NAIH (Hungary) - NAIH-2501-10/2022
|NAIH - NAIH-2501-10/2022|
|Relevant Law:||Article 5(1)(a) GDPR|
Article 5(1)(b) GDPR
Article 6(1) GDPR
Article 12(1) GDPR
Article 13 GDPR
Act CXIX of 1995 on the processing of name and address data for research and direct marketing
|Parties:||Magyar Éremkibocsátó Kft.|
|National Case Number/Name:||NAIH-2501-10/2022|
|European Case Law Identifier:||n/a|
|Original Source:||NAIH homepage (in HU)|
|Initial Contributor:||Abel Kaszian|
The Hungarian DPA fined a company €73,500 for using consent as general authorization to use personal data for any purposes and for failing to properly inform data subjects about separate processing purposes, including Google and Facebook advertisements.
English Summary[edit | edit source]
Facts[edit | edit source]
The controller is a limited liability company in Hungary and also part of the Samlerhuset Group, an international group of companies based in Amsterdam. It sold different versions of commemorative and historical coins, with a specific focus on Hungarian history. The controller acquired the data of its customers as follows: they can place an order by filling in a form, received as part of advertising materials via postal mail. This data includes name, address, phone number, e-mail address.
Since July 2020, the DPA received several complaints from data subjects concerning the processing of their data by the controller and objecting to its data processing practices. In most cases, the controller created a user account (profile) with the personal data provided during the purchase or ordering process. However, it only informed the data subjects afterwards about the processing. The DPA therefore carried out a test registration on the controller's website and analysed the privacy notices on the website and from the postal mail. Based on its findings, the DPA suspected an infringement of GDPR and launched an investigation.
During the DPA’s investigation, the controller provided the following information on its data processing: potential new customers received a promotional mailing by post. In the controller's view, this did not constitute direct marketing under the Hungarian Act CXIX of 1995 on the processing of name and address data for research and direct marketing. The controller argued that the promotional material was sent to the data subjects together with a newspaper, to which they were subscribed pursuant to a contract with another separate company. Thus, the controller did not contact data subjects directly by itself. The data subjects could then contact the controller online, by phone or by post, in case they would like to order coins.
In the online shopping process, the information on data processing is linked at the end of the order. The controller emphasized that the online registration did not involve the processing of any more personal data than a purchase without registration. It was also possible to order products by phone or by post, without registering an online account. The data subjects gave their consent by signing the order form in writing for postal orders, verbally for phone orders and by ticking a specific checkbox for online orders.
The controller also informed the DPA that for the purpose of targeted advertising on Facebook and Google social media platforms, the controller manually selected – without automated decision-making – a group of its customers with an e-mail address for whom the given advertisement may be relevant. This list of addresses was hashed and uploaded to the Facebook and Google advertising systems for the display of the advertisement to data subjects whose email address hash matched an element of the uploaded hash list.
The controller further stressed that it found data protection highly important, and it employed a dedicated data protection officer (DPO) as well.
Holding[edit | edit source]
The DPA found that, on the form sent out by the controller, the information was provided in very small print, so barely legible. When requesting consent for direct marketing, only the identity of the controller was indicated, with a very general purpose to send “further favourable offers.” The information also stated that the processing was unlimited in time and scope, until consent would be withdrawn. The DPA noted that a more specific purpose limitation and other information as required under Article 13 GDPR, as well as the fact of data transfer abroad, were completely missing. The DPA stated that Article 13 GDPR only provides the bare minimum content. Additional, case-specific information would be necessary for transparency and informed choice. On the forms of the controller, the mandatory data were distinguished from the non-mandatory data with a tiny asterisk. Thus, the DPA found that the average data subject was not given clear and easily accessible information. It was not possible to indicate that you only wanted to provide your data to receive updates on an order, and not for direct marketing. Individual purposes and individual contact methods were not separated on the postal form.
Over the phone – if the data subjects shared that they did not have an internet connection – a list of data processors was read out to them. In this case, it was not possible either to choose whether the data subject wished to consent to be contacted only by certain means, e.g. by post only, by phone only, by e-mail only, or by any combination of these. As in the case of postal communications, no information was provided about other forms of processing, such as Google and Facebook targeted advertising.
For online orders, the data subject could easily access the privacy notice, which contained information on data processing related to direct marketing. However, the DPA found that it was not possible to give specific, separate consent for receiving emails and targeted advertising through Google and Facebook. The DPA noted that the absence of any meaningful information on the use of these complex services in itself raised a serious validity issue in relation to consent.
With regard to the legal basis for consent, the DPA stressed that consent was not intended to be a general authorization for the controller to process any personal data without restriction, at any time and for any reason, irrespective of other legal conditions. It was only valid when requested for specific, separately identifiable purposes, and preceded by appropriate information that puts the data subject in a position to make an informed decision. Article 12(1) GDPR explicitly requires the controller to be result-oriented, i.e. to provide the data subject with the assistance necessary to enable him or her to exercise all his or her data subject rights in an informed manner. The DPA deemed it not the responsibility of the data subject to obtain the information from another source. It should be readily and reasonably available to them at the time of the request for consent. The DPA concluded a data subject would most likely not look online for information on data processing before placing an order by post or phone. This is also not expected by GDPR. The DPA held that the controller had an active obligation to provide the information to the data subject, appropriate for the communication channel used.
The DPA further stated that there was currently no DPO under the name of the controller in the designated database operated by the DPA (accessible for everyone). The controller also did not prove otherwise that it had in fact appointed a DPO. DPA noted that, if there was a technical reason beyond the control of the controller for which the entry was not made, it could have been detected and corrected by the controller in the last 4 years since the introduction of the GDPR, if it really considers data protection to be of high importance.
In short, the DPA found that the processing was explicitly for profit, using small print and without easily accessible information, implementing a poor business practice that was, and is problematic, even before the GDPR. The lack of adequate information put the data subjects in a position where they were not aware of their rights and how to exercise them. Therefore, the DPA fined the controller €73,500. The DPA further instructed the controller to modify its data processing practices in relation to direct marketing in order to properly separate specific purposes, obtaining the consent of data subjects, and providing them with adequate prior information appropriately. Also, to delete contact personal data where there was no valid consent.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.
