NAIH (Hungary) - NAIH-3344-1/2026

From GDPRhub
NAIH - NAIH-3344-1/2026
Authority: NAIH (Hungary)
Jurisdiction: Hungary
Relevant Law: Article 5(1)(a) GDPR
Article 5(1)(c) GDPR
Article 6(1) GDPR
Article 13 GDPR
Type: Investigation
Outcome: Violation Found
Started: 07.04.2025
Decided: 30.01.2026
Published:
Fine: 1,500,000 HUF
Parties: n/a
National Case Number/Name: NAIH-3344-1/2026
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Hungarian
Original Source: NAIH (in HU)
Initial Contributor: bms

The DPA fined the Hungarian University HUF 1,500,000 (€3,933.80) for the unlawful, excessive and insufficiently transparent data processing in course of dormitory admissions. According to the DPA, the university incorrectly referred to consent in its admission forms.

English Summary

Facts

The Hungarian University (the controller) operated its dormitory admission procedure through academic software. Students could also submit a separate social situation assessment request. Although this request was not formally mandatory, students who did not submit it received zero social points in the dormitory ranking.

The dormitory ranking was based on social circumstances, academic performance, and institutional, professional, academic and public life activities. In practice, the result of the social situation assessment was used for the dormitory admission procedure.

For the social situation assessment, the controller required applicants to submit supporting documents to prove their social circumstances. These documents included, among others, residence cards and authority decisions proving disadvantaged or multiply disadvantaged status. As a result, the controller processed personal data relating not only to applicants, but also to household members, relatives, witnesses and, in some cases, health or social-status information.

During the 2022-2024 application periods, the controller did not provide a separate privacy notice for dormitory admissions. The application forms also stated that submitting an application amounted to consent for the controller to forward the submitted documents to the persons or committees reviewing the application. However, the controller mainly relied on processing carried out in the public interest and, in part, on processing necessary for pre-contractual steps.

The Hungarian DPA investigated whether the controller had a valid legal basis, complied with the principle of data minimisation, and provided adequate information to applicants in the dormitory admission and related social situation assessment procedures.

Holding

The DPA held that the controller violated Articles 5(1)(a), 5(1)(c), 6(1) GDPR, 13(1)-(2) GDPR.

The DPA accepted that Article 6(1)(e) GDPR could serve as a legal basis where the controller processed data necessary to assess statutory social criteria. However, this did not allow the controller to process any data contained in the supporting documents. The controller had to limit the processing to the data strictly necessary to verify the relevant criteria.

The DPA found that the controller breached the principle of data minimisation by processing excessive data from residence cards. In particular, the controller did not need to process document numbers, personal identification numbers or issuance-related data to verify the applicant’s residence or household situation.

The DPA also found that the controller unlawfully processed full authority decisions on disadvantaged or multiply disadvantaged status. According to the DPA, only proof of the relevant status was necessary. The full decisions could contain additional sensitive or private information about family, employment, housing, education or child-protection circumstances, which was not necessary for the assessment.

Since this excessive data was not necessary for the controller’s task, the DPA held that the controller also lacked a legal basis for processing it. In addition, the controller failed to provide adequate prior information under Article 13 GDPR. The DPA further held that the reference to consent in the application forms was misleading, because consent was not the applicable legal basis.

The DPA ordered the controller to stop the unlawful processing, delete the unlawfully processed data, amend its privacy notice, and prove compliance within 45 days. It also imposed a HUF 1,500,000 fine (€3,933.80).

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details. 

