NAIH (Hungary) - NAIH-2732-2-2023
| NAIH - NAIH-2732-2-2023 | |
|---|---|
 | |
| Authority: | NAIH (Hungary) |
| Jurisdiction: | Hungary |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 5(1) GDPR Article 6(1) GDPR Article 13(1) GDPR Article 13(2) GDPR Article 24 GDPR Article 25 GDPR Article 32(1)(b) GDPR Article 32(2) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | 19.10.2021 |
| Decided: | 06.02.2023 |
| Published: | 06.02.2023 |
| Fine: | 30000000 HUF |
| Parties: | n/a |
| National Case Number/Name: | NAIH-2732-2-2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Hungarian |
| Original Source: | NAIH (in HU) |
| Initial Contributor: | Ábel Kaszián |
The Hungarian DPA held a beauty salon liable for major GDPR infringements including cameras monitoring employees and clients, the mishandling of sensitive data and the use of data for marketing purposes without proper consent. The DPA imposed a fine of €80,000.
English Summary
Facts
The controller was a Budapest-based company that operated the Spandora Beauty Centre, where facial and body treatments and medical aesthetic procedures were performed. The controller also distributed cosmetic products.
The DPA received several notifications in which clients and employees of the controller complained about cameras recording image and sound in all premises (offices, treatment rooms, corridors, reception) at its headquarters.
The DPA launched an official investigation on 19 October 2021 and carried out an on-site visit on 20 October 2021. The main issues arising from the very detailed investigation can be summarized as follows:
First, the cameras were monitoring the room where the staff eats, the training rooms and customer treatment rooms (implying that clients were often seen in incomplete clothing). The purpose of this processing was however not clearly defined nor communicated.
Second, the controller explained that only a few specific people had access to the recordings. However, the on-site visit showed that the camera images were also seen by the sales manager, who used them to check that the staff was communicating properly with the clients. The recordings were available on a computer in an unlocked room. To access them, one could click on a shortcut and enter a username which was written on a piece of paper stuck to the monitor.
Third, all clients had to fill in and sign a consultation form which mentioned the placement of cameras for the purpose of protecting clients and staff. It however did not mention the recording of audio. The investigation also showed that there was no mention of the cameras in the privacy notice in force.
Fourth, the controller stored health data in the client database, including Covid vaccination status, pregnancy, and sicknesses.
Fifth, the controller stated that the signature of the consultation form constituted a consent to the processing of their data for a marketing purpose. Later, the controller held that this processing was based on legitimate interest, and then in a further contradictory declaration, it stated that it did not use client data for such purposes
Holding
The DPA assessed the compliance of the monitoring in the light of the different elements of the investigation.
First, the DPA stated that the monitoring was performed for an unclear purpose and without settings that minimized the processing. The controller referred to the purposes in general terms and with contradictory statements. Consequently, the DPA concluded that the controller had breached the purpose limitation principle under Article 5(1)(b) and (c) GDPR. The DPA, therefore, prohibited the processing of data by the camera in operators and in diagnostic and examination rooms and instructed the controller to delete in a documented manner the video recordings made in operators and in diagnostic and examination rooms.
Second, Regarding the people who could access the cameras, the DPA found that the controller did not guarantee the confidentiality of the data processing and did not take measures to protect personal data. Indeed, the images of the cameras and the stored recordings could be easily accessed. The DPA found that by failing to provide the default settings for the operation of the camera system that minimize data processing, the means necessary to ensure the highest possible level of protection of personal data, the controller violated Article 5(1) GDPR in Article 24 GDPR and Article 25 GDPR, as well as Article 32(1)(b) GDPR and Article 32(2) GDPR, and instructed the controller to take appropriate technical and organizational measures to ensure that its processing operations comply with the legal provisions.
Third, concerning the information, the DPA found that the privacy notice did not comply with the requirements of the GDPR as it did not provide information on the location of each camera and its purpose, the area or object it monitored, or whether the employer was carrying out direct or fixed surveillance with the camera. It also did not provide for the specific duration of the storage of the recordings, the rules for viewing the recordings, or the purposes for which the recordings could be used by the employer. The consultation forms could not either be considered as compliant since they contained misleading information. The controller therefore didn't comply with the requirement of transparent processing under Article 5(1)(a) GDPR, and Article 13(1) and (2). The DPA instructed the controller to provide adequate, clear, and transparent information to data subjects about all processing.
Fourth, regarding the collection and storage of health data, the DPA recalled that the processing of sensitive data is possible if the data subject has given his or her explicit consent or if the processing complies with Article 9(2) GDPR. In this case, the controller neither demonstrated that the processing of certain health data was indispensable for the performance of the services nor to have collected a valid consent. Thus, the DPA found that the controller had violated Article 6 GDPR and Article 9(2) GDPR and prohibited the processing of the health data and to delete the personal health data from the records.
Fifth, the DPA found that there was no checkbox on the consultation form to consent to the processing for marketing purposes. The clients therefore did not consent to the processing for this purpose. The controller also failed to demonstrate a legitimate interest. The DPA concluded that, as the controller processed the data for marketing purposes without a legal basis, it had breached Article 6(1) GDPR in relation to this processing. For these reasons, the DPA instructed the controller to cease the unlawful processing and to bring the processing operation into compliance with the legal provisions by justifying the legal basis for the processing of the guests' data for marketing purposes.
Taking into account that the controller had not previously committed GDPR violations and that it implemented compliance measures, the DPA ordered a fine of HUF30,000,000 (approx. €80,000).
Comment
At the publication of this case summary, the privacy notice in question is still accessible from the website of the controller, it was amended following the investigation and now contains for example a truly illegible camera location drawing.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.
