the Applicant nevertheless contacted the Applicant on 15.06.2022, first on the telephone number 0620[…] and then on the telephone number 0670[…]. During this telephone conversation, the Applicant stated that he did not give his consent to the management of his telephone number 0670[…], or to the recording of any telephone contact information.
(42) The statements made by the Applicant were clearly aimed at not storing his telephone number and not using it for contact purposes, which can be interpreted as not giving consent or objecting to data processing. The contents of the telephone transcript of 15.06.2022 are to be assessed as the exercise of the right to object pursuant to Article 21 of the GDPR by the Applicant, therefore the Applicant should have considered the request made during the telephone conversation as an objection, since according to his statement, he based the processing of telephone numbers for contact purposes during this period on the legal basis of legitimate interest.
10
(43) The administrator’s response to the Applicant’s requests was that he did not record the telephone number, and that no contact number was recorded. In this regard, the Applicant assumed in his statement in the present proceedings that the Applicant’s telephone number 0670[…] was used from the documentation recorded during the previous complaint handling process.
(44) Annex to application no. NAIH-6610-1/2023 and annex to application no. NAIH-6610-6/2023. From the transcripts of the telephone conversation dated 15.06.2022 as per Annex No. 5 of the submission, it can be established that the Applicant was not informed during the telephone conversation that the Applicant was not processing the telephone numbers for the purpose of claim management based on the presumed consent of the caller, but on legitimate interest, nor about what data subject rights the Applicant can exercise and how (specifically, e.g. the right to object in the case of a legitimate interest legal basis), nor about the fact that the Applicant is storing and preserving the telephone number based on a legal obligation in terms of complaint management, and on a legitimate interest legal basis in terms of the purpose of preserving audio recordings as evidence, among other things. Furthermore, the Applicant's employee did not evaluate what was said on the telephone as a protest and did not take appropriate measures.
(45) However, the Applicant’s telephone number data was deleted, following an electronic request received on 2022.11.02, as the Applicant objected to the processing of his telephone number data in this way. According to the Applicant’s response to the Applicant dated 30 November 2022 with the registration number […], the request containing the objection was examined, and the request was fulfilled and the telephone number data was deleted in both cases.
(46) The Applicant also stated to the Authority that it deleted the telephone number as contact data, but that it continued to record it in connection with complaint handling and conversations with the telephone customer service. The Applicant confirmed to the Authority with a copy of the screenshot that it does not manage a telephone number for the purpose of contact in relation to the Applicant.
(47) The Respondent was unable to provide a single answer regarding the source of either telephone number data, as both telephone number data were deleted from its system on 30 November 2022 as a result of the Applicant’s objection.
(48) The Respondent used a legitimate interest legal basis for telephone numbers processed for contact purposes before 2 May 2023. It also based its data processing for claims management purposes on a legitimate interest in relation to the Applicant’s telephone numbers, until it deleted the Applicant’s telephone number on 30 November 2022 following the Applicant’s objection.
III. Applicable legal provisions
(49) Pursuant to Article 2(1) of the GDPR, the GDPR shall apply to the data processing in this case.
(50) The GDPR applies to data processing falling within the scope of the GDPR. According to Article 2(2), the GDPR shall apply with the additions set out therein.
(51) Article 4(1) of the GDPR defines ‘personal data’ as any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, a number, location data, an online identifier or to one or more factors specific to the physical, physiological,
11
genetic, mental, economic, cultural or social identity of that natural person.
(52) According to Article 4(2) of the GDPR, ‘processing’ means any operation or set of operations which is performed on personal data or on data sets, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
(53) Article 4(7) of the GDPR defines the concept of controller as “the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of the processing are determined by Union or Member State law, the controller or the specific aspects of the designation of the controller may also be determined by Union or Member State law.”
(54) Pursuant to Article 5(2) of the GDPR, the controller shall be responsible for compliance with paragraph 1 and shall be able to demonstrate such compliance (‘accountability’).
(55) Pursuant to Article 6(1) of the GDPR, the processing of personal data is lawful only if and to the extent that at least one of the following is met:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
b) processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the data subject's request prior to entering into a contract;
c) processing is necessary for compliance with a legal obligation to which the controller is subject;
d) processing is necessary for the protection of the vital interests of the data subject or of another natural person;
e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
(56) Pursuant to Article 21(1) of the GDPR, the data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her based on points (e) or (f) of Article 6(1), including profiling based on those provisions. In such a case, the controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
(57) Pursuant to Section 38(3) and Section 60(1) of the Data Protection Act, the Authority shall, within the scope of its powers under Section 38(2) and (2a) of the Data Protection Act, conduct an ex officio data protection authority procedure in order to enforce the right to the protection of personal data.
12
(58) Pursuant to Section 60/A. (1), the administrative deadline in the data protection authority procedure is one hundred and fifty days.
(59) Pursuant to Section 61. (1) a) of the Infotv., the Authority may apply the legal consequences specified in the GDPR in connection with the data processing operations specified in Section 2. (2) and (4).
(60) Pursuant to Section 75/A. of the Infotv., the Authority shall exercise its powers set out in Article 83 (2)-(6) of the General Data Protection Regulation taking into account the principle of proportionality, in particular by taking measures to remedy the infringement in the event of a first breach of the provisions relating to the processing of personal data – laid down in a law or a binding legal act of the European Union – primarily by warning the data controller or processor, in accordance with Article 58 of the General Data Protection Regulation.
(61) Pursuant to Article 58(2)(i) of the GDPR, the supervisory authority shall, acting in its corrective capacity, impose administrative fines in accordance with Article 83, in addition to or instead of the measures referred to in this paragraph, depending on the circumstances of the case.
(62) Without prejudice to other administrative or judicial remedies, pursuant to Article 77(1) of the GDPR, each data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or the place of the alleged infringement, where the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
(63) Pursuant to Article 83(1) of the GDPR, each supervisory authority shall ensure that administrative fines imposed for infringements referred to in Article 83(4), (5) and (6) of the GDPR are, in each case, effective, proportionate and dissuasive.
(64) Pursuant to Article 83(2) of the GDPR, administrative fines shall be imposed in addition to or instead of the measures referred to in points (a) to (h) and (j) of Article 58(2), depending on the circumstances of the case. When deciding whether to impose an administrative fine and when setting the amount of the administrative fine, due account shall be taken in each case of:
a)
the nature, gravity and duration of the infringement, taking into account the nature, scope or purposes of the processing operations in question, the number of data subjects affected by the infringement and the extent of the damage suffered by them;
(b)
whether the breach was intentional or negligent;
(c)
any measures taken by the controller or processor to mitigate the damage suffered by the data subjects;
(d)
the extent of the liability of the controller or processor, taking into account the technical and organisational measures taken by the controller or processor pursuant to Articles 25 and 32;
(e)
relevant breaches previously committed by the controller or processor;
(f)
the extent of cooperation with the supervisory authority to remedy the breach and mitigate any negative effects of the breach;
(g)
the categories of personal data affected by the breach;
(h)
how the supervisory authority became aware of the breach, in particular whether the controller or processor notified the breach and, if so, with what details;
( 13
i)
where the controller or processor concerned has previously been subject to one of the measures referred to in Article 58(2) in respect of the same subject matter, compliance with those measures;
j)
whether the controller or processor has adhered to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and
k)
any other aggravating or mitigating factors relevant to the circumstances of the case, such as financial gain gained or loss avoided as a direct or indirect result of the infringement.
(65) Article 83(5) of the GDPR provides that infringements of the following provisions shall be punishable by administrative fines of up to EUR 20 000 000 or, in the case of undertakings, up to 4% of the total worldwide annual turnover of the preceding business year, whichever is the higher, in accordance with paragraph 2:
a)
the principles of processing, including the conditions for consent, in accordance with Articles 5, 6, 7 and 9 of the GDPR;
b)
the rights of data subjects in accordance with Articles 12 to 22 of the GDPR;
c)
the transfer of personal data to a recipient in a third country or to an international organisation in accordance with Articles 44 to 49 of the GDPR;
d)
obligations under Member State law adopted pursuant to Chapter IX of the GDPR;
e)
failure to comply with the instructions of the supervisory authority pursuant to Article 58(2) of the General Data Protection Regulation or with the request to temporarily or permanently restrict data processing or to suspend data flows, or failure to provide access in violation of Article 58(1) of the General Data Protection Regulation.
(66) Pursuant to Section 288(2) of Act CCXXXVII of 2013 on credit institutions and financial undertakings, in the event of complaint handling by telephone, the financial institution shall record the telephone communication between the financial institution, the independent intermediary and the customer and shall retain the recording for five years. The customer shall be informed of this at the start of the telephone handling.
IV. Decision
IV.1. The data processing examined and the capacity of the Respondent as data controller
(67) In the data protection authority procedure initiated upon the request, the Authority examined whether the data processing of the Respondent was lawful in the processing of the Applicant’s 0670[…] telephone number data, and whether the right to object specified in the GDPR was ensured.
(68) According to Article 4(1) of the General Data Protection Regulation, telephone number data is to be considered personal data of the data subject, since the telephone number can be linked to him, a connection can be established with him when making and receiving a call, or in this case, he used it when contacting the Respondent, and it can be clearly linked to his person.
(69) Based on Article 4(2) of the GDPR, the calls made by the Respondent in relation to the Applicant’s 0670[…] telephone number data, as well as the storage of this data, also constitute data processing.
(70) The Authority further determined that, with regard to the processing of the Applicant’s personal data, the Applicant is a data controller pursuant to Article 4(1) of the GDPR, since it decided on the purpose and means of data processing, and therefore the responsibility of the data controller exists pursuant to the GDPR.
IV.2. The Applicant’s data processing in relation to the Applicant’s 0670[…] telephone number data
IV.2.1. Data processing for the purpose of maintaining contact
(71) In the decision NAIH-4783-1/2022. referred to by the Applicant, the Authority condemned the Applicant in an individual case, in proceedings initiated upon request, and sanctioned the Applicant with a fine. In the decision referred to, the Authority did not examine the balancing of interests of the Applicant regarding the processing of the Applicant’s telephone number data for the purpose of debt management, which the Applicant submitted to the Authority during the execution of the decision.
(72) The Applicant has repeatedly, and verifiably, made it clear on 12.05.2022 that he does not wish to be contacted by telephone by the Respondent, despite this, the Respondent nevertheless contacted the Applicant on the telephone number 0670[…] in the telephone transcript of 15.06.2022.
(73) The Authority notes that the telephone conversation can be linked to the Applicant’s administrator, however, pursuant to Article 4.7 of the GDPR, the Applicant qualifies as a data controller and the Applicant is the one who organizes the data processing process and establishes its circumstances. The most important characteristic of the data controller is that it has substantive decision-making powers and is responsible for the fulfillment of all data processing obligations set out in the General Data Protection Regulation. Based on all of this, the GDPR violation related to the case also falls within the scope of responsibility of the Applicant as a data controller.
(74) During the verification of the implementation of the NAIH-4783/2022. Resolution, the NAIH previously examined the Applicant's general data processing practice and the general balancing of interests of the use of telephone numbers for contact purposes, and did not accept the primacy of legitimate interest or the legal basis of legitimate interest. This is also applicable to the present case, since the data processing under examination falls within the period of application of the legitimate interest legal basis, and the Applicant declared in October 2022 that it would change its previous general practice, and then switched to the practice of requesting consent from 2 May 2023. Consequently, the application of the legitimate interest legal basis does not constitute an appropriate legal basis for data processing in the present case either, so the Applicant carried out data processing without a legal basis. During the verification of the implementation of the aforementioned precedent resolution, the Authority has already made the relevant general findings applicable to all data subjects. For this reason, it is stated that data processing without legal basis has also taken place with regard to the Applicant’s data subject, since the Applicant’s legitimate interest does not prevail in terms of maintaining contact. However, beyond the establishment of this infringement, no sanctions or measures will be imposed in the present applicant’s case.
(75) It should be noted that, compared to the general balancing of interests, the fact that the Applicant’s interests are also prioritized over the Applicant’s interests is also strengthened by the fact that in this case it is a “corporate” telephone number, i.e. a number subscribed by an employer and used by an employee, in which respect the data subject’s interest in not having the telephone number recorded as the Applicant’s contact information should be taken into account.
(76) Based on the information available in the case, it is also clear that the Applicant’s statements are contradictory and its practice is inconsistent. Namely, during the telephone conversation, the Respondent’s administrator replied to the Applicant that his telephone number was not recorded for contact purposes and that he does not record it. However, due to the application of the legitimate interest legal basis
15
, he would have had the opportunity to do so, but the administrator did not provide information about this, but did not record the telephone number data as if he had considered it to be consent-based data processing. This was confirmed by the Respondent’s statement during the procedure that the administrator presumably used the telephone number from the complaint handling documentation. In contrast, the Respondent provided information in its response to the Applicant dated 30 November 2022 that the telephone number data had been deleted in both cases in response to his request. The Respondent also confirmed this in its statement to the Authority. It is therefore clear that the statements made contradict each other, because either there was no telephone number in the claims management register, and then there was nothing to delete, or there was still a telephone number recorded, which was deleted upon request. Resolving the contradiction and determining what the real, actual situation is, which is the correct statement, i.e. further clarification of the facts, is no longer possible, because the telephone number data has been deleted, and the previous state of the register cannot be reconstructed. However, it is clear that the data processing process of the Respondent detailed above is not clear, the information provided to the Applicant and the Authority is not consistent, but contains self-contradictions, therefore the lawfulness of its data processing in this regard is not substantiated, and its compliance with data protection regulations has not been proven.
(77) Based on the above, the Authority found that the Respondent had violated the principle of accountability set out in Article 5(2) of the GDPR, according to which the data controller must demonstrate the adequacy of its data processing.
(78) Considering that the Respondent had confirmed during the procedure with a screenshot that it no longer processes any telephone number data regarding the Respondent for the purpose of claims management, the Authority therefore did not order the Respondent to delete the data.
IV.2.2. Data processing related to telephone conversations
(79) According to the attached documents, the Respondent notified the Applicant in its letter dated 30 November 2022 with the registration number […] that it had deleted his telephone number data recorded as contact information, despite the fact that the Applicant had already – according to the records – clearly indicated during the telephone conversation on 15.06.2022 that he had not given his consent to the processing of his telephone number data 0670[…]. Since the GDPR does not apply any formal requirements in relation to the submission of data subject requests, and the Respondent’s letter of 15.06.2022. contacted the Applicant on, among other things, to agree on data related to claims management, the processing of which contact data was handled by the Applicant on the basis of legitimate interest prior to 2 May 2023, thus the refusal to maintain telephone contact formulated by the Applicant should be considered a data subject request pursuant to Article 21 of the GDPR by the Applicant. According to the Authority's position, during the telephone conversation on 15 June 2022, the administrator should have recorded that the Applicant had submitted a data subject request pursuant to Article 21 of the GDPR, and should have informed him orally or in writing.
(80) Furthermore, the Applicant has provided the annex to the NAIH-6610-1/2023. application and the NAIH-6610-6/2023. submission No. 5. From the transcripts of the telephone conversation of 15.06.2022, as per the annex, it can be established that the Respondent did not receive information that the Respondent was processing the telephone numbers for claims management purposes not on the basis of consent but on the basis of legitimate interest, nor about what data subject rights the Respondent could exercise and how - specifically, e.g. the right to object in the case of a legitimate interest legal basis -, nor about whether the Respondent was storing and preserving the telephone number - among other things - on the basis of a legal obligation or on the basis of a legitimate interest legal basis. Furthermore, the Respondent's employee did not assess what was said on the phone
16
as a protest and did not take appropriate measures.
(81) By not informing the Applicant about the legal basis and the related right to object in its response to the Applicant’s requests during the telephone conversation on 15.06.2022, nor considering the Applicant’s request as a right to object, but only responding to the Applicant’s subsequent written request, the Applicant violated Article 21(1) of the GDPR.
IV.3. Legal consequences
(82) The Authority examined whether it was justified to impose a data protection fine on the Applicant. In this regard, the Authority considered all the circumstances of the case based on Article 83(2) of the General Data Protection Regulation and Section 75/A of the Infotv. and concluded that in the case of the violations revealed during the present procedure, a warning is not a proportionate sanction, therefore a fine should be imposed. However, the Authority shall not sanction infringements of Article 6(1) of the GDPR.
(83) When determining the amount of the fine, the Authority took into account that the infringements committed by the Applicant qualify as infringements falling under the higher maximum fine category pursuant to Article 83(5) of the GDPR.
(84) When determining the amount of the fine, the Authority took into account the provisions of the European Data Protection Board’s Guideline No. 4/20222 (hereinafter: the Guideline), which contains the criteria for calculating administrative fines under the GDPR. In view of this, the amount of the fine was determined on the basis of the following criteria:
o
According to the Applicant’s 2023 annual report, its turnover was […] HUF, i.e. […] HUF.
o
According to the Applicant’s 2024 annual report, its turnover was […] HUF, i.e. […] HUF.
(85) The Authority has taken the turnover of the last closed year (2024) as the basis for determining the amount of the fine.
(86) Pursuant to Article 83(5) of the General Data Protection Regulation, the Respondent may be subject to an administrative fine of up to EUR 20,000,000 [static maximum fine] for infringements committed, or in the case of undertakings, up to 4% of the total annual worldwide turnover of the preceding financial year [dynamic maximum fine], whichever is higher.
(87) 4% of the Respondent’s turnover in 2024 is HUF […], i.e. […] forints, which at the current HUF/EUR exchange rate does not exceed the so-called static maximum fine set by the Regulation, i.e. the amount corresponding to EUR 20,000,000. Since the fine must be calculated and proportionate to the higher category of the static and dynamic amounts that can be imposed in the given case
2https://www.edpb.europa.eu/system/files/2024-01/edpb_guidelines_042022_calculationofadministrativefines_hu_0.pdf
17
, the Respondent may be imposed an administrative fine of up to EUR 20,000,000 in the present case.
(88) According to the Guidelines, in the case of infringements falling within the fine category referred to in Article 83(5) of the GDPR, to which the static maximum fine of EUR 20,000,000 applies, the net turnover of the undertaking taken into account in determining the amount of the fine, as well as the gravity of the infringement committed, are subject to further examination.
(89) Based on the net sales of the Respondent in 2024, […] HUF, i.e. […] forints, which, calculated at the current HUF/EUR exchange rate, falls into the category of enterprises with a turnover of between EUR 10 million and EUR 50 million as specified in the Guidelines in relation to the consideration of the management data of enterprises.
(90) When determining the amount of the data protection fine, the Authority took into account as an aggravating circumstance that the infringements committed by the Respondent qualify as infringements falling under the higher fine category pursuant to Article 83(5)(a) of the General Data Protection Regulation. It should also be considered an aggravating circumstance that the Respondent has already been convicted several times for violating the GDPR.
(91) The Authority has imposed fines on the Respondent several times for violating the General Data Protection Regulation:
- NAIH/2020/35/3. resolution: one million forints,
- NAIH/2020/687/2. resolution: two million forints,
- NAIH/2020/2025/2. resolution: five hundred thousand forints,
- NAIH/2020/2616/9. resolution: five million forints,
- NAIH/2020/2760/9. resolution: two million forints.
- NAIH/3659/2021/1. resolution: five million forints,
- NAIH/4783/2022/1. resolution: one million forints,
- NAIH/1000/2023/1. decision: one million forint
Relevant, fundamental (GDPR Article 5) violations previously committed by the Applicant (GDPR Article 83(2)(e)):
NAIH/2020/35/3. Decision,
- NAIH/2020/687/2. Decision,
- NAIH/2020/2025/2. Decision,
- NAIH/2020/2616/9. Decision,
- NAIH/2020/2760/9. Decision,
- NAIH/3659/2021/1. Decision,
- NAIH/4783/2022/1. Decision
-NAIH/1000/2023/1. decision
Among these decisions stating a violation of the basic principle, the violation of the principle of accountability is contained in NAIH/3659/2021/1. Decision; NAIH/4783/2022/1. Decision and NAIH/1000/2023/1. Decision.
18
The determination of a violation of data subject rights from the above cases:
- NAIH/2020/687/2. Decision,
- NAIH/2020/2025/2. Decision,
- NAIH/2020/2616/9. Decision,
- NAIH/3659/2021/1. Decision.
None of these decisions contains a violation of the data subject's right to object.
(92)
When imposing the fine, the Authority took into account the exceeding of the administrative deadline, the delay in the administrative procedure, and the fact that the Applicant called the Respondent quite a lot during the period related to the subject of the procedure as mitigating circumstances.
(93)
The Authority did not take into account the following provisions of Article 83(2) of the GDPR when imposing the fine, because they were not relevant in the case at hand: point c), point d), point f), point g), point h), and point j).
(94)
Based on the violations committed, the revealed facts, and the aggravating and mitigating circumstances relevant to the given case, the Authority considered the violations committed in the present case to be of medium gravity.
(95)
According to the Guidelines, if the net turnover of the undertaking in the previous year is between EUR 10 million and EUR 50 million, the maximum amount of the fine that can be imposed is reduced to EUR 30,000 – 400,000 for medium-severity infringements.
(96)
The amount of the fine was determined by the Authority acting within its statutory discretion.
(97)
The fine imposed is proportionate to the gravity of the infringement, it cannot be considered excessive, and it is a low amount compared to the economic weight of the Applicant and the financial resources at its disposal.
(98)
Based on the above, the Authority decided as set out in the operative part.
(99)
The Authority exceeded the limits of the Infotv. 60/A.§ (1) of the Administrative Procedure Act, therefore the Applicant is entitled to HUF 10,000, i.e. ten thousand forints – at his/her choice – by bank transfer or postal order based on Section 51. (1) b) of the Ákr.
V. Other issues
(100)
The Authority’s competence is determined by Section 38. (2) and (2a) of the Infotv., its jurisdiction extends to the entire territory of the country.
(101)
The decision is based on Sections 80-81 of the Ákr. and Section 61. (1) of the Infotv. The decision becomes final upon its publication based on Section 82. (1) of the Ákr. Pursuant to Sections 112 and 116 (1) and Section 114 (1), the decision and the order may be appealed against through administrative proceedings.
(102)
According to Section 135 of the Civil Code, the debtor is obliged to pay a late payment surcharge in the amount equivalent to the statutory interest if he fails to meet his payment obligation within the deadline
19
(103)
According to Section 6:48 (1) of Act V of 2013 on the Civil Code, in the event of a financial debt, the debtor is obliged to pay late payment interest in the amount equivalent to the central bank base rate valid on the first day of the calendar half-year affected by the delay, starting from the date of default.
(104)
The rules of administrative litigation are determined by Act I of 2017 on the Code of Administrative Procedure (hereinafter referred to as the Code). Pursuant to Section 12 (1) of the Code, administrative litigation against the decision of the Authority falls within the jurisdiction of the court, and the Metropolitan Court has exclusive jurisdiction over the litigation pursuant to Section 13 (3) a) aa) of the Code. Pursuant to Section 27 (1) b) of the Code, legal representation is mandatory in litigation falling within the jurisdiction of the court. Pursuant to Section 39 (6) of the Code, the filing of a statement of claim does not have a suspensive effect on the entry into force of the administrative act.
(105)
Section 29 (1) of the Code and, in view of this, the Code of Civil Procedure According to Section 19 (1) b) of Act CIII of 2023 on the Digital State and Certain Rules for the Provision of Digital Services, applicable pursuant to Section 604, the legal representative of the client is obliged to maintain electronic contact.
(106)
The time and place of filing the statement of claim is determined by Section 39 (1) of the Civil Procedure Code. Information on the possibility of requesting a hearing is based on Section 77 (1)-(2) of the Civil Procedure Code. The amount of the administrative litigation fee is determined by Section 45/A (1) of Act XCIII of 1990 on Fees (hereinafter: the Civil Procedure Code). Section 59 (1) and Section 62 (1) h) of the Civil Procedure Code exempt the party initiating the proceedings from the advance payment of the fee.
(107)
If the Applicant fails to provide adequate proof of compliance with the prescribed obligation, the Authority shall consider that the obligation has not been fulfilled within the deadline. According to Section 132 of the Tax Code, if the obligated party has not complied with the obligation set out in the final decision of the authority, it shall be enforceable. The decision of the Authority shall become final upon notification in accordance with Section 82(1) of the Tax Code. Pursuant to Section 133 of the Tax Code, enforcement shall be ordered by the authority that made the decision, unless otherwise provided by law or government decree.
(108)
According to Section 134 of the Tax Code, enforcement shall be carried out by the state tax authority, unless otherwise provided by law, government decree or, in the case of a local government, a local government decree.
Budapest, “according to the electronic signature and time stamp”
Dr. habil. Attila Péterfalvi
President c. university professor