DECISION
The National Data Protection and Freedom of Information Authority (hereinafter: Authority) makes the following decisions in an ex officio data protection authority procedure regarding the compliance of the data processing practices of the Hungarian University of Agricultural and Life Sciences (seat: 2100 Gödöllő, Páter Károly u. 1.a;
hereinafter: MATE) with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: General Data Protection Regulation) in relation to dormitory admissions, including the examination of the application of the principles of data processing, the legal basis for data processing and the appropriate prior information.
1. The Authority condemns MATE for negligently infringing Article 5(1)(a) and (c), Article 6(1) and Article 13(1)-(2) of the GDPR, as explained in the statement of reasons.
2. The Authority prohibits MATE from processing data without a legal basis, as set out in Sections V.5.3 and V.5.8.1 of the Decision, as of the date of receipt of this Decision, with effect for the future. To this end, the Authority orders MATE to erase all personal data unlawfully processed.
3. The Authority further orders MATE to comply with the provisions of Section V.6 of the Decision. modify the content of its data management information in accordance with the requirements set out in point 1 of this Article and prove this to the Authority by sending the data management information and referring to the relevant points or by preparing and sending a new data management information.
4. The Authority obliges MATE to pay a data protection fine of HUF 1,500,000, i.e. one million five hundred thousand forints, for the violations established above.
MATE must prove in writing to the Authority that it has taken the measures prescribed in points 2 and 3 within 45 days of receiving this decision, together with the submission of supporting evidence, a deletion protocol and a data management information.
The data protection fine must be paid within 30 days of receipt of this decision to the Authority's centralized revenue collection target settlement forint account (10032000-
01040425-00000000 Centralized collection account IBAN: HU83 1003 2000 0104 0425
0000 0000). When transferring the amount, reference must be made to the NAIH-3344/2026. BÍRS. number.
If MATE fails to meet its obligation to pay the fine within the deadline, it shall pay a late payment surcharge to the above
account number. The rate of the late payment surcharge is the statutory
2
interest, which is the same as the central bank base interest rate valid on the first day of the calendar half-year affected by the delay.
In the event of failure to comply with the obligations under points 2 and 3, and failure to pay the data protection fine and the late payment fee, the Authority shall order the enforcement of the decision.
Until the expiry of the deadline for filing an action to challenge the decision, or until the final decision of the court in the event of an administrative lawsuit, the data affected by the disputed data processing may not be deleted or destroyed.
There is no right of appeal against this decision through administrative means, but it may be challenged in administrative proceedings by means of a statement of claim addressed to the Metropolitan Court within 30 days of its notification. The statement of claim shall be submitted to the Authority electronically1,
which shall forward it to the court together with the case documents. The request for a hearing shall be indicated in the statement of claim. For those not entitled to full personal exemption from fees, the administrative lawsuit fee is HUF 30,000, and the lawsuit is subject to the right to record the subject matter of the fee. Legal representation is mandatory in the proceedings before the Metropolitan Court.
The Authority publishes the decision with identification data on its website.
JUSTIFICATION
I. P a r e c t i o n s , a u t i o n a l i t i o n (1) On December 18, 2024, the Authority launched a data protection authority inspection of MATE’s data processing practices related to dormitory admissions – including the validity of the data processing principles, the legal basis for data processing, and the appropriate prior information – with the General Data Protection Regulation, under the number NAIH-13263/2024. The period under review covered the application period for the 2022-2024 academic year.
(2) During the audit, the Authority called on MATE to provide a statement on two occasions (orders numbered NAIH-13263-2/2024 and NAIH-1312-2/2025), which MATE complied with on both occasions within the deadline (documents filed under numbered NAIH-1312-1/2025 and NAIH-1312-3/2025).
(3) During the audit, the Authority reviewed MATE's data processing process related to its dormitory admissions and the closely related social situation assessment procedure.
