NAIH (Hungary) - NAIH-1743/2021
|NAIH (Hungary) - NAIH-1743/2021|
|Relevant Law:||Article 5(1) GDPR|
Article 6(1) GDPR
Article 9 GDPR
Article 58 GDPR
|National Case Number/Name:||NAIH-1743/2021|
|European Case Law Identifier:||n/a|
|Original Source:||NAIH (in HU)|
The Hungarian DPA issued a reprimand against a controller for the unlawful recording and sharing of a private conversation between two parents and a daycare employee which contained special categories of data.
English Summary[edit | edit source]
Facts[edit | edit source]
A data subject submitted a complaint with the Hungarian DPA for the unlawful processing of their personal data and the personal data of their child, including special categories of data. The complaint was made regarding the recording and subsequent sharing of a private conversation between the defendant and the complainant, as well as an employee of a daycare attended by both of their respective children. The recording contained personal data, including sensitive information about the health of a minor. It was then shared by the controller within a Facebook group containing of all the parents whose children attend the daycare, as well as via e-mail with other parties. Upon questioning, the defendant admitted that they had no legal grounds for the collection or sharing of this data.
Holding[edit | edit source]
The Hungarian DPA noted that both recording the conversation for purely personal use or sharing information about the meeting with other interested parents could have fallen under the household exemption of the GDPR under Article 2(2)(c). However, NAIH held that the sharing of such recording excluded the exemption and was also contrary to the principles of purpose limitation and data minimisation under Articles 5(1)(b) and 5(1)(c) GDPR. Moreover, the DPA held that the defendant had no legal ground for the processing of the data, including special categories of data, under Article 6(1) and Article 9 GDPR.Subsequently, NAIH decided to reprimand the controller under Article 58(2)(b) and impose a ban on any further processing under Article 58(2)(f). The DPA also ordered the controller to inform those with whom the data was shared to erase it without undue delay under Article 58(2)(g). However, NAIH did not find it necessary to impose an administrative fine under Article 83(2), taking into account that the controller is a natural person who had accepted that their conduct had been unlawful.
Comment[edit | edit source]
In the DPA's Opinion, the recording of the conversation between two parents and the daycare employee in secret is 'concerning and unacceptable from an ethical point of view'. However, they state that it would have still fallen under the household exemption, as long as the data is not shared with others (but only serves as an aid to help remembering what was said during the meeting). One could argue that this interpretation of Article 2(2)(c) allows natural persons to record all of their phone conversations for example, as long as they don't share them with anyone. One risk could be that given that the this processing would fall outside the scope of the GDPR, even the general principles (especially 'integrity and confidentiality') wouldn't apply.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.
Case No: NAIH-1743- / 2021 Subject: Approval of application decision DECISION Before the National Authority for Data Protection and Freedom of Information (hereinafter referred to as the Authority) […] with regard to the minority of the applicant (hereinafter referred to as the Applicant): […] (address: […], Hereinafter referred to as "the Representative", against […] (address: […]) (hereinafter referred to as "the Applicant") unauthorized data processing submitted to the Authority on 28 January 2021 In the data protection authority proceedings initiated following the request of the Authority, the Authority shall take the following decisions: I. The Authority will grant the applicant 's request and 1) condemn the Applicant, taking into account that the Applicant 's personal data and special personal data of natural persons for the processing of personal data and the free movement of such data, and Regulation (EU) 2016/679 repealing Directive 95/46 / EC (a hereinafter referred to as the GDPR) in accordance with Article 5 (1) (a), a The principle of purpose limitation under Article 5 (1) (b) of the GDPR and Article 5 (1) the principle of data retention referred to in paragraph 1 (c) and Articles 6 and 9 of the GDPR unlawfully handled the data when disclosed to third parties made it available; 2) prohibits the Applicant from recording with third parties - either online or otherwise; 3) oblige the Applicant to provide the recipients to whom the recording by e-mail personal and special personal data of the Applicant notified of the need to delete the recording. The Applicant is the completion of the measure must be duly substantiated to the Authority by the present decision within 30 days of becoming final. II. The Authority shall issue the Applicant ex officio for the infringements set out in point I. in the warning gives. There is no administrative remedy against this decision, but from the date of notification within 30 days of the application to the Metropolitan Court in an administrative lawsuit can be challenged. The application must be submitted to the Authority, electronically, which is the