File number: NAIH-2501-10/2022 Subject: decision History case number: NAIH-8700/2021 DECISION The National Data Protection and Freedom of Information Authority (hereinafter: Authority) On November 26, 2021, Magyar initiated an official data protection procedure opposite Éremkibocsátó Kft. (headquarters: 1054 Budapest, Szabadság tér 7; the hereinafter: Client) the processing of personal data of natural persons regarding its protection and the free flow of such data, as well as 95/46/EC Directive 2016/679/EU on repealing the directive (hereinafter: general investigation of suspected violations of the provisions of the data protection decree), in particular considering the source, purpose and its legal basis, the legality of its data transfers, and the enforcement of the data subject's rights subject. The Authority makes the following decisions in the above official data protection procedure: I. The Authority determines that the Client provided adequate prior information, specifically contact personal data processed in the absence of a specific purpose and a valid legal basis in relation to thousands of stakeholders, and thus violated the general lawful, transparent data management according to Article 5 (1) point a) of the Data Protection Regulation principle, the purpose-related principle according to Article 5 (1) point b), Article 12 (1) paragraph and Article 13 of the obligation to provide prior information, as well as in the absence of valid consent due to the above, Article 6 (1) of the General Data Protection Regulation paragraph and paragraph 2 of Article 7. II. The Authority based on Article 58 (2) point d) of the General Data Protection Regulation ex officio instructs the Customer to modify it as such by acquiring direct business related postal and telephone data management practices to comply with the general of the data protection regulation, i.e. indicate a corresponding specific goal or goals, the data subjects obtain your consent by providing the appropriate amount and form of prior information and delete the contact personal data currently processed for the above purpose to which a as above, could not be valid in accordance with the General Data Protection Regulation to obtain consent, or for other purposes with other legal grounds (e.g. contractual contact) in the case of usability, instead of deleting, do not handle it with valid consent contact data for direct business acquisition purposes. Informational self-determination CXII of 2011 on law and freedom of information. Act (hereinafter: Infotv.) 61. The deadline for filing an action to challenge the decision based on paragraph (6) of § until its expiration, or in the event of an administrative lawsuit, until the final decision of the court in dispute data affected by data management cannot be deleted or destroyed. III. The Authority ex officio the Customer due to the above data protection violations HUF 30,000,000, i.e. thirty million forints data protection fine obliged to pay. 2 The above II. the fulfillment of the obligation prescribed by the Customer towards this decision must be in writing within 30 days of the expiration of the legal remedy deadline - the supporting document together with the presentation of evidence - to prove it to the Authority. Data management exclusively in addition to defining the appropriate scope of data, for real and specific purposes, a valid legal basis, as well as data subject rights - including, but not limited to, prior information - it can be continued with proof of adequate insurance, otherwise the Customer has a must prove the termination of the data management in question to the Authority within the above deadline. The above III. fine according to point 30 days from the date of this decision becoming final within the forint settlement account of the Authority for the collection of centralized revenues (10032000-01040425-00000000 Centralized direct debit account IBAN: HU83 1003 2000 0104 0425 0000 0000) must be paid. When transferring the amount, "NAIH-642/2022 FINE.” number must be referred to. If the Customer does not fulfill his obligation to pay the fine within the deadline, he is in default is obliged to pay a penalty. The rate of penalty is the legal interest, which is is the same as the central bank base rate valid on the first day of the relevant calendar semester. Non-payment of the fine and late fee, as well as the above IV. obligation according to point in case of non-compliance, the Authority orders the implementation of the decision. There is no place for administrative appeal against the decision, but only from the announcement within 30 days from the date of issue, with a letter of claim addressed to the Capital Tribunal can be challenged in a lawsuit. The claim must be submitted to the Authority electronically, which forwards it to the court together with the case documents. The request for the holding of the trial is submitted by the must be indicated in the application. For those who do not receive full personal tax exemption the fee for the judicial review procedure is HUF 30,000, the lawsuit is subject to the right to record the fee. THE Legal representation is mandatory in proceedings before the Metropolitan Court. Infotv. Pursuant to § 61, subsection (2), point a), the Authority publishes this decision a Authority website. JUSTIFICATION I. Procedure and clarification of the facts 1. History matters 1.1. NAIH/2020/5802 to the Authority on July 28, 2020. an announcement was received at based on which the whistleblower objected to the Customer's data management practices. According to the announcement, it is The customer creates a user account with the personal data provided by the notifier during the purchase registered, and the Customer subsequently provided information about this fact. 1.2. The Authority CL. 2016 on the general public administrative order. law (a hereinafter: Ákr.) based on paragraph (1) of § 68, on October 8, 2020, the You completed a test registration on the website www.eremkibocsato.hu (hereinafter: Website). The Authority reports on this fact in Art. On the basis of § 68, paragraph (2), he subsequently informed the Customer 1 The NAIH_K01 form is used to initiate an administrative lawsuit: NAIH_K01 form (16.09.2019) The form is can be filled out using a general form filling program (ÁNYK program). 3 bearing in mind that in case of prior notice, the Customer would have had the opportunity to a To modify content available on the website prior to test registration. 1.3. In addition, the Authority noticed ex officio that letters sent by the Customer by post data management information provided in connection with this is likely to be considered infringing. 1.4. Based on the above, the Authority considered it justified to initiate an official inspection ex officio in order to verify that the data management practices used by the Customer does it comply with the requirements of the general data protection regulation, so the NAIH 1320-4/2021. the data protection authority control informed the Customer in its order no about its initiation and called him several times to provide a written statement in order to clarify the facts information on the questions asked in them. 1.5. The Authority, in accordance with Article 5 and Article 6 (1) of the General Data Protection Regulation, and due to the presumed violation of Articles 12, 13 and 14, the official control closed, and on November 26, 2021, the Ákr. ex officio on the basis of point a) of § 101, paragraph (1). initiated this official data protection procedure. 1.6. Infotv. On the basis of § 71, paragraph (2), the official knowledge of the Authority is considered to be In relation to the client, the facts and findings contained in the following documents are: In previous procedures related to the customer, the following arose: (i) Notice No. NAIH/2018/795/4/V of the Authority from the Authority's filing system. (ii) From the Authority's filing system, repeated Authority No. NAIH/2019/2181/2 prompting. (iii) From the Authority's filing system, the Authority's investigation No. NAIH/2019/2181/5 termination decision. (iv) Data provision No. NAIH-1320-5/2021 from the Authority's filing system is provided to the Customer and its annexes 1 - 7/A,B. 1.7. In notice No. NAIH/2018/795/4/V, the Authority stated that the Customer did not unlawfully delete the personal data of a data subject, and the data subject did not respond to the deletion at his request, and therefore called on the Customer to comply with the data subject's deletion request or a for the appropriate justification of the refusal and for informing the person concerned about it. 1.8. In repeated notice No. NAIH/2019/2181/2, the Authority stated that the Customer did not fully comply with notice No. NAIH/2018/795/4/V, therefore the Authority called on the Customer to make arrangements with the debt collector's data processor on the complete deletion of the data subject's personal data, since there is no outstanding debt on this data management is illegal. 1.9. The Authority in the decision terminating investigation No. NAIH/2019/2181/5 determined that the data related to the non-existing claim was deleted by the Customer, a it handles the remaining data on the basis of legal obligations, thus giving rise to the continuation of the investigation in the absence of taxing circumstances, the Authority terminated the investigation. 1.10. During the provision of data under NAIH-1320-5/2021, dated February 22, 2021, the The customer made the following statements relevant to the decision and attached documents: 4 (i) New customers will be mailed promotional mail that does not qualify of 2008 on the basic conditions and certain limitations of economic advertising activity. year XLVIII Act (hereinafter: Grtv.) direct according to § 6, paragraph (1). for acquiring business, since the subscriber involved the advertising material with another company it is received along with the newspaper subscribed to based on the concluded contract, in addition, the Customer does not contacts the affected parties directly. (ii) The information is the data provision no. 2. attached, the materials sent copy of no. 3 are found in the appendix. (iii) The script used during the telephone order is data provision no. 4. can be found in the appendix. (iv) The online shopping process is described in data provision no. 5. annex is included, and the screenshots of the webshop are included in the data service 6/A-B. s. annexes, and the data management is linked at the end of the order information. (v) The process of online shopping is described in data provision 7/A-B. s. presented in its appendices. (vi) Products can be ordered by phone or by mail without registering an online account to your order. (vii) Online registration is required to complete the order, no more personal registration is required processing of data as purchasing without registration would entail, in this regard it is online data management information 1.3. and 1.4. point contains information. (viii) Data provision no. 8 annex to the Customer's data management register a copy of data processing in connection with product orders. (ix) The data subject gives his consent to the communication material in case of mail order in