(4) In this context, the Authority received information regarding the period under review – indicating the number of data subjects – about what personal data MATE processed for the two procedures, on what legal grounds, and in the case of health and other sensitive data, which additional legality requirement under Article 9 of the General Data Protection Regulation was applied. MATE also provided information about what documents it requested from the applicants in the two procedures to verify each piece of data and on what legal grounds, including how it complied with the principle of data economy in relation to the processing of documents. 1 The form called NAIH_K01 is used to initiate administrative proceedings: NAIH_K01 form (2019.09.16.) The form can be completed using the general form filling program (ÁNYK program). The form is available at the following link: https://naih.hu/kozig-hatarozat-birosagi-felulvizsgalata
3
MATE also presented how it provided information on data processing.
MATE supported its responses by sending documents.
(5) After reviewing and evaluating MATE's statements and the documents attached to them, the Authority detected a suspicion of a violation of the law with regard to the application of the principle of data economy, the legal basis for data processing, and the information on data processing, in view of the documents requested for the application materials, the legal references prescribing data processing, and the non-uniform data processing information.
(6) Based on the information revealed during the official inspection, the Authority closed the official inspection on 7 April 2025 due to a suspected violation of the provisions of the General Data Protection Regulation and on the same day initiated an ex officio data protection official procedure to examine the compliance of the data processing practices of MATE dormitory admissions with the General Data Protection Regulation.
I I . A U T I O N I N G O R T I O N P R O C E R C O N T I O N (7) The period under examination – in accordance with the official inspection – covered the application period of the 2022-2024 academic year.
(8) The Authority issued a decision on the initiation of the data protection official procedure dated 7 April 2025,
NAIH-9574-1/2025. notified MATE in its order No. 
, in which order it also called upon it to make a statement in order to clarify the facts.
(9) MATE responded to the Authority's order in its submission dated 22 April 2025 (filed under number NAIH-
9574-2/2025).
(10) Since, after reviewing the submissions made by MATE in its response, further clarification of issues regarding the data processing under review became necessary, the Authority repeatedly called upon MATE to make a statement in order to clarify the facts in its order No. 
NAIH-
9574-3/2025 dated 20 June 2025.
(11) MATE responded to the Authority's order in its submission dated 17 July 2025 (filed under number NAIH-
9574-4/2025).
(12) The Authority also used the documents and data of the data protection authority inspection initiated under the number NAIH-13263/2024 in the present data protection authority procedure, about which the record number NAIH-9574-5/2025 was prepared.
(13) Based on the evidence at its disposal, the Authority informed MATE in its order number NAIH-9574-6/2025 dated 11 November 2025 that the evidentiary procedure in the data protection authority procedure had been completed and drew its attention to the fact that it may examine the evidence uncovered during the clarification of the facts, taking into account the rules on access to documents, and may make further evidentiary motions.
(14) MATE requested access to the documents in its submission dated 19 November 2025 (filed under number NAIH-9574-7/2025).
(15) The Authority granted MATE’s request for access to the documents in its order dated 24 November 2025 (filed under number NAIH-9574-8/2025).
(16) MATE requested a copy of the documents of the proceedings in its submission dated 26 November 2025 (filed under number NAIH-9574-9/2025).
4
(17) The Authority sent MATE a copy of the documents of the proceedings as an attachment to its order dated 28 November 2025 (filed under number NAIH-9574-10/2025).
(18) After reviewing the documents, MATE did not submit any further submissions, statements or requests for evidence.
I I I . ESTABLISHMENT OF THE FACT
I I I . 1 . D e s t a t i o n s f o r m e n t i o n s f o r m e n t i o n s
(19) According to the documents of the official inspection annexed to the note No. NAIH-9574-5/2025, MATE has submitted documents No. NAIH-1312-1/2025 and NAIH-1312-3/2025. submitted the following in its submissions filed under number:
(20) MATE stated regarding its data processing process related to the dormitory admission procedure that the dormitory admission procedure and the social situation assessment can be initiated on the student interface of the Neptun study system (hereinafter: Neptun), as separate applications, since the social situation assessment can be linked to other applications, thus it is an independent procedure from the dormitory admission procedure. Within the framework of the dormitory admission procedure, 100 points can be awarded for social situation, 70 points for academic achievement, and 30 points for institutional, professional, scientific and public activities (200 points in total). If the applicant students have the same score, preference shall be given to the student in need based on his/her social situation during the dormitory admission procedure. In connection with the dormitory admission process, completing the social situation assessment is not mandatory, so it is not a prerequisite. However, if the student wishes to take his or her social circumstances (social situation score) into consideration during the dormitory admission process, it is necessary to submit the social situation assessment application prior to the dormitory application.