case forward it to the court together with his documents. Those who do not benefit from full personal exemption ………………………………………………………………………………………………………… 1055 Budapest Tel .: +36 1 391-1400 firstname.lastname@example.org Falk Miksa utca 9-11. Fax: +36 1 391-1410 www.naih.huszám The fee for the administrative lawsuit is HUF 30,000, the lawsuit is subject to the right to record material fees. The Capital Legal proceedings are mandatory in proceedings before the General Court. I N D O K O L Á S I. Procedure (1) The Representative, represented by the Applicant, received a letter from the Authority on 28 January submitted a request for data protection authority proceedings against the Applicant, in which he complained that the Requested was secretly made and then a Facebook published a recording of a conversation in which the Applicant 's personal and information classified as special data was provided. (2) The Applicant shall, in order to investigate the matter, discover the violation, and the legal consequences for the Applicant requested the Authority to apply. (3) The Authority issued its decision of 5 March 2021, NAIH-1743-2 / 2021. Order No. of the Applicant on 17 March 2021 In its letter to the Authority and the annexes thereto deed. (4) The Authority found that the detail of the screenshot was not suitable for the objected subject to prove the processing of data, therefore NAIH-1743-4 / 2021 dated 14 April 2021. number In his order, he called on the Representative to do so within 8 days of receiving the order send a screenshot of the recording to the Authority. (5) Following the receipt of the above-mentioned order on 16 April 2021, the Applicant shall by post and attached to the letter received by the Authority on 27 April complied with the Authority's order. (6) The Authority issued NAIH-1743-6 / 2021 on 13 May 2021. In its order No To give an application within fifteen days of receipt of the order information on the purpose and legal basis for sharing the recording on the Facebook group, as well as who in the process got to know the Applicant’s personal and special personal data and whether the recording was sent by e-mail, to whom (s), for what purpose and on what legal basis. 2 (7) On 2 June 2021, the Applicant sent NAIH-1743-6 / 2021. Order no NAIH-1743-9 / 2021. on 14 June 2021 via the e-paper service in his letter sent. (8) On 25 June 2021, the Authority informed the Applicant and the Applicant that the in the data protection authority proceedings, the evidentiary procedure was completed and drew their attention the right to inspect the file and to submit further requests for evidence the possibility of exercising it. (9) On 2 July 2021, the Representative indicated that he wished to exercise his right of access to the file. The Authority has issued NAIH-1743-14 / 2021. submitted by the Representative in his order no limited access to personal data that is not known to him and sent it to the specified postal address from the non-Applicant copies of documents originating from and not sent to the Applicant. (10) No further request for access to the file or request for proof was received by the Authority. II. Facts (11) In a request received by the Authority on 28 January 2021, the Applicant complained that. discussing the problem related to the Applicant - indicated by the kindergarten teacher A meeting was organized with the Representative and the head of the kindergarten also taken the Applicant, who is the mother of one of the kindergarten groupmates. Included in the application According to He requested from the first 46 minutes of the meeting with his mobile phone in secret made a video recording that is more of an audio recording because the recording when it was made, the device was in his pocket, so it only recorded sound. The Applicant submitted that Applicant “uploaded the audio recording to the Facebook community page of a kindergarten to the side of the group created for the parents, that is, to the public made it directly accessible, ’. According to the application, the applicant is included in the recording information that constitutes your personal and special personal information notwithstanding, the Applicant has not requested the Representative - ie Applicant 's legal representative - consent to the recording of the sound recording, and neither the fact of its preparation nor its use, that is, to the public did not inform the Representative. (12) According to the Applicant, the Applicant violated the information self-determination CXII of 2011 on the right to freedom of information and freedom of information Act (hereinafter: the Information Act) Section 4 (1), Section 5 (1) (b), Section (2) (a) and Section 14 therefore processing is unlawful. The Applicant requested the Authority to investigate expose the case, detect the breach and prohibit the infringing controller from further infringement, and apply legal sanctions against him. 3 (13) The Applicant attached to his application a piece of data carrier on which it can be found one that contains a visual display only in its first seconds, but is natural a non-personal video recording of the conversation described in the application audible. There are also two Word documents on the flash drive, one of which presumably an online conversation between the Applicant and the Applicant, while another is likely to be between the parents of children in the