writing by signing the attached order coupon, or verbally in the case of phone orders, in the case of an online order, enter it by ticking a separate check-box. (x) The Customer does not process personal data based on the Customer's legitimate interests. (xi) From May 25, 2018 until the date of data provision, the Customer has received 647 deletion requests replied within the deadline. (xii) Skarbnica Narodowa Sp. z.o.o. (seat: Aleja Jana Pawla II 19, 00-854 Warsaw, Poland; hereinafter: Company 1) and Samlerhuset Group B.V. (head office: Landdrostdreef 100, 1314 SK Almere, The Netherlands; hereinafter: Company 2) perform database management activities for the Customer in terms of data management in accordance with point 2 of the information sheet and belong to the Customer's company group. (xiii) For the purpose of targeted advertising on Facebook and Google social media platforms The customer manually - without automated decision-making - selects a list of the e- of a group of customers with e-mail addresses for whom the given ad is intended may be relevant, and this e-mail address list is uploaded by Facebook and Google based on the hash principle in its advertising system to display the ad to those concerned for whom it is the hash of your e-mail address matches an element of the uploaded hash list. 5 (xiv) Data provision no. 2 "text of data management information" according to Annex The content of the text is as follows: "With my signature, I declare that the Magyar Éremkibocsátó Kft.'s policy is available at www.eremkibocsato.hu/adatkezeles I have read and accepted it, I acknowledge that my data is marked there for the purpose and duration of Magyar Éremkibocsátó Kft. (1054 Budapest, Szabadság tér 7., Bank Center Office Building, Citi Tower, 7th floor, www.eremkibocsato.hu) is managed by Direct text of marketing consent: ☐ Yes, I give my consent for additional benefits to receive offers as long as I do not indicate my intention to the contrary over the phone, by e-mail or at the given postal address.". (xv) Data provision no. 2 in its annex, the Client declared to the Authority that Entering the e-mail address and phone number is not mandatory, but this does not apply to the above part of information. (xvi) Data provision no. 2 according to its annex, to existing customers with the invoice the following data management by means of a combined marketing offer (double invoice). provides information: "If you do not have a need for our new products in the future for information, please let us know if you wish to unsubscribe email@example.com e-mail, or Magyar Éremkibocsátó Kft. (1519 Budapest Pf.: 341) at its postal address or at the telephone number 06 80 888 889.". (xvii) Data provision no. 2 according to its annex, other advertising mailings (Delivery Offer, Direct Mail, Target Group Mailing, Passive Customer Mailing) data management the text of the information is as follows: "With my signature/order, I declare that a Magyar Éremkibocsátó Kft. is available on the website www.eremkibocsato.hu/aszf General I have read and accept its Terms and Conditions, as well as acknowledge and I accept that Magyar Éremkibocsátó Kft. and its partners a The regulations that I am familiar with are available on the website www.eremkibocsato.hu/adatkezeles my data will be used as indicated there. If in the future does not claim information about our news, offers, etc If you wish to unsubscribe, please send an e-mail to firstname.lastname@example.org or at the postal address of Magyar Éremkibocsátó Kft. (1519 Budapest Pf.: 341) or on the phone number 06 80 888 889.". (xviii) Data provision no. 3 annex (sample advertising offer attached to an invoice) existing customers received the following information along with the product: "If in the future you do not have a claim related to our new products and offers for information, please indicate your intention to unsubscribe email@example.com e-mail, or Magyar Éremkibocsátó Kft. (1519 Budapest Pf.: 341) at its postal address or at the telephone number 06 80 888 889.". (xix) Data provision no. 3 in the samples for existing customers according to the Annex for the order of the new product, for the validity of the order the required signature also means the consent of the interested party is given later for direct inquiries according to the information with the same text as above, none it is possible to order in such a way that the person concerned does not contribute to the subsequent direct for searching. (xx) Data provision no. 3 sample for new customers according to Annex a data required for ordering (name, address, telephone number, e-mail address) a to order, and in this connection it is mandatory to indicate it with an asterisk character data, which are name and address. The star is extremely large, barely visible. There is no 6 it is possible to indicate, if the person concerned, the telephone number and e-mail address data of the direct you don't want to enter it for the purpose of inquiry and only the order is easier would provide these for tracking. (xxi) Data provision no. 3 according to the annex, the sample for new customers is separate contains a check-box for giving the consent of the affected person later directly search, the text of which is the following in small, barely legible font size: "☐ Yes, I give my consent to receive further favorable offers as long as until I indicate my intention to the contrary by phone, e-mail or by the specified post at address. [date, signature, Attention! Your order is invalid without your signature.] With my signature, I declare that Magyar Éremkibocsátó Kft. a I have read the regulations available at www.eremkibocsato.hu/adatkezeles and I have accepted, I acknowledge that my data will be used for the purpose indicated there and for a period of time, Magyar Éremkibocsátó Kft. (1054 Budapest, Szabadság tér 7., Bank Center Office Building, Citi Tower, 7th floor, www.eremkibocsato.hu). (xxii) Data provision no. 4 according to its annex, in the case of a telephone inquiry, it is the text of the data management information is as follows: "Regarding your order, data controller Magyar Éremkibocsátó Kft. and a Information available on the website https://www.eremkibocsato.hu/adatkezeles partners manage your personal data. The purpose of data management is the Hungarian Medal Issuer Fulfilling orders given to Kft., maintaining contact with customers, complaint handling, webshop operation, and possible claims validation. With data management, especially with your rights you can request further information on any of the following contact details: Mailing address: 1519 Budapest, Pf. 341; E-mail address: firstname.lastname@example.org, phone number: 0680-888-889; text of consent: You consent to a Magyar Éremkibocsátó Kft. also uses the provided contact information to make it unique with its offers and news through direct business acquisition by mail, telephone or electronic means can be found on the website https://www.eremkibocsato.hu/adatkezeles as stated in the information sheet? Consent is voluntary and can be withdrawn at any time on any of the contact details just described.". (xxiii) Data provision no. 4 in its annex, the Customer stated that if the affected who was called on the phone says that he does not have internet or cannot watch it the list of data processors, then the administrator will read it to the data processors list. (xxiv) Data provision no. 5 online order based on its attachment and is required for that during registration, data management consent can be given with separate check boxes both simultaneously and separately for each channel (mail, telephone, e-mail) regarding, and the data management information on the home page of the website It is available from the "Data management" menu item. 2. This official data protection procedure 2.1. In this data protection official procedure, the Customer, upon request of the Authority, 2021. In his reply letter received on December 17, sent to NAIH-8700-2/2021, the following made statements relevant to the decision: 7 (i) Source of personal data used for data management for direct business acquisition the person concerned, its purpose is direct business acquisition, direct marketing activity, its legal basis is according to Article 6 (1) point a) of the general data protection regulation concerned consent, data processing lasts until the withdrawal of consent. (ii) Data subjects give their consent to data management by postal order by signing the coupon in writing, in the case of phone orders orally, online in the case of an order, it is specified by checking a separate checkbox. (iii) The personal data used for direct business acquisition includes the data of the previous purchase, i.e name, address, telephone number and e-mail address of the person concerned. (iv) Those concerned about data management in the order process, the consent will be informed in advance of the date of February 22, 2021 (NAIH-1320-5/2021 filed under no. 1.1. according to point and 2-7/A-B annexes. (v) Those concerned exercise their rights by post, by telephone, via the Customer's website, or e- they can practice by email. (vi) The Customer properly ensures the rights of stakeholders, in this context the Customer a It cooperates with authorities, for example, the investigation No. NAIH/2019/2181 is also terminated after their cooperation. (vii) The Customer complies with the principle of built-in and default data protection in its processes properly designed to ensure that they comply with the relevant legislation compliance and data security. (viii) The Customer considers data protection to be of the utmost importance, therefore a separate data protection policy employs an official, which was announced by the Authority on August 28, 2018 for. (ix) Since May 25, 2018, the Client has received hundreds of data deletion requests from stakeholders in connection with which the Customer answered within the deadline, without any complaints from stakeholders and settled. 200 per month on average in connection with the Customer's direct marketing materials requests are received, which the Customer fulfills. (x) In 2018, the Authority carried out an official inspection in connection with a data protection incident and it It was closed by decision on January 18, 2019, as the Customer did the necessary steps to deal with the incident (notification, police report, etc.). (xi) The net sales revenue of the Customer in 2020 was HUF 2,332,576,000. (xii) 8 of the application filed by the Client to the Company 2 under the number NAIH-1320-5/2021. forwarded by the data subjects as described in the data management register according to Annex your personal data. The legal basis for data transfers is the same as data management with its legal basis. (xiii) The Customer maintains NAIH-1320/2021 unchanged. official case number started statements made during the inspection. (xiv) For the Customer's statements no. 1. according to the data management register attached as an attachment The legal basis for data processing related to direct business acquisition is the general data subject consent according to Article 6 (1) point a) of the Data Protection Regulation. 