(21) According to the MATE statement, the applications for dormitory applications can be accessed by the competent staff of the University Dormitories Directorate and Dormitory Departments. Technical support for the dormitory admission process is provided by the Directorate of Education (hereinafter: OIG), the Academic Department and the Neptun and Educational Organization Department, within the framework of which the applications are accessed. The content of the social situation assessment is not visible in the dormitory application, only the achieved social score and a yes/no flag are displayed, indicating whether any special circumstances occurred during the social assessment that justify preference for the applicant. The competent staff of the University Dormitories Directorate participate in the decision-making process on the application.
(22) According to the MATE statement, the legal basis for data processing in connection with the dormitory admission procedure is Article 6(1)(b) and (e) of the General Data Protection Regulation, and the following legal provisions should also be taken into account in connection with the processing of health and other sensitive data:
- Act CCIV of 2011 on national higher education (hereinafter: Nftv.);
- Government Decree 51/2007. (III. 26.) on the benefits of students participating in higher education and certain fees to be paid by them (hereinafter: Government Decree);
- Act LXXXIX of 2018 on educational records (hereinafter: Onytv.).
(23) In addition, according to the MATE statement, no sensitive data will be processed in connection with the dormitory admission procedure. In connection with the personal data processed during the dormitory admission procedure and their necessity, the necessity and legal basis for the processing of 5 individual personal data were indicated in a summary table as follows: (24) Personal data processed Necessity Legal basis Name Identification of the applicant Taking steps prior to concluding a contract (Article 6 (1) (b) of the General Data Protection Regulation) Neptune identifier Place and time of birth Mother's name Address Ranking Waiting list Calculation of the points required for assessing the dormitory admission application in the case of a Hungarian/dual citizen abroad Verification of the eligibility of the data included in the identity card in the case of a Hungarian/dual citizen abroad Name of the roommate with whom the student would like to share a room Assignment of students to dormitory rooms Training location of that dormitory selection of the place where the student is to be placed; performance of a public interest task (Article 6(1)(e) of the General Data Protection Regulation); name (code) of the training; form of financing of the training; determination of the dormitory fee; level of training; calculation of the points required for the assessment of the dormitory admission application; academic achievement (data source: Neptun); calculation of the points that can be awarded on the basis of the academic achievement; social score and flag; assessment of the dormitory admission application; institutional, professional, scientific and public life score; calculation of the points that can be awarded under this title; verification of the validity of the data in the supporting documents in the case of institutional, professional, scientific and public life activities; (24) According to the MATE statement, within the framework of the dormitory admission procedure, applicants does not process the personal and sensitive personal data of their relatives and those living in the same household.
(25) However, in the context of the procedure for assessing the social situation, it stated that
it also processes the personal and, where applicable, sensitive data of the applicants and their relatives on the basis of Article 6(1)(e) of the General Data Protection Regulation. It bases the processing of special categories of personal data on Article 9(2)(b) of the General Data Protection Regulation. The legal basis for the specific data – and in the case of health and other sensitive data, which additional legality requirement under Article 9 of the General Data Protection Regulation – is also provided to the Authority in the form of a separate table, as follows.
Document type Data Document requirement Personal data processed Necessity of personal data processed Remarks Address card Verification of whether they live in a common household. Proof of distance between the place of training and the place of residence. Name, place of birth, date, mother's name, place of residence, registration date, personal identification number, card number Identification of the person concerned and proof of address. Amendment in 2025: Only the relevant part of the address card needs to be attached. Amendment in 2025:
In case
the
address
is
different
from
the
address
on
the
Authority