affected kindergarten group online conversation was recorded in typed form. (14) In response to the Authority's request for rectification, the Representative clarified his request that infringes the processing of your child's personal and special personal data, and provided the personal data requested by the Authority and Facebook referred to in the request group information. The impugned recording was attached to the letter a detail of the screenshot to verify the publication of the […] Screenshot of a Facebook group. (15) The Applicant shall send another flash drive - with the screenshots on it - confirmed that the recording in question was in a Facebook group used by several persons publication, its date and the identity of the publisher, and the fact that the group includes a discourse on the conversation you hear on the recording. (16) At the request of the Authority, the Applicant submitted that the audio material was submitted on 21 January 2021 was made for the reason that such a conversation also had professional reasons they utter what he can hardly recall later. The Applicant explained that he was not bad intentions, and in this conversation it became clear to the children they are in danger, and neither the kindergarten teacher nor the Representative want a substantive take steps. The Applicant further submitted that to his knowledge, in addition to one nor was a parent aware that he was “suffering from a severe nervous system problem a small child joins the group, ”and feared the children. He therefore claims to have published the audio material on January 22, 2021 at 5:12 a.m. parents of preschoolers - a total of 23 people - used by the messenger group. He stressed that the purpose was to inform and that he realized that this should not have been the case when the kindergarten teacher a on the day of publication, he wrote to him at 10:30 a.m. to remove the recording because he had not consented to it. The Applicant therefore removed the recording from the group at 10:15 a.m. THE According to the applicant, since many parents are working at the time of publication, and recording was available for a very short time, "almost no one could listen." THE Based on his statement, the applicant also immediately deleted the recording from the conversation. THE Applicant also cited the group discussions as well as his statement also attached screenshots to prove this. 4 (17) To the Authority's question on the legal basis for sending the recording by e-mail in response, the Applicant admitted that he had no right to send the recording to anyone who he asked, and again pointed out that he had done so not with malicious intent, but for the benefit of the children. He further submitted that the recording was sent only to the person who requested it from one of the parents. (18) In its clarified statement, the Applicant identified the three persons to whom the recording has been sent via email. (19) On the basis of the information available, the Authority concluded that the application between the Representative, the Applicant and the head of the kindergarten talk. (20) During the discussion, the following points concerning the Applicant were made, inter alia information: name ([…]), place of residence, fact that it does not belong to the given kindergarten district, as well as the finding in a particularly sensitive area of the private sector that there have been three recent deaths in his family. It can also be heard on the recording a lot of information that the Applicant's behavior, behavioral problems whether it is to mention a specific conflict or a problem duration of its existence. (21) In addition, the following information on the Applicant 's state of health was recorded on the audio recording information can also be heard: they accompany […]; You are taking a 'active' medicine; […] Will be investigated (Due to […] problem); twice a week and related statements referring to the fact of illness (eg by the Applicant to the Representative) statement: "I do not see you admitting that [”]. "). (22) The recording was published in a chat group of which the Applicant is a member parents of children attending kindergarten group also visited. To publish a link to the recording the day after the conversation on the recording, that is to say, on 22 January 2021, and a messenger was also deleted from the group that day. III. Applicable law Article 2 (1) GDPR: This Regulation shall apply to personal data in part or fully automated processing of personal data and the processing of personal data which are part of a registration system which are intended to be part of a registration system. 