8 2.2. In this data protection official procedure, the Customer, upon request of the Authority, 2022. In his reply letter received on February 24, sent under number NAIH-2501-3/2022, the following made statements relevant to the decision: (i) Data is transmitted to the Company 2 as a data processor, both the Customer and it On behalf of other companies belonging to the Customer's company group, however, by the Customer transmitted data will not be transmitted to other members of the company group, that is the purpose of data transfer is exclusively database management tasks by Company 2 supply to facilitate the operation of the Customer. (ii) The following types of data in the customer database operated by Company 2 can be found: contact details, details of current and previous orders, customer service communication and in connection with visiting the Customer's website generated data. (iii) The Customer does not forward personal data to third parties for the purpose of so that they can contact the stakeholders with their own offers. (iv) Company 1, as a data processor, monitors the debts of the affected customers, thereby reports to the Customer, for example, if a certain amount is exceeded, and performs invoicing tasks related to lost shipments. 2.3. The Akr. Pursuant to § 76, the Authority is the Client after the completion of the proof procedure invited him to make a statement and indicated that the Customer is entitled to document inspection view the case documents. At the request of the Authority, the Client on April 26, 2022, the present to the procedure documents - including note No. NAIH-2501-2/2022 on February 11, 2022 in copy I.1.6, made part of this procedure. documents according to point - he inspected them, but not about them requested a copy. After that, the Customer is free from the inspection of documents specified by the Authority did not make a new statement within the 15-day deadline. 2.4. The Authority noticed ex officio that the official https://e-beszamolo.im.gov.hu is public based on the latest electronic report found on the portal, the Customer's net for 2021 its sales revenue was HUF 2,214,700,000 (published: 30.05.2022). II. Legal provisions applicable in the case According to recital (74) of the General Data Protection Regulation, personal data processing of any kind by the data controller or on behalf of the data controller the authority and responsibility of the data controller must be regulated. The data controller must be obliged, in particular, to implement appropriate and effective measures, and to be able to prove that the data management activities are general they comply with the data protection regulation, and the effectiveness of the measures applied is the same level required by the general data protection regulation. These measures are data management its nature, scope, circumstances and purposes, as well as natural persons it must be made taking into account the risk to your rights and freedoms. According to recital (171) of the General Data Protection Regulation, the general data protection regulation repeals directive 95/46/EC. General data protection data processing started before the date of application of the regulation is governed by the general data protection Within two years from the date of entry into force of the Decree, Article 9 must be harmonized with the general data protection regulation. If the data management is according to Directive 95/46/EC is based on consent and the data subject meets the conditions set out in the General Data Protection Regulation has given his consent in accordance with the that the data controller also after the date of application of the general data protection regulation continue data processing. Decisions taken by the Commission on the basis of Directive 95/46/EC, and the licenses issued by the supervisory authorities remain in force as long as until they are amended, replaced or repealed. According to Article 2 (1) of the General Data Protection Regulation, the general data protection regulation must be applied to personal data in part or in whole in an automated manner processing, as well as the non-automated processing of data that are part of a registration system or which are a registration system want to be part of. Pursuant to Article 4, point 7 of the General Data Protection Regulation, "data controller" is the natural or legal entity, public authority, agency or any other body that is personal determines the purposes and means of data management independently or together with others. If that the purposes and means of data management are determined by EU or member state law, the data manager or special considerations for the appointment of the data controller by the EU or the Member States can also be determined by law Pursuant to Article 4, point 11 of the General Data Protection Regulation, it is "the consent of the data subject". of the will of the person concerned, based on voluntary, specific and adequate information and clear declaration by which the relevant statement or confirmation is unambiguously expressed indicates by action that he gives his consent to the processing of his personal data. According to Article 5 (1) point a) of the General Data Protection Regulation, personal data must be handled legally and fairly, as well as in a transparent manner for the data subject carry out ("legality, due process and transparency"). According to Article 5 (1) point b) of the General Data Protection Regulation, personal data should only be collected for specific, clear and legitimate purposes and should not be processed in a manner inconsistent with these purposes; in accordance with Article 89 (1). is not considered incompatible with the original purpose for the purpose of archiving in the public interest, further data management for scientific and historical research purposes or for statistical purposes ("goal-boundness"). According to Article 6 (1) of the General Data Protection Regulation, personal may be legal processing data if at least one of the following is met: a) the data subject has given his consent to his personal data for one or more specific purposes for its treatment; b) data management is necessary for the fulfillment of a contract in which the data subject is one of the parties, or at the request of the data subject prior to the conclusion of the contract necessary to take steps; c) data management is necessary to fulfill the legal obligation of the data controller; d) data management is vital for the data subject or another natural person necessary to protect your interests; 10 e) data processing is in the public interest or the data controller is authorized by a public authority necessary for the execution of a task performed in the context of its exercise; f) data processing is for the legitimate interests of the data controller or a third party necessary for its enforcement, unless priority is given to these interests enjoy the interests or fundamental rights and freedoms of the data subject which they require the protection of personal data, especially if the person concerned is a child. According to Article 7 (2) of the General Data Protection Regulation, if the consent of the data subject given in the context of a written statement that also applies to other matters, a request for consent in a way that is clearly distinguishable from these other cases must be presented in an understandable and easily accessible form, with clear and simple language. The any part of such statement containing the consent of the affected party which violates the General Data Protection Regulation does not have binding force. Based on Article 12 (1) of the General Data Protection Regulation, the data controller is compliant takes measures in order to allow the data subject to process personal data all relevant information mentioned in Articles 13 and 14 and Articles 15-22 and Article 34 according to each information is concise, transparent, comprehensible and easily accessible provide it in a clear and comprehensible form, especially to children for any information received. Based on Article 13 (1) and (2) of the General Data Protection Regulation, if the personal data were obtained from the data subject, the data controller makes the data available to the data subject following information: a) the identity of the data controller and, if any, the representative of the data controller and your contact information; b) contact details of the data protection officer, if any; c) the purpose of the planned processing of personal data and the legal basis of data processing; d) in point f) of Article 6 (1) of the General Data Protection Regulation in the case of data management based on the legitimate interests of the data controller or a third party; e) where applicable, recipients of personal data, and categories of recipients, if any such; f) where appropriate, the fact that the data controller is in a third country or international organization wishes to forward the personal data to, and the Commission the existence or absence of a compliance decision, or general data protection regulation in Article 46, Article 47 or Article 49 (1) second in the case of data transfer referred to in subsection, the appropriate and suitable guarantees designation, as well as the methods for obtaining a copy of them or that reference to their availability; g) on the duration of storage of personal data, or if this is not possible, on this aspects of determining the duration; h) on the data subject's right to request from the data controller the personal data relating to him access to data, their correction, deletion or management 11 limitation and may object to the processing of such personal data, as well as the about the data subject's right to data portability; i) or in point a) of Article 6 (1) of the General Data Protection Regulation in the case of data management based on point a) of Article 9 (2) a right to withdraw consent at any time, which does not affect the legality of the data processing carried out on the basis of consent prior to withdrawal; j) on the right to submit a complaint to the supervisory authority; k) that the provision of personal data is legal or contractual whether it is based on an obligation or a prerequisite for concluding a contract, and whether it is whether the data subject is obliged to provide personal data, and how it is possible failure to provide data may have consequences; l) mentioned in paragraphs (1) and (4) of Article 22 of the General Data Protection Regulation the fact of automated decision-making, including profiling, as well as at least in these cases it is understandable for and regarding the applied logic information about the significance of such data management and for the data subject what are the expected consequences. Based on Article 13(4) of the General Data Protection Regulation, Article 13(1)-(3) it does not have to be applied if and to what extent the data subject already has the information. For data management under the scope of the General Data Protection Regulation, Infotv. Section 2 (2) according to paragraph of the general data protection regulation in the provisions indicated there must be used with included additions. Infotv. Validation of the right to the protection of personal data based on § 60, paragraph (1). in order to do so, the Authority initiates an official data protection procedure at the request of the data subject and may initiate official data protection proceedings ex officio. Infotv. According to § 61, paragraph (1), point a), it was made in the official data protection procedure in its decision, the Authority issued Infotv. Data management defined in paragraph (2) of § 2 in connection with operations defined in the general data protection regulation may apply legal consequences. Infotv. Pursuant to § 71, paragraph (2), the Authority lawfully acquired during its procedures can use documents, data or other means of proof in other proceedings. Infotv. 