Certificate
/
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
Certificate
of
the
persons
who
are
registered
at
a
different
address
on
the
Authority
Certificate
Certificate
Certificate
of
the
person.of
the
person.
Certificate
of
the
person.
Certificate
of
the
person.
Certificate
of
the
person.
Certificate
of
the
person.
Certificate
of
the
person.
Certificate
of
the
person.
C Name, place of birth, date, mother's name, apartment address, signature Identification of the person concerned, confirmation of actual residence, verification of the authenticity of the contract. Amendment in 2025: The attachment of the apartment contract has been deleted. Declaration No. 1 Confirmation that he/she lives at a different address than the one indicated in the Authority Certificate. Name, place of birth, date, mother's name, address, content of the declaration, witness's name, address, signature Identification, personal document formalities Amendment from 2025: Necessity: Proof of change in the amount of child support Proof of the fact of separation and amount of child support.
name, place of birth, date, mother's name, address, statement content, 
name of 7 witnesses, address, signature of 
custodial parent, name of 
separate parent, amount of 
child support payment
Certification if the 
sibling does not live in the same household as the 
name, place of birth, date, mother's name, address, statement content, witness's name, address, signature
Identification, personal document formalities
Certification that the 
sibling over 16 years of age wishes to continue his or her studies, if he or she cannot prove it otherwise.
No such certificate was requested in 2024.
Proof that the applicant does not receive any benefits if he or she does not live in the same household as the parents. If the employment relationship began within the previous 3 months, it is necessary to attach a statement from the relative stating that he or she has no other income in addition to the start of the new employment relationship. Added from 2025. Income certificate issued by NAV Joint name / individual Concerned person 8 to determine the income situation of persons living in the household. company name net income, tax identification number / tax number paid in the tax year KATA amount, primary producer registration number identification and income verification income certificate issued by the employer name, address, date of birth, occupation, tax identification number 3-month net income and average employer: name, tax number, registered office and name of the person issuing the certificate + legal representative of the employer name
(signatory)
Certificate of the KATA
amount
Cata paid
in
the
tax year
Document confirming the termination of the sole proprietorship
Name, tax number, registration number, seat, date of termination
of the sole proprietorship
Certificate of registration with the ÓCSI
Certificate of the original producer
Name, tax number, seat, registration number
Identification of the person concerned
Name, birth name, mother's name,
Identification of the person concerned
and his/her income
9 Certificate issued by the local government
Establishment of the income situation
pension, disability allowance family allowance amount confirmation place and time of birth, mailing address name of the person issuing the certificate and the name of the administrator confirmation of the settlement allowance amount certificate issued by the District Employment Department of the District Office name, birth name, mother's name, place and time of birth, mailing address name of the person issuing the certificate and the name of the administrator jobseeker's allowance amount copy of pensioner's card name, birth place, time, mother's name amendment in 2025: information issued by the Hungarian State Treasury Pension Payment Directorate on the benefits paid in the previous calendar year and the amount of benefit expected in the current year, information issued by the Hungarian State Treasury Pension Payment Directorate, name, registration number, date of birth, address, pension amount, copy of the last monthly pension slip, name, pension amount, copy of the relevant part of the bank account line, name, pension, disability benefit amount, postal confirmation slip, determination of the income situation of persons living in a joint household. name, disability benefit, pension amount, identification of the person concerned and proof of income, 10 proof of disability benefit, pension amount, No. 3. Annex
Certification of disability or health status
Name, date of birth, permanent address, signature of family doctor, address of workplace, fact of disability or reduced working capacity + name of family doctor
Identification of the person concerned and determination of eligibility.
Hungarian
State
Treasury
certificate
-
childcare
benefit
(gyes),
-childcare
fee
(gyed),
-childcare
support
(gyet)
-student
name,
name of the
child
for whom
the
benefit
is
paid,
amount
of
Gyes/Gyed/Gyet
-
name
of
the
supporter
name,
name
of
the
child
for whom
the
benefit
is
paid,
amount
of
Gyes/Gyed/Gyet
name,
registration number,
date
of
birth,
address,
benefit
amount
of
the
affected
person
Identification
and
determination
of
the
entitlement