5GDPR Article 2 (2) (c): 'This Regulation shall not apply to personal data natural persons solely for their personal or domestic activities carried out in the framework of the GDPR Article 4 (1): "personal data" means identified or identifiable natural data any information about the person ("data subject"); identifiable by that natural a person who, directly or indirectly, in particular by means of an identifier such as a name, number, location data, online identification or physical, physiological, genetic, intellectual, economic, cultural or social identity identifiable by several factors; GDPR Article 4 (2): "processing of personal data" means personal data or data files any operation or set of operations carried out in an automated or non-automated manner, thus collecting, recording, organizing, sorting, storing, transforming or altering, querying, available for inspection, use, communication, transmission or other means harmonization or interconnection, restriction, deletion or destruction. Article 4 (15) of the GDPR: '' health data 'means a physical or mental substance of a natural person personal data concerning his state of health, including for a natural person also provide information on the health services provided the state of health of the natural person; " Article 5 (1) (a) GDPR: “the processing of personal data lawfully and lawfully be carried out fairly and in a way that is transparent to the data subject ("legality, fair procedure and transparency ");" Article 5 (1) (b) GDPR: "the collection of personal data shall be limited to specified, for a clear and legitimate purpose and not be treated in a way that is incompatible with those purposes in a compatible manner; does not constitute an original purpose in accordance with Article 89 (1) incompatible for the purpose of archiving in the public interest, scientific and historical research further processing for personal or statistical purposes ("purpose limitation"); " Article 5 (1) (c) GDPR: personal data shall have “the purposes for which they are processed they must be appropriate and relevant and necessary limited to "data saving"; " GDPR Article 6 (1): Processing of personal data only if and to the extent that lawful if at least one of the following is met: (a) the data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes treatment; (b) processing is necessary for the performance of a contract to which one of the parties is a party; or to take action at the request of the data subject prior to the conclusion of the contract required; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; 6d) the processing is in the vital interests of the data subject or of another natural person necessary for its protection; (e) the exercise of a public interest or the exercise of official authority vested in the controller necessary for the performance of its task; (f) processing for the legitimate interests of the controller or of a third party necessary, unless the interests of the data subject take precedence over those interests or fundamental rights and freedoms which call for the protection of personal data, especially if the child concerned. Point (f) of the first subparagraph shall not apply to the performance of their duties by public authorities data management. 3. The legal basis for the processing referred to in points (c) and (e) of paragraph 1 shall be the following state: (a) Union law, or (b) the law of the Member State to which the controller is subject. The purpose of the processing shall be determined by reference to this legal basis and in accordance with paragraph 1 (e). with regard to the processing of data referred to in point (a), it must be necessary in the public interest or a task performed in the exercise of a public authority conferred on the controller to implement. This legal basis may include the application of the rules contained in this Regulation adjusting provisions, including the lawfulness of the processing by the controller general conditions, the type of data subject to data processing, the data subjects, the the entities with which personal data may be disclosed and the purposes of such disclosure, restrictions on the purpose of the data processing, the duration of the data storage and the data processing operations and other data processing procedures, such as lawful and fair data processing measures necessary to ensure compliance, including the other as defined in Chapter for specific data management situations. EU or national law must pursue an objective in the public interest must be proportionate to the legitimate aim pursued. Article 9 of the GDPR: Management of special categories of personal data (1) Racial or ethnic origin, political opinion, religion or belief or personal data referring to trade union membership, as well as genetic data, natural biometric data for personal identification, health data and personal information concerning the sexual life or sexual orientation of natural persons data processing is prohibited. * 2. Paragraph 1 shall not apply if: (a) the data subject has given his or her explicit consent to one or more specific transfers of such personal data unless Union or Member State law provides that the prohibition referred to in paragraph 1 may not be lifted with the consent of the data subject; (b) the processing of data by the controller or the data subject concerning employment and social fulfillment of its obligations under legal provisions governing security and social protection and in order to exercise his specific rights, if he is defending the fundamental rights and interests of the data subject 7 under EU or national law which also provides adequate guarantees or under the law of a Member State a collective agreement allows for this; (c) processing for the protection of the vital interests of the data subject or of another natural person necessary if, due to the physical or legal incapacity of the person concerned, he is unable to a give its consent; (d) the processing is carried out by a foundation for political, ideological, religious or trade union purposes, association or any other non-profit organization with appropriate guarantees provided