75/A. Based on § 83 of the General Data Protection Regulation, Article 83 (2)–(6) exercises its powers in accordance with the principle of proportionality, especially with the fact that you are in the legislation regarding the handling of personal data The regulations defined in the mandatory legal act of the European Union are being implemented for the first time in case of violation, to remedy the violation - with Article 58 of the General Data Protection Regulation in accordance with - takes action primarily with the warning of the data manager or data processor. It is ordered by the Authority based on Article 58 (2) point d) of the General Data Protection Regulation the data manager or the data processor to perform its data management operations - where applicable in a specified manner and within a specified time - is harmonized by the general with the provisions of the data protection regulation. 12 On the basis of Article 58 (2) point i) of the General Data Protection Regulation, the Authority has the 83. imposes an administrative fine in accordance with Article, depending on the circumstances of the given case in addition to or instead of the measures mentioned in this paragraph. Based on Article 83 (1) of the General Data Protection Regulation, all supervisory authority ensures that paragraphs (4), (5), (6) of the general data protection regulation due to the said violation, each of the administrative fines imposed on the basis of this article should be effective, proportionate and dissuasive. According to Article 83 (2) of the General Data Protection Regulation, administrative fines depending on the circumstances of the given case, Article 58 (2) of the General Data Protection Regulation must be imposed in addition to or instead of the measures mentioned in points a)-h) and j) of paragraph When deciding whether it is necessary to impose an administrative fine or a sufficiently in each case when determining the amount of the administrative fine the following should be taken into account: a) the nature, severity and duration of the infringement, taking into account the one in question the nature, scope or purpose of data management, as well as the number of data subjects whom the affected by the infringement, as well as the extent of the damage suffered by them; b) the intentional or negligent nature of the infringement; c) damage suffered by data subjects on the part of the data controller or data processor any measures taken to mitigate; d) the extent of the responsibility of the data controller or data processor, taking into account the technical performed by him on the basis of Articles 25 and 32 of the General Data Protection Regulation and organizational measures; e) relevant violations previously committed by the data controller or data processor; f) the remedy of the violation with the supervisory authority and the possible negative nature of the violation extent of cooperation to mitigate its effects; g) categories of personal data affected by the infringement; h) the manner in which the supervisory authority became aware of the violation, in particular whether the data controller or the data processor has reported the violation, and if so yes, in what detail; i) if against the relevant data manager or data processor earlier - in the same in the subject matter - ordered Article 58 (2) of the General Data Protection Regulation one of the measures mentioned in paragraph compliance with measures; j) whether the data manager or the data processor considered himself to be the general for approved codes of conduct pursuant to Article 40 of the Data Protection Ordinance or approved certification according to Article 42 of the General Data Protection Regulation for mechanisms; as well as k) other aggravating or mitigating factors relevant to the circumstances of the case, for example, financial acquired as a direct or indirect consequence of the infringement profit or avoided loss. 13 In the absence of a different provision of the General Data Protection Regulation, the application was initiated for official data protection procedure, Art. provisions shall be applied in Infotv with certain deviations. Grtv. According to paragraph (1) of § 6, unless a separate law provides otherwise, advertising by directly contacting a natural person as an advertising recipient (a hereinafter: direct business acquisition), so especially electronic correspondence or with it through another equivalent individual means of communication - defined in paragraph (4). with an exception - it can only be disclosed if the recipient of the advertisement is clearly informed in advance and specifically contributed. Grtv. According to paragraph (4) of § 6, the addressee of advertising mail is a natural person such as a for the recipient of advertising through direct business acquisition, the recipient is preliminary and explicit it can be sent even without your consent, but the advertiser and the advertising service provider are obliged to ensure that the recipient of the advertisement can send the advertisement at any time free of charge and without restriction can prohibit without. In the event of a ban, direct advertising to the person concerned can no longer be sent through business acquisition. III. Decision 1. The data controller and data processors 1.1. According to the established facts, the Customer brought the examined direct himself decisions related to data management for the purpose of acquiring business, it was not determined by others purpose and means of data management. 1.2. No evidence has emerged that the Customer is other than its data processors would have forwarded it to a third party through data management for the purpose of direct business acquisition processed personal data in connection with, no other data controller could be identified. 1.3. Based on the above, in the case of all data processing examined in this case, it is the obligee of all data management obligations related to data management is general Based on Article 4, Point 7 of the Data Protection Regulation, the Customer. 2. Provided in connection with personal data related to direct business acquisition information for each connection method 2.1. Since the source of personal data is new customers, the Authority is primarily new customers investigated the acquisition of his data, as the legality of this and the then determined conditions also determine subsequent data management. Already in progress for existing customers during data processing, the validity of the data subject's consent prior to the consent information is also basically defined. Illegally obtained personal data in the future, its handling will not be by itself with subsequent information and references behavior is legal if the information is not followed by active, specifically consent an act aimed at granting. Article 4 Article 11 and Article 7 of the General Data Protection Regulation (2) and the European Data Protection Board 5/2020 regarding consent Based on paragraph 81 of its guidelines, consent cannot be obtained with the same a with an act, such as consent to a contract (in this case, signing the order 25/2020 Guidelines on consent pursuant to Regulation (EU) 2016/679, date of adoption: May 4, 2020, (hereinafter: 5/2020 Guidelines), availability: https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_hu.pdf 14 by existing customers). Because of all this, the Authority investigated in more detail that a how personal data was obtained for new customers. For existing customers apart from the order, there was no other stakeholder declaration, so the validity of the consent is the new one developed in the same way as customers. 2.2. Information provided in case of mail order 2.2.1. By mail, on many occasions, a significant number of people who cannot be precisely determined are involved receive advertising materials in addition to your newspaper subscription arising from other legal relationships, and on this The Customer can place an order by filling in the form received as part of the advertising materials to its products. 2.2.2. The information on the Customer's form is in extremely small letters, barely legible 3 is happening. When requesting consent, the information is provided exclusively to the person of the data controller, the very general purpose for the Customer to send "favorable offers" to the concerned subject and the legal basis of the consent, the revocability of the consent and indicates its management until withdrawal and the availability of further information online. THE more specific goal determination, and others according to Article 13 of the General Data Protection Regulation provision of information with sufficient specificity and data management a foreigner is fundamentally necessary for its transparency, but not obvious to those involved the fact of data transmission is also completely absent. 2.2.3. Article 13 of the General Data Protection Regulation only defines minimum content, i.e in the case of individual data management, it is necessary to provide all information that is necessary for transparency and a considered decision. Mandatory and non-mandatory Mandatory data in connection with the order, not marketing they were indicated in the section on data management and with a small star that almost it is illegible, so the average person concerned is not clear and easily accessible information when requesting consent. It is not possible to indicate if the affected phone number is and e-mail address data for the purpose of direct inquiry, and only a for easier tracking of the order, would you enter these, each goal and each contact methods are not separated on the postal form. 2.3. Information provided when ordering by phone 2.3.1. By telephone, the above III.2.2. problems explained in subsection arise with the with the addition that if the person concerned does not have an internet connection, their statement according to, then the list of data processors will also be read to them (general data protection Regulation Article 13 (1) point (e)), and in relation to marketing data management a goal definition is more specific than the postal text, not so meaningless ("contributes in order for [the Customer] to use the provided contact information also because it is unique with its offers and news through direct business acquisition by mail, telephone or electronic means search for it”). 