Certificate
of
the
amount
of
the
widow's
benefit
to
be
paid
for
the
given
year.

name,
registration number,
date
of
birth,
address,
benefit
amount

Certificate
of
orphan's
benefit.
student's name, age, orphan/half-orphan status, deceased parent's name, ID number, date of birth, address, amount of benefits marriage certificate Proof of marriage. Name of student and spouse/partner, spouse's/partner's family name and surname, place and date of birth + married name for spouses, place and date of marriage/registered partnership Identification of the person concerned and determination of entitlement. Certificate issued by the Mayor's Office Proof of marriage.
In the case of unemployed, a certificate issued by the competent local government on the amount of settlement allowance/lack thereof, birth certificate, confirmation that the applicant or his/her spouse or partner has a child or is expecting a child, the child's family name and surname - gender - place and time of birth - the father's and mother's family name and surname - in the case of adoption, the fact of this and the family name and surname, married name of the adopter(s). Identification of the person concerned and determination of eligibility. Amendment in 2025:
In the case of birth certificate(s), all other information other than the information required for identification must be covered up!
Sibling's certificate (under 16 years).
Copy of student ID
Sibling's certificate over 16 years.
name, place of birth, time, work schedule,
we did not request a copy in 2022 and 2023.
12
Child's certificate.
ID number, card number, signature, photo School attendance certificate In the case of a child and a sibling over 16 years of age, proof of continuing studies: name, mother's name, place of birth, time, fact of studies at the institution Maternity certificate Child and sibling certificate. Name of student or spouse/partner, name of child, age, fact of pregnancy, pregnancy health data Amendment in 2025: We do not request a maternity certificate. We did not request one for your sibling in 2022. Certificate issued by the Employment Department of the competent District Office Proof of being a registered job seeker.
Name of the relative,
Jobseeker status/Health Insurance Relationship Status
Registered jobseeker:
Name, birth name, date and place of birth,
Mailing address, benefit amount
Name of the person issuing the certificate
+ name of the administrator
Identification of the person concerned and determination of eligibility.
Certificate issued by the competent county government body acting in the health insurance fund department that he/she is not a registered jobseeker.
Unregistered jobseeker: name, maiden name, place and time of birth, address, social security number, workplace 13 information/official certificate of health insurance name, job title court decision on divorce certificate details of the custodial parent, name and details of the divorced parent, amount of child support payment, amended in 2025: If the court decision is in the meantime a copy of the court decision/document on child support. Proof of the amount of child support. If the supporting parent's data, the divorced parent's data, the amount of child support, the monthly amount of child support has changed, the person liable for maintenance must declare this on the form in Annex 1.
Nursery certificate
Certificate of a sibling participating in nursery care.
Data on nursery certificates
Amendment in 2025:
Deleted
Certificate of student status in higher education
Certificate of continuation of studies for siblings over 16 years of age.
student's name, place and time of birth, mother's name, address, student identification number, start of legal relationship Identification of the person concerned and determination of eligibility Admission decision Proof of continuation of studies for siblings over 16 years of age, if they have not yet enrolled in the higher education institution. Based on Section 41/D. (2) of the National Education Act: The classification decision shall include the name of the proceeding body, the file number, the applicant's name, electronic contact details, personal identification number of the person serving Amendment in 2025: Classification decision of the Education Office is required. 14
data,
the
decision on the merits,
information
on
the
legislation
serving
as
the
basis
of
the
decision,
the
place
and
time
of
the
decision,
the
signature
of
the
issuer.