that the processing is carried out exclusively by such a body applies to current or former members or to persons who are regular members of the organization are related to the purposes of the organization and that personal data are shall not be made available to persons outside the organization without the consent of the persons concerned for; (e) the processing relates to personal data which are specifically requested by the data subject disclosed; f) the processing is necessary for the establishment, enforcement or protection of legal claims, or when the courts are acting in their judicial capacity; * (g) processing is necessary for overriding reasons of public interest under Union law or the law of a Member State which: proportionate to the aim pursued, respects the right to the protection of personal data appropriate to ensure the fundamental rights and interests of the data subject and prescribes concrete measures; (h) for the purposes of pre - processing health or occupational health purposes, assessment of an employee's ability to work, medical diagnosis, health care or the provision of social care or treatment, or health or social systems and necessary for the management of the service, under Union or Member State law, or under a contract with a healthcare professional and referred to in paragraph 3 subject to conditions and warranties; (i) the processing is necessary in the public interest in the field of public health, such as: protection against serious cross-border threats to health or health the high quality and safety of care, medicines and medical devices under EU or Member State law that is appropriate and specific provides for measures to safeguard the rights and freedoms of the data subject, and in particular to: professional secrecy; (j) data processing in accordance with Article 89. for archiving in the public interest in accordance with Article necessary for scientific and historical research or statistical purposes under the law of a Member State, which is proportionate to the aim pursued, respects personal data the essential content of the right to the protection of the individual and the fundamental rights and interests of the data subject provides for appropriate and concrete measures to ensure 3. The personal data referred to in paragraph 1 may be exchanged in accordance with paragraph 2 (h). for the purposes referred to in paragraph 1, if the processing of such data by or on behalf of a professional under the responsibility of a professional who is competent or competent under Union or Member State law professional secrecy laid down in the rules laid down by the competent authorities of the Member States or by another person who is also a Member State or a Member State rules laid down by the competent authorities of the Member States subject to a specific obligation of confidentiality. Member States may maintain additional conditions, including restrictions, or may be introduced for the management of genetic data, biometric data and health data regarding. Article 58 (2) GDPR: Acting in the corrective power of the supervisory authority: (b) reprimands the controller or the processor if he or she is acting in a data-processing capacity infringed the provisions of this Regulation. (f) temporarily or permanently restrict data processing, including data processing prohibition; (g) order personal data in accordance with Articles 16, 17 and 18 respectively rectification or erasure of data and restrictions on data processing, as well as Article 17 (2) order notification to the addressees in accordance with with whom or with whom the personal data have been communicated; Article 77 (1) GDPR: Without prejudice to other administrative or judicial remedies, all parties concerned shall have the right to lodge a complaint with a supervisory authority, in particular the according to his habitual residence, place of employment or the place of the alleged infringement in a Member State, if the data subject considers that the processing of personal data concerning him or her infringes this Regulation. Infotv. § 2 (2): Personal data shall be processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council covered by the Council Regulation (hereinafter referred to as the General Data Protection Regulation) General Data Protection Regulation in Annexes III-V. and VI / A. Chapter and Section 3, Sections 3, 4, 6, 11, 12, 13, 16, 17, 21, 23-24. Section 4 (5), Section 5 (3) to (5), (7) and (8) § 13 (2), § 23, § 25, § 25 / G. § (3), (4) and (6) in paragraph 25 / H. § (2), 25 / M. § (2), 25 / N. §, 51 / A. § (1), Articles 52-54. § 55 (1) - (2), 56-60. §, 60 / A. § (1) - (3) and (6), Section 61 (1) (a) and (c), Section 61 (2) and (3) paragraph 4 (b) and paragraphs 6 to 10, paragraphs 62 to 71. § 72 in Section 75 (1) - (5), Section 75 / A. With the additions specified in § and Annex 1 should be used. Infotv. Enforcement of the right to the protection of personal data pursuant to Section 60 (1) the Authority shall, at the request of the data subject, initiate a data protection authority procedure. The data protection authority procedure is governed by the CL of 2016 on General Administrative Procedure. (hereinafter: Ákr.) shall be applied in accordance with the provisions of the Infotv additions and derogations under the General Data Protection Regulation. Infotv. 