2.3.2. However, even in the case of telephone consent, it is not possible to choose, if only one the interested party wishes to contribute to the inquiry in the following ways, e.g. you are only by post, only by phone by e-mail only or by indicating any combination of these. Article 13, paragraph (1) point (a) of the 3rd General Data Protection Regulation 4 General Data Protection Regulation Article 13 (1) point (c). Article 13 (2) point (c) of the General Data Protection Regulation General Data Protection Regulation Article 13 (1) (b), (e), (2) (b), (d), (e), (f) 15 2.3.3. As with postal information, it is not the same in the case of telephone information providing information to the data subject about other data management methods apart from the above, for example Google and Facebook targeted advertising using the e-mail address, but not an e-mail message through targeted website advertising. 2.4. Information provided when ordering online 2.4.1. In the case of an online order, unlike the above, the phone number and e-mail address are mandatory data to be provided, but consent can be given separately for each inquiry method give. 2.4.2. However, the wording "electronically" is too broad a term, it is by e-mail in addition to the request, any other - not visible to the affected person in advance, even future - relational it may also include a form to which the person concerned may not necessarily wish to do so contribute in any form chosen by the Customer. 2.4.3. There is no option to send an e-mail message or be targeted online by Google and Facebook to separately consent to the processing of data related to advertisements, even though they are very different and data processing affecting the privacy of the affected person to a significantly different extent. Google, Facebook and the transparency and data protection issues of similar mass automated advertising systems it is not investigated by the Authority, but by the competent data protection authorities of foreign Member States, that is not the subject of this proceeding. However, the above is still dubious and difficult to understand the lack of any meaningful information about the use of services is serious in itself raises a validity problem with the consent requested by the Client from the data subjects in connection. 2.4.4. In the case of online ordering, unlike the above, the person concerned can easily access a www.eremkibocsato.hu/adatkezeles for online information, which is for direct marketing contains information related to related data management. 2.4.5. The Authority provides online information only for data processing related to direct marketing closely related to the subject of the present proceedings, not everything there with regard to listed data management. Given that apart from online orders it is stakeholders cannot simply access this information through the channel on which the non-online order is made, therefore the content of the online information is the present decision was largely irrelevant. 3. Obligation to provide appropriate information 3.1. According to Article 12 (1) of the General Data Protection Regulation, the Customer is considered independent the obligation of the data controller to take appropriate measures to ensure that concerning the processing of personal data for those concerned, referred to in Articles 13 and 14 all information and 15-22. and each information according to Article 34 is concise, in a transparent, comprehensible and easily accessible form, in a clear and understandable way provide it formulated. 3.2. The system of appropriate information in the general data protection regulation serves to so that the data subject can be aware of which personal data, which data controller and for which purpose, how you will handle it. This is essential to be in a position to to be able to meaningfully exercise its stakeholder rights. 16 3.3. There is a significant risk involved in the extensive and large number of contributors by processing the personal data of data subject no in context. For this reason, there is an increased expectation of information. Adequate information in its absence, by definition, the data subject is not in a position to properly exercise his rights practice and make a real contribution to something you are not fully aware of. The Recital (74) of the General Data Protection Regulation and Article 24 (1). and on the basis of Article 25 (1), the data controller is responsible for the rights of data subjects must meet expectations commensurate with its reported risk. 3.4. Data management based on point a) of Article 6 (1) of the General Data Protection Regulation based on Article 4, point 11 of the General Data Protection Regulation, not only the data management beginning, but before obtaining consent, the data controller is obliged to to provide information on the basis of which informed consent can be given. 3.5. In relation to the legal basis of data subject consent according to the General Data Protection Regulation it is important to emphasize that it does not mean that the data controller is subject to other legal obligations applies as a general authority regardless of conditions that at any time and can handle any personal data without limits for any reason. For data management stakeholder consent can only be valid if it is for specific purpose(s) - per purpose can be specified separately - they ask, and before that they provide adequate information, which in such a situation brings the data subject to be able to make an appropriate decision about giving consent, and complies with all other validity conditions prescribed in the General Data Protection Regulation requirement. Article 12 (1) of the General Data Protection Regulation specifically imposes a performance obligation on the data controller, i.e. the data subject needs such help provide, so that all stakeholders can exercise their rights in an informed manner. 3.6. As explained above, the obligation to provide information is not a mere "paperwork" is an obligation in the General Data Protection Regulation. Everything contained in the preamble, all the articles of the General Data Protection Regulation require the data manager to achieve results in determining its obligations, not just a specified minimum effort confirmation by the data controller. The purpose of the information is to put you in such a situation data subject to be in the appropriate decision-making position by exercising the data subject's rights in connection. 4. Lack of adequate information 4.1. Based on Article 12 (1) of the General Data Protection Regulation, it is not enough if it is data controller signs with the data subject a statement that from another source, the data controller became familiar with the data management before knowing its existence and intention to enter into a contract related information. It is not the responsibility of the data subject to provide information from other sources acquisition, it can be easily and reasonably expected during the given consent request should be available. It is rare to be affected by mail or telephone orders you seek online data management information beforehand, and this is not your obligation. The client acknowledged in his statements regarding the telephone script, there may be a number of stakeholders who does not have internet access or is not easily able to post or telephone to search for information on the Internet during or before ordering. Because this cannot be known which exists for data subjects, based on Article 12 (1) of the General Data Protection Regulation The customer has an active obligation to make the information available to the data subject in such a way which is adapted to the currently used communication channel. 5/2020 Paragraph 62 of the guidelines also states that if the data controller does not provide access information, the user's control over the data becomes apparent, and the 17 consent becomes an invalid basis for data management. Ease of access is essential its requirement is also confirmed by paragraphs 66 and 67 of Directive 5/2020. 5/2020 Based on paragraph 69 of the guidelines, it is possible in the case of information provided electronically typically use multi-level information. This option is basically not available for the postal route its nature can be interpreted, access to additional information is a disproportionate time investment would cause and it is impractical to base the information on this. 4.2. Because the Customer creates the form and quantity of his choice out and send it attached to a newspaper, or read it over the phone to your new customers, that is basic information from the point of view of data management (for example, in the case of a postal route, the more specific, destination indicated on the phone) and the separate consent per destination and connection method ensuring the possibility not only during online data management, but on all channels possible and expected from the Customer. Other provisions of the general data protection regulation in relation to the legal basis of consent, Article 6 (1) of the General Data Protection Regulation point a) of paragraph also highlights the possibility of contributing by specific purpose necessity. This does not preclude the provision of an option by means of which all it is possible to contribute to a specified goal at the same time, but there must be an option in addition to this to give separate consent for certain purposes. 4.3. Article 4, point 11, Article 7, paragraph 2 of the General Data Protection Regulation, and 5/2020 Paragraph 90 of the guidelines also confirms that the data subject's consent is a legal basis in the case of its application, the consent of the data subject must always be obtained before that the data controller would start the personal data management for which you have consented need. 5/2020 Guideline regarding information regarding consent Paragraph 63 also highlights that it concerns consent based on information the consequence of not complying with the requirements is that the consent will be invalid and the controller may violate Article 6 of the General Data Protection Regulation. 4.4. Based on paragraph 64 of Directive 5/2020, in order for the consent to be informed be based on, the person concerned must be informed of certain things that are crucial for decision-making about elements. Therefore, the European Data Protection Board considers that valid consent at least the following information is required: (i) the identity of the data controller - this has been fulfilled; (ii) the purpose of each data processing operation for which consent is requested - this is a not suitable as above; (iii) what type of data is collected and used - this was not fulfilled, a on the management of shopping habits data for marketing purposes and profiling based on this no information is sent by post or telephone; (iv) the existence of the right to withdraw consent - this has been fulfilled; (v) where applicable, to use the data for automated decision-making relevant information in accordance with point c) of Article 22 (2) - this is present is not applicable in this case, although there is no information by mail or telephone that this is the case does not happen, and manual sorting is done based on shopping habits; (vi) the compliance decision for data transmissions and described in Article 46 possible risks arising from the lack of adequate guarantees - this is not the case in this case guide, no information about this has arisen. 18 4.5. The above list also explicitly indicates that it is based on Article 13 of the General Data Protection Regulation only a minimum requirement, but in addition it is necessary to provide all information, which may be important in the decision of a typical person concerned, for example to go abroad (also within the European Union) large-scale and regular transmission of data, or for targeted advertisements use (with the possibility of a separate contribution). These elements were also missing the postal and from telephone information. 4.6. Based on what was explained above, the Customer did not fulfill the legal requirements in a significant part expectations for personal data collected in connection with postal and telephone orders during processing for the purpose of obtaining direct business, and in the case of online orders a for the concreteness of consent, the term "electronically" needs to be clarified, which is not meets the requirement of adequate information. In addition, it is outside the e-mail address provided other way, e.g. Targeted direct advertising on the Google and Facebook advertising systems a separate consent would be required to request personal data in any way during its collection. 4.7. Based on any of the legal grounds of Article 6 (1) of the General Data Protection Regulation in the case of data management, the General Data Protection Regulation is also required for all carriers comply with its provision, in this case with special regard, but not exclusively to the general obligations according to Article 13 of the Data Protection Regulation. 4.8. The exception according to Article 13 (4) of the General Data Protection Regulation does not apply a in this case, a general contractual conditional statement in fine print is not enough write it down to the data controller in order to be relieved of all responsibility, instead of writing it down you should provide substantial evidence that the new customer is affected by mail and telephone in case of ordering by road, they will at least receive information about the essential elements. 5. Purpose-bound data management 5.1. The data subject is based on Article 6 (1) point a) of the General Data Protection Regulation you can give informed consent to the processing of your personal data for specific purposes. However, for this to be valid, the consent must comply with general data protection other generally applicable rules of the regulation, such as the general data protection regulation Data management principles according to Article 5 (1) and (2) and the concept according to Article 4, point 11 conditions indicated in the definition, as well as Article 7 of the General Data Protection Regulation restrictions according to 5.2. The principles in Article 5 (1) of the General Data Protection Regulation are not limited to that they serve to make theoretical findings with the implementation of data management in connection. These principles cover specific obligations that can be held accountable in specific cases on the data controllers. 5.3. According to Article 5 (1) point b) of the General Data Protection Regulation, the personal data may only be collected for specific, clear and legitimate purposes, and not may be treated in a manner inconsistent with these goals. For this reason, data management also indicating the sufficiently specific goal during planning and informing the stakeholders a prerequisite for legal data management. This interpretation is reinforced, among other things, by the general Article 6(1)(a) and Article 7(2) of the data protection regulation, since based on these a declaration of consent by the data subject that is not sufficiently specific and contributes to known data management to an adequate extent in such a way that it can be separated you can consent separately to data management. It's obviously completely unrelated inquiry through different channels (post, telephone, e-mail, targeted online advertising), 19 they can be continued completely independently of each other, they are inseparable illegal. Based on Article 4, point 11 of the General Data Protection Regulation, the data subject your consent is appropriate for data management with a too general purpose and not determined in time not valid in the absence of information. In the absence of valid consent, no data processing corresponds to the legal basis according to Article 6 (1) point a) of the General Data Protection Regulation, and the existence of another legal basis cannot be established based on the facts. 5.4. The Customer's obligation to determine the above specific goal - the disclosed facts and III.2.-III.4 above. taking into account the points explained - he did not fulfill it. The relational the purpose of processing data cannot be an intangible and limitless goal such as "receiving further favorable offers". Direct business acquisition is an umbrella term that it is necessary to mark its specific implementation as a goal, e.g. own or third party sending advertisements about products on a given channel or specific channels. Separately important things that are different from the usual and not reasonably expected by the stakeholders should be highlighted circumstances, for example the foreign data processor and its clear, concise, easy to understand role during data management. 6. Lack of legal compliance of data management 6.1. III.2-III.5 above. based on the points explained, the Customer has violated the general providing information in accordance with Article 12 (1) and Article 13 of the Data Protection Regulation obligation, therefore it could not have a valid legal basis for direct business acquisition related data management. Based on this and as explained above, the Customer violated Article 5 (1) points a) and b) and 6 of the General Data Protection Regulation. (1) and (2) of Article 7. The Authority is the Client directly its data management outside of business acquisition and the general completeness of its online information is present did not examine it in the procedure. 7. Evaluation of the Customer's other statements regarding data management 7.1. The Customer referred to the fact that the rights of the stakeholders are adequately ensured in this context the Customer cooperates with the Authority, for example, investigation No. NAIH/2019/2181 is also terminated after their cooperation. In this context, the Authority highlights that NAIH/2019/2181 No. NAIH/2018/795/V, and the Customer did not fulfill the in full the notice of the Authority with case file number NAIH/2018/795/4/V, therefore repeated notice became necessary with file number NAIH/2019/2181/2. The test is repeated notice was terminated after execution by the Customer, as only this, or it is possible to initiate a data protection official procedure at the end of the investigation, and by the Customer after fulfillment, it was not justified to initiate the data protection official procedure on that individual in case of cancellation. This cannot be evaluated in favor of the Customer in this procedure and is general data management before the data protection decree came into effect is not relevant anyway. Also not relevant from the point of view of the present procedure, that the Authority during a separate data protection incident procedure that determined that the Customer had taken appropriate measures to deal with the incident, since it cannot be evaluated in favor of the Customer, only the Customer's failure to do so would be evaluated at his expense according to judicial practice. The fact that a data protection incident occurred at the Customer is the reason regardless of its management, it is not a positive event in terms of the Customer's data management, so it is It cannot be taken into account in a positive way requested by the customer. 7.2. The Customer referred to the built-in and default data protection of its processes in accordance with its principle, it was designed in such a way that they ensure the relevant legislation compliance and data security. However, this statement is by no means 20 supported it, and based on the revealed facts, it is related to direct business acquisition in relation to data management, it is significant in relation to the legal basis and information to the data subject there were deficiencies that comply with Article 25 of the General Data Protection Regulation design is questioned. Based on Article 5 (2) of the General Data Protection Regulation e round, the Authority evaluated the doubt at the Customer's expense. 7.3. The Customer referred to the fact that he considers data protection to be of the utmost importance, for this reason separately employs a data protection officer, which was announced by the Authority on August 28, 2018 for. The Customer did not substantiate the above claim by the online data protection officer with a copy of confirmation from the reporting system, and it cannot be found at the moment Under the name of a customer, a data protection officer operated by the Authority, by anyone online searchable database. Although this notification obligation is not the subject of this procedure, a Based on the above and Article 5 (2) of the General Data Protection Regulation, the doubt in this context the Authority assessed it at the Customer's expense, therefore the Customer was not even aware of this statement due process to be considered as supporting evidence. The Authority in this round notes that if, for technical reasons not attributable to the Customer, the registration, the Customer could have noticed and corrected it in the almost 4 years that have passed since then, if really considers data protection to be of utmost importance. 7.4. In relation to the Customer's direct marketing materials, according to his statements, on average monthly 200 inquiries are received and you are constantly trying to expand your marketing database, for example by sending advertisements to newspaper subscribers. Based on this, the examined data management is precisely not can be determined, but the fundamental right to the protection of personal data of a significant number of affected persons affected, and the number of those affected is constantly increasing. In this context, the Authority emphasizes that the no transparent data management that is not adequately known by the stakeholders is not only principled, but in a practical way, it violates the basic right of the data subjects to the protection of personal data. 7.5. The Customer referred to the mailing of its advertising materials attached to newspapers sending is not considered Grtv. of inquiries for the purpose of direct business acquisition according to § 6 (1). This is not relevant in the present procedure, as the Authority complies with the general data protection regulation compliance, including the use of the collected contact data for that purpose examined the legality of the fact that the Client is ordering from him for the purpose of obtaining direct business will contact those involved later. This is the legality of obtaining consent also depends on its legality and is independent of when the Customer obtained the consent, whereas, based on recital (171) of the General Data Protection Regulation, May 25, 2018 must comply with the General Data Protection Regulation or request a new consent. THE During the authority's procedure, the Grtv. but according to the general data protection regulation consent conditions must be met. ARC. Legal consequences 1. The Authority complies with Article 58 (2) point i) and Article 83 (2) of the General Data Protection Regulation may impose a data protection fine instead of or in addition to the other measures. There is no doubt that in case of violation of the general data protection regulation, the general to oblige the data controller based on Article 58 (2) point d) of the Data Protection Regulation necessary to bring data management into line with the general data protection regulation. The Authority considered that the usual 30 days are sufficient, as they must be applied in the future. In addition, the Authority is in accordance with the governing judicial practice, in such a case, the imposition of a fine is 7https://www.naih.hu/index.php/adatvedelmi-tisztviselo-bejelento-reszentrum 8https://dpo-online.naih.hu/DPO/Search 21 among the aspects listed in Article 83 (2) of the General Data Protection Regulation presents what was taken into account in the justification of the decision. 