The
reasoning
of
the
classification
decision
must
include
the
score
calculated
for
all
the
applicants
and
the
applicants
must
be
informed
about
the
possibility
of
the
legal
redress.

Decision
on
the
termination
of
the
payment
of
a widow's
pension.

Certification
of
the
fact
of
the
termination.
name
registration number
date of birth
address
pension
amount
death
certificate
of orphanhood or semi-orphanhood
name
(including married name),
marital status,
gender,
place and date of birth,
place and date of death,
date of birth of father and mother
amendment in 2025:
A resolution on the termination of orphan benefit payment is required, the death certificate has been cancelled.
15
surname and
first name
income-
expenditure
statement
of
self-supporting
applicant
income
expenditure
proof
housing
costs,
utility
fees,
daily
sustenance
costs,
other
monthly
regular
costs,
of
which
housing
and
utility
costs
must
be
proven.
On utility bills: name, address decision of the competent notary/guardian office on the determination of a disadvantaged or cumulatively disadvantaged situation Confirmation of a disadvantaged or cumulatively disadvantaged situation Student's disadvantaged/cumulatively disadvantaged situation Name, date and place of birth, mother's name, address Name of the person issuing the decision + name of the administrator Identification of the person concerned and determination of entitlement Annex 5 Health status of a close relative living in the same household as the student (disability, fact of living with a disability, long-term illness) Name, date of birth, address, health status of the relative eü.
cost,
names
and addresses of witnesses
in 2025 amendment:
In Annex No. 5,
we only ask for
the costs of
the relative,
not
their
health
condition!
Annex No. 4
Healthcare
expenses
related
to
the
applicant
student
student/relative
name,
date
of
birth,
address,
health
16
certificate:
condition,
healthcare
costs,
names
and
addresses of
witnesses
certificate
of
the
competent
district
or
district office
certificate
of
the
supporter
participating
in
the
care
fee.
student/relative's health status, Name of the person entitled to the benefit (plus personal details – date of birth, address), amount of the fee and name of the person issuing the certificate + name of the administrator, certificate from the competent district or district office, certificate from the breadwinner participating in GYOD. This form of benefit/sibling's health status Name of the person entitled to the benefit (plus personal details – date of birth, address), amount of the fee and name of the person issuing the certificate + name of the administrator, identification of the person concerned and determination of entitlement. Dormitory certificate Proof of residence in another dormitory institution Student's place of residence, dormitory fee amount, name of the person issuing the certificate Subtenancy agreement containing the rent Proof of residence in a subtenancy Student's place of residence, rent fee Amendment in 2025: In the case of an applicant living in a subtenancy, the subtenancy agreement must be attached in 17 parts in such a way that the personal and additional data of the landlord, except for the name of the landlord, in the case of a joint tenancy, the personal and additional data of the co-tenant(s), except for the name of the co-tenant(s), and additional costs (e.g. deposit) are covered up. screenshot
from
GoogleMaps
or
Waze
app
in
case
of
public
transport
a
screenshot
of
the
official
timetable
of
the
transportation
company
Proof
of
the
distance
between
the
place
of
training
and
the
place
of
residence.
attach a screenshot of the online timetable of your place of residence showing the price, proof of travel costs, in the case of students starting the first semester, proof of residence and travel costs in 2022 and 2023: season ticket and confirmation issued by MÁV, Volán, train ticket, seat ticket, fast train supplement ticket, national season ticket, county season ticket, proof of travel costs, OM identification number, personal ID number, date of birth, name, address, MÁV customer number, from 2025, an invoice proving the purchase will also be accepted. bank account details confirming the transfer of family allowance, name of the person entitled to family allowance, amount of family allowance in 2022 and 2023: not requested. Amendment in 2025: The paid family allowance must be confirmed by an official certificate from the territorially competent 18 Government Office or by a bank transaction certificate/postal confirmation slip of the last monthly transfer. In the event of the termination of family allowance, the relevant decision of the Government Office must be attached (26) According to the MATE statement, the analysis system of the social situation assessment is reviewed every year, the version of which is valid for a given period is available on the OIG website. The social situation assessment is carried out every semester, and is submitted to the Authority every semester, in accordance with Appendix 4 of the Student Benefits and Reimbursements Regulations (hereinafter referred to as: HJT): The detailed analysis system for the social situation assessment. The above table can be considered a tabular extract of this appendix. (27) According to the MATE statement, students always submit their social situation assessment application via Neptun, and the applications are also scored via it. The University Student Welfare Committee (hereinafter referred to as: EDJB) decides on the score of the students' social situation. The uploaded documents are collected and stored electronically by the Neptun system on its own server located at the MATE headquarters. As a preparatory material for the decision of the EDJB, a tabular summary of the submitted social situation assessment applications is prepared, which is shared privately with the members of the committee via the university's storage2. However, this aggregated material no longer contains certificates or documents. (28) According to MATE's statement, the documents requested to verify each piece of data are necessary for checking eligibility and assessing the given application. The legal basis for processing the documents is the same as the legal basis for processing personal data. When requesting a given certificate, the principle of data economy is complied with by requesting only the documents necessary for verifying eligibility. The student can upload the documents to his/her own storage in Neptun as an attachment to the application. According to MATE's statement, the retention period for documents uploaded in connection with the dormitory admissions procedure is 10 years according to MATE's document management regulations, which is calculated from the last substantive action. The social situation assessment application and the documents submitted with it are kept by MATE for 80 years following the notification of the termination of the student status [Nftv. Annex 3 I/B. 1. be), 3.]. MATE does not request certificates or documents for which the redaction of personal data would be justified. However, MATE specifically draws attention to the redaction of documents in certain cases.
(29) MATE sent the Authority the certification samples used during the period under review. It also provided information that the social situation assessment analysis system was revised in 2025, and in this context, the relevant Annex 5 of the analysis system was amended. The currently valid version is available on the OIG website.
2 https://tarhely.uni-mate.hu
19