75 / A. §: The Authority is set out in Article 83 (2) to (6) of the General Data Protection Regulation exercise its powers in accordance with the principle of proportionality, in particular by: legislation on the processing of personal data or binding European Union law for the first time in the event of a breach of the rules laid down in 9 in accordance with Article 58 of the General Data Protection Regulation by alerting the controller or processor. ARC. Decision (23) The processing of data by recording consisted of two different data processing operations. The first operation was to record the recording, while the second operation was to communicate the recording, and the latter it took two different forms when the Applicant first appeared in the group shared the recording and then e-mailed his statement - and the attached evidence - according to three people. Both operations, including the recording and communication of the recording considered as data processing within the meaning of Article 4 (2) of the GDPR. IV.1 Data management related to the communication of the recording (24) The Authority found that personal data within the meaning of Article 4 (1) of the GDPR the following information about the Applicant on the audio recording shall be considered: a name ([…]), place of residence, that it does not belong to the given kindergarten district; in his family a there have been three recent deaths; the Applicant's conduct, behavioral information about your problem. (25) It was also found that the GDPR was a health claim within the meaning of Article 4 (15) and therefore special personal data under Article 9 (1) of the GDPR statements made by the Applicant that […] are taking “[…]” medication, […] will have a test […] problem, two weeks a week times of development, as well as to provide indications that he is ill. (26) The Applicant indicated different data processing purposes for the two data processing operations me. According to the Applicant 's statement, the recording was made for the purpose of: later recall the conversation and the communication to the other parents - ie to inform the addressees of the communication. (27) As regards the recording of the recording, the Authority noted that as long as is for purely private purposes, that is to say, as the Applicant has pointed out, the recording will help the Recaller to recall what was said during the interview the so-called "household data management" category, and the GDPR - a Article 2 (2) (c) shall not apply to it. However, not it may be disregarded that the recording was made in secret - subject to the 10 the sensitivity of the topic of discussion - ethically concerned and not acceptable. (28) However, at the moment, as between the Applicant and the Representative and the a recording of a conversation between the kindergarten teacher for other people made it available - thus making the Applicant’s personal and special personal data - the private nature of the recording, ie also by the Applicant emphasized, his own self-interest ceased to exist. Consequently, the position of the Authority according to the division of the recording goes beyond the household exception to the GDPR the concept of data management. (29) With regard to the sharing of recordings as a data processing operation, the Authority should the purpose indicated by the applicant - ie to inform the other parents about the Applicant stated the following. THE conversation with two people involved in the main topic, the kindergarten teacher with the help, so between three people, it took place in a closed circle, and although it was uttered differently also conflicts and general problems related to children, starting from the There was a conflict between the Applicant's child and the Applicant. The Applicant himself is a in the attached messenger conversation: “Monday afternoon, a after another incident with my son, I had another parental complaint with the head of the kindergarten. ” […] “At the initiative of yesterday […], we sat down with his kindergarten teacher to discuss things. ” The Representative also intends to have a child and the Applicant in a conversation between the two of them to resolve a conflict between their children informing all parents about what has been said is not considered lawful under the GDPR purpose. (30) In addition to the illegality of the stated objective, the Authority found that if the others an oral conversation about general, relevant information that concerns them exclusively also due to its household nature does not qualify as GDPR therefore cannot be objected to from a data protection point of view. (31) However, sharing the recording in this way was an unnecessary intervention to the privacy of the data subject, ie the Applicant, by being personal and special your personal data has thus become accessible to more than one person. (32) In addition to the above, the Authority did not consider that the online communication was made appropriate way to pass on the information in this case, as it carries the possibility and risk of the link - or, in the case of an e-mail, the file - the recipient may transfer the recording to other persons. 11 (33) In view of the above, the Applicant violated Article 5 of the GDPR by sharing the recording. the principle of purpose limitation under Article 5 (1) (b) and Article 5 (1) of the GDPR. the principle of data protection set out in paragraph 1 (c). IV.2 Legal basis for data processing (34) Based on the above, the Applicant's personal data of the Applicant is third activities under the GDPR in which case the lawfulness of the processing is subject to one of the conditions laid down in Article 6 of the GDPR Existence of a legal basis governed by paragraph 1. (35) In addition, the processing of special personal data is in principle prohibited. The special personal data may be lawfully processed only if Article 6 (1) of the GDPR in addition to a specific legal basis, a circumstance within the meaning of Article 9 (2) of the GDPR which allows an exception to the prohibition on the processing of special data. (36) The Applicant did not have the consent of the Applicant for the data processing. THE Authority invited the Applicant to indicate his data processing however, the Applicant did not comply with this during the proceedings. To the Authority he stated, “I did not have the right to send the recording to anyone who asked for it now I know.". With the consent of the Applicant or the legal representative did not in fact have any provisions or prove the existence of any other plea in law. (37) In view of the specific circumstances of the case, the Authority concluded that both The processing of both the applicant's personal data and his special personal data is a legal basis therefore, the Applicant violated Articles 6 (1) and 9 of the GDPR. (38) In view of the above, the Authority granted the applicant's request pursuant to Article 58 (2) of the GDPR. Pursuant to paragraph 1 (f), the Applicant is prohibited from recording the sound by third parties to the Commission. IV.3. Principle of fair data management (39) The fairness of data processing is the principle governing data processing, the data subject respect for his or her privacy and human dignity. THE in accordance with the principle of fair data processing, the data subject may not become vulnerable to against the data controller or another person. (40) About the conversation about the Applicant with his legal representative without the Representative's knowledge was taken when the Applicant secretly, without informing those present, into his pocket used the recording device in secret. He did this to record a conversation 12 during which the Representative, i.e. the mother of the minor Applicant, did nothing about the recording suspecting her child has a number of sensitive privacy and health issues shared status information with the other two participants in the conversation. Given that the Representative did not know how to make the recording, and given he could not even count on him in the circumstances, so he could not protest against him. (41) The purpose of the meeting was to be the child of the Applicant and the Applicant to talk about the situation caused by conflicts and other problems between the two countries, and try to find a solution together. The Applicant was therefore aware of this put the conversation from the very beginning to be the focus of the Applicant will have problems with their behavior and their background. (42) In addition, the Applicant emphasized on several occasions during the discussion that with his questions or comments he tried to confirm that the Applicant was ill. An example of this phenomenon is the dialogue on the recording when the Requested To his representative that "I do not see you admitting that […]. ” the Representative begins his response with “I acknowledge,”. Also during the conversation the Applicant is repeatedly compared to other preschoolers as healthy with children. The Applicant also mentions his own child in such a context, indirectly referring to the Applicant's patient status: "I have the right to protect my healthy child." (43) The Applicant was therefore aware not only of the conversation but also of the knowing the sensitivity of what was said in the conversation - as an active participant in it and Shaper - shared the recording with third parties. (44) Sensitive, special data about the Applicant and the allusions to his behavior were made. The data transmission was suitable for a Applicant's judgment in the microenvironment, the parents of the kindergarten peers adversely affected. (45) In view of the above, the Authority finds that the Applicant has infringed Article 5 of the GDPR The principle of fair treatment under paragraph 1 (a) because in a situation decided to be uncomfortable for the Applicant, to the detriment of his fellow preschoolers indicating, emphasizing his illness, and distinguishing him from others transmission of a recording of a conversation when it would not have existed at all need to process personal and special personal data. IV.4. Other findings of the Authority (46) According to the Applicant, the Applicant violated the information self-determination CXII of 2011 on the right to freedom of information and freedom of information Act (hereinafter: the Information Act) Section 4 (1), Section 5 (1) (b), Section (2) (a) and Section 14 therefore processing is unlawful. 13 (47) The Authority firstly points out that the General Data Protection Regulation is applicable Infotv. protection of personal data the scope of the relevant provisions of The “new Infotv.”, I.e. Infotv Act CXII of 2011 on the right to information self-determination and freedom of information. amending the law in connection with the data protection reform of the European Union, and Act XXXVIII of 2018 amending other related laws. by law (a hereinafter referred to as the Modified Act) - § 2 (2) effective from 26 July 2018 states that personal data fall within the scope of the General Data Protection Regulation the general data protection regulation of the Infotv. in which provisions shall apply with specific additions. These do not include the Applicant provisions referred to in its request. (48) In view of the above, subject to the provisions of Article 2 of the GDPR, the present case The GDPR shall apply to the processing of data pursuant to IV.5. Legal consequences (49) The Authority granted the applicant's request pursuant to Article 58 (2) (b) of the GDPR. condemns the Applicant for violating Article 5 (1) (a) of the GDPR; (b) and (c), Article 6 and Article 9. (50) The Authority granted the Applicant’s request, the termination of the infringement and the in order to restore data protection in Article 58 (2) (f) GDPR prohibits recording, whether online or otherwise - and instructs the Applicant to refrain from such conduct in the future. (51) In addition, in accordance with Article 58 (2) (g) of the GDPR, the Authority instructs the The applicant shall be notified of the need to delete the recording to the addressees to whom the recording has been forwarded by e-mail. (52) The Authority examined of its own motion whether it was justified to impose a data protection imposition of a fine. In this context, the Authority will amend Article 83 (2) of the GDPR and Infotv. 75 / A. § considered all the circumstances of the case. In view of the circumstances of the case, The Authority found that in the case of the infringement found in the present proceedings, warning is a proportionate and dissuasive sanction, so the imposition of a fine is not required. (53) In its decision, the Authority took into account that the Requested Individual and the case in all its circumstances, it is presumed that it is possible to impose a fine without the imposition of a fine fully comply with the decision of the Authority and ensure the personal identity of the Applicant protection of your data. The Authority will specifically monitor compliance with this Decision, and in the event of non-compliance, impose a procedural fine or another data protection authority may initiate proceedings. Legal consequences in the event of a further data breach the present infringement will be taken into account as an antecedent with greater weight. 14V. Other issues (54) The powers of the Authority are limited to Infotv. Section 38 (2) and (2a) defines its jurisdiction it covers the entire territory of the country. (55) The decision is based on Article 80.-81. § and Infotv. It is based on Section 61 (1). The decision is Ákr. Pursuant to Section 82 (1), it becomes final upon its communication. (56) Art. Pursuant to Section 112 and Section 116 (1) and Section 114 (1) a administrative action against the decision and the winding-up order redress. (57) The rules of administrative litigation are laid down in Act I of 2017 on the Procedure of Administrative Litigation (a hereinafter: Kp.). A Kp. Pursuant to Section 12 (1), the Authority The administrative lawsuit against the decision of the Criminal Court falls within the jurisdiction of the court. 13. § (3) (a) (aa), the Metropolitan Court has exclusive jurisdiction. A Kp. Pursuant to Section 27 (1) (b), in proceedings falling within the jurisdiction of the General Court, the representation is mandatory. A Kp. Pursuant to Section 39 (6), the filing of the application a has no suspensory effect on the entry into force of an administrative act. (58) A Kp. Section 29 (1) and with this regard Pp. Applicable pursuant to Section 604, the of 2015 on the general rules of electronic administration and trust services CCXXII. Pursuant to Section 9 (1) (b) of the Act (hereinafter: E-Administration Act) the client's legal representative is obliged to communicate electronically. (59) The time and place of the application were set out in Kp. Section 39 (1). THE Information on the possibility of requesting a hearing is provided in the CM. Section 77 (1) - (2) based on paragraph The rate of the fee for an administrative lawsuit is set out in the 1990 Fees Act XCIII. Act (hereinafter: Itv.) 45 / A. § (1). The fee is preliminary from the payment of the Itv. Section 59 (1) and Section 62 (1) (h) exempt initiating proceedings. (60) If the Debtor does not duly prove the fulfillment of the prescribed obligation, a The Authority considers that it has not complied with the obligation within the time limit. The Ákr. Section 132 if the debtor has not made the obligation contained in the final decision of the authority meet, it is doable. The decision of the Authority Pursuant to Section 82 (1) a becomes final upon communication. The Ákr. Section 133 enforcement - if you are a law Government decree does not provide otherwise - it is ordered by the decision-making authority. The Ákr. Under Article 134 of the Enforcement - if by law, government decree or municipal local government decree does not provide otherwise in an official matter - the state tax authority. Infotv. Pursuant to Section 60 (7) in the decision of the Authority to perform a specific act, conduct or tolerate a specific act 15 the obligation to suspend the enforcement of the decision by the Authority implements. Budapest, September 23, 2021 Dr. Attila Péterfalvi President c. professor 16