2. On the question of whether the imposition of a data protection fine is justified, the Authority made a decision based on statutory discretion, taking into account Infotv. Section 61 (1) to paragraph a), Infotv. 75/A. 83 of the General Data Protection Regulation. (2) and Article 58 (2) of the General Data Protection Regulation. THE Based on the authority's assessment, the conviction in itself is disproportionate and dissuasive would be a sanction, therefore imposing a fine on the Customer's income and the significant - with distribution related to magazine subscriptions, potentially in the hundreds of thousands - no data subject, as well as the direct marketing nature of the data management. In this case, personal data protection - which is the responsibility of the Authority - the imposition of fines detailed below based on the totality of circumstances, it cannot be achieved without imposing a data protection fine. THE the imposition of fines serves both special and general prevention, for the sake of which the decision is also published on the website of the Authority. 3. When determining the amount of the fine, the Authority first identified that a Article 83, paragraph 5, point (a) of the General Data Protection Regulation provides, the maximum fine that can be imposed on this basis is EUR 20,000,000, or the enterprises in the case of no more than 4% of the total annual world market turnover of the previous financial year amount. Converting 4% of EUR 20,000,000 to HUF is approximately HUF 8,000,000,000 means The net sales revenue of the Customer's sales is for the latest available year 2021 according to data, it was HUF 2,214,700,000. Based on all this, the legal maximum of the fine is present in case HUF 88,588,000. 4. When determining the amount of the data protection fine, the Authority uses the following aggravating factor circumstances were taken into account: (i) It represents an overall increased risk for the protection of the personal data of the data subjects his right is that the above IV.2. on the basis of what was also explained in point, the violation is serious is considered, the above III.7.4. according to point, the personal data of a significant number of stakeholders is long over a period of time has been and continues to be managed with the direct aim of acquiring business, the number of which is constantly increasing, and the email address data is Google and Facebook also its use based on insufficiently transparent information for targeted advertising takes place, which in itself carries significant risks for personal data regarding the right to protection (General Data Protection Regulation Article 83 (2) paragraph a) point). (ii) At a minimum, there is gross negligence because, as described in the decision, no the Client provided relevant and non-transparent information for years in a way that caused a significant informational disadvantage to those concerned (general Article 83 (2) point b) of the Data Protection Regulation. (iii) Undertaken by the Customer on the basis of Articles 25 and 32 of the General Data Protection Regulation technical and organizational measures were insufficient, which the measures present is supported by its ineffectiveness established in the decision (general data protection Article 83 (2) point (d) of the Decree). (iv) The data management is specifically aimed at profit-making, small print, not easy with accessible information, implements an old bad practice that already is it was also problematic in the time before the General Data Protection Regulation and it still is. THE the lack of adequate information puts the person concerned in such a situation that he does not even know his rights learn about and practice, because of this often such violations will not even be known in the 22nd Before the Authority, if it does not come under the Authority's purview due to other individual complaints. (general Article 83 (2) point (k) of the Data Protection Regulation. 5. When determining the amount of the data protection fine, the Authority uses the following mitigating factor circumstances were taken into account: (i) The persons concerned did not suffer direct financial damage due to the infringement (general Article 83 (2) point a) of the Data Protection Regulation. (ii) Contact personal data is not considered sensitive data (general Article 83 (2) point (g) of the Data Protection Regulation. (iii) The Authority exceeded the administrative deadline (Article 83 (2) of the General Data Protection Regulation) paragraph k) point). 6. When determining the amount of the data protection fine, the following circumstances are the fine their extent was neither aggravated nor alleviated, they have a neutral effect for the following reasons they were: (i) The Customer did not recognize the breach of law, and therefore did not take any mitigation measures done (General Data Protection Regulation Article 83 (2) point c)). (ii) The Authority has not yet determined general data protection against the Customer violation of the regulation in a data protection official case, however, the general data protection there was such a finding in the period before the regulation became applicable (case files NAIH/2018/795/4/V and NAIH/2019/2181/2) and a data protection incident also occurred in At the Customer, so in this regard, the Customer's data management cannot be said to be problem-free (General Data Protection Regulation Article 83 (2) point (e)). (iii) The Client cooperated with the Authority during the procedure, however, this is judicial practice and, based on the Authority's practice, its legal obligation, it could be absent aggravating circumstance (Article 83 (2) point f) of the General Data Protection Regulation). (iv) The Authority initiated ex officio proceedings against the Client based on a stakeholder complaint detected the likelihood of the unlawful nature of the data management practice, which the result was the present procedure (Article 83 (2) of the General Data Protection Regulation). (h) point). 8. Based on the above and all the circumstances of the case, the Authority is in accordance with the relevant part considered the imposition of a data protection fine in the amount proportionate and deterrent with regard to both special and general prevention, which amount significantly a is below the maximum fine. In other cases, this amount is based on individual circumstances may be significantly different, it does not bind the Authority in other matters. A. Other questions 1. Infotv. According to § 38, paragraph (2), the Authority is responsible for the protection of personal data, and the right to access data of public interest and public interest control and promotion of the validity of personal data in the European Union facilitating its free flow within. Infotv. According to Section 38 (2a), the general tasks and powers established for the supervisory authority in the data protection decree general data protection for legal entities under the jurisdiction of Hungary is exercised by the Authority as defined in the decree and this law. The Authority its jurisdiction covers the entire territory of Hungary. 23 2. The Art. Based on Section 112, Paragraph (1), Section 114, Paragraph (1) and Section 116, Paragraph (1), the a decision can be appealed through an administrative lawsuit. * * * 3. The rules of the administrative procedure are laid down in Act I of 2017 on the Administrative Procedure hereinafter: Kp.) is defined. The Kp. Based on § 12, paragraph (1), by decision of the Authority the administrative lawsuit against falls within the jurisdiction of the court, the lawsuit is referred to in the Kp. Section 13, paragraph (3). Based on point a) subpoint aa), the Metropolitan Court is exclusively competent. The Kp. Section 27 (1) according to paragraph 1, legal representation is mandatory in administrative proceedings before the tribunal. The Kp. According to paragraph (6) of § 39, the submission of a claim is an administrative act does not have the effect of postponing its entry into force. 4. The Kp. Paragraph (1) of Section 29 and, in view of this, CXXX of 2016 on the Code of Civil Procedure. applicable according to § 604 of the Act, electronic administration and trust services CCXXII of 2015 on its general rules. according to § 9 (1) point b) of the Act, the the client's legal representative is obliged to maintain electronic contact. The submission of the statement of claim time and place of Kp. It is defined by § 39, paragraph (1). Request to hold the hearing information about the possibility of the Kp. It is based on paragraphs (1)-(2) of § 77. 5. The amount of the fee for the administrative lawsuit is determined by the XCIII of 1990 on fees. law (hereinafter: Itv.) 45/A. Section (1) defines. From the advance payment of the fee the Itv. Paragraph (1) of § 59 and point h) of § 62 (1) exempt the person initiating the procedure half. 6. If the Customer does not adequately certify the fulfillment of the prescribed obligations, the Authority considers that the obligations have not been fulfilled within the deadline. The Akr. According to § 132, if the Customer did not comply with the obligation contained in the Authority's final decision, that is can be executed. The Authority's decision in Art. according to § 82, paragraph (1) with the communication becomes permanent. The Akr. Pursuant to § 133, enforcement - if you are a law government decree does not provide otherwise - it is ordered by the decision-making authority. The Akr. 134. pursuant to § the execution - if it is a law, government decree or municipal authority the local government decree does not provide otherwise - the state tax authority undertakes. Infotv. Based on § 61, paragraph (7), contained in the Authority's decision, to carry out a specific act, to perform a specific behavior, to tolerate or regarding the obligation to stop, the Authority will implement the decision undertakes. dated: Budapest, September 12, 2022. Dr. Attila Péterfalvi president c. professor