(30) According to the statement of MATE, employees do not receive thematic training either in the context of the application for the social situation assessment or in the context of the dormitory admission procedure. In the case of the dormitory admission procedure, employees are informed about the knowledge and changes necessary for the performance of the tasks and the relevant regulations in the context of the dormitory admission procedure in the context of periodic meetings. In addition, current employees and new entrants are also required to complete general data protection training, the materials of which MATE has attached to the Authority.
(31) According to MATE's statement, until 1 February 2024, a confidentiality clause has been included in the employment contract of employees acting within the framework of the social situation assessment and the dormitory admission procedure. From 1 February 2024, MATE will apply a separate confidentiality declaration for employees, a sample of which has been sent to the Authority.
(32) Furthermore, according to MATE's statement, students will not perform any tasks within the framework of the dormitory admission procedure. Students will participate in the assessment of social situation assessment applications and will perform the following tasks in relation to the submitted social situation assessment applications:
- checking the attachments to the application;
- giving opinions;
- preparing and sending out notices to fill gaps via Neptun;
- determining partial scores;
- if necessary, clarifying the factual data related to the application in order to determine the appropriate score.
(33) According to the MATE statement, during the period under review, students received training on the tasks, where the entire process of the assessment, its steps, and the relevant regulations (Appendix 4 of the HJT: Detailed analysis system of the Social Situation Assessment) were presented to them. From 2025, students will also take an exam on the knowledge they have acquired. The students participating in the assessment did not make a separate confidentiality declaration between 2022 and 2024, but HJT No. 4 Appendix: Section 11 (1) (c) of the Detailed Analysis System of the Social Situation Survey stipulates that, when processing personal data related to applications, requests and procedures, persons participating in the processing of data and the assessment are obliged to maintain confidentiality with regard to the data they come to know during the procedure. (34) According to its statement, MATE did not have a separate data management information for the dormitory admission procedure between 2022 and 2024. The relevant university internal regulations and internet platforms provide some information on data management (for example, the scope of personal data processed, the purpose of data management, the identity of the data controller, the contact details of the data protection officer). Furthermore, MATE already processes the data on academic achievements, institutional, professional and scientific activities and public life handled within the framework of the application, only the purpose of the data management changes, so in its opinion, the data subjects already had information about the management of these data. MATE examined this issue at the request of the Authority and established the deficiency, therefore, in order to promote transparency and provide full information, in addition to the existing regulations, MATE prepared a separate data management information sheet for the submission of the dormitory admission application, which MATE sent to the Authority and was also published on the MATE website and on the internal student interface of Neptun.
(35) MATE stores the personal data of the data subjects in Neptun in connection with the dormitory admission procedure by applying the following data security measures:
- two-factor login;
- up-to-date updates;
20
- use of firewalls and anti-virus programs;
- […] backups are available, which are stored by the system for […] days. The status of the backups is checked by regular testing and test reloading. Only the persons operating the backup server have authorization;
- automatic […] setting, which stores snapshots of the past […] days. This allows the information to be restored within a short time in the event of an incident or emergency. The data recorded in the snapshot cannot be manipulated and contains the entire database;
- the electronic information system is protected by an […] intrusion detection and prevention system;
- the principle of least privilege applies: external supporters of […] (registered office: […], tax number: […], company registration number: […]; hereinafter: […]) as a data processor can only access the database with a […] key, from pre-announced IP addresses. MATE operators do not grant or receive authorization, only the authorizations necessary for operating the operating system, backup, and restoration are available. MATE's IT Directorate
operators do not have the right to access Neptun;
- a lockable, air-conditioned server room.
(36) According to MATE's statement, the following organizational units
may access the personal data of applicants:
- OIG Neptun and the Department of Educational Organization: administrator rights;
- OIG Academic Department: reading rights;
- University Dormitories Directorate and Dormitory Departments: reviewer/reviewer rights.
(37) According to MATE's further statement, Neptun runs on MATE's own server.
As part of system support operations, […] as a data processor can also access live database data. During system support activities, updates and program version changes necessary for the operation of the system are prepared, and system errors that arise are resolved. The detailed data processing operations are described in Article 1 of the data processing agreement. which MATE made available to the Authority.
(38) According to MATE's statement, the rights of the data subject can be exercised in several ways in connection with the dormitory admission process. The data subject can exercise some of the rights of the data subject himself, but if necessary, he can also contact the Administration, Data Protection and Educational Law Department, the data protection officer or the Education Directorate. The data subject can exercise the following rights:
- right to information and access;
- right to rectification;
- right to erasure and to be forgotten;
- right to restriction of data processing;
- right to object;
- right to data portability.
(39) According to MATE's statement, there are no faculties, the dormitory admission process exists in a central, single application template, therefore the procedure and the scope of documents to be submitted are completely identical for all dormitories on campus.
(40) MATE also provided information, supported by a document, that the number of dormitory admission procedures in the 2022-2024 period was as follows:
- 2018 in 2022;
- 1909 in 2023;
- 1911 in 2024.
21
(41) MATE also sent information on how many applicants requested that their social situation be taken into account in the dormitory admission procedure during the period under review. Based on this:
- in 2022, in the 2018 dormitory admission procedure, 1354 applicants requested a social situation assessment;
- in 2023, in the 1909 dormitory admission procedure, 1228 applicants requested a social situation assessment;
- in 2024, 1218 applicants requested a social situation assessment in the 1911 dormitory admission procedures.
I I I . 2 . D e s t r e p o r t i o n s g i n g the a p p r o c e d i t i o n (42) The MATE was registered on April 22, 2025, under the number NAIH-9574-2/2025., on July 17, 2025, under the number NAIH-9574-4/2025. and on November 19, 2025, under the number NAIH-9574-7/2025. In its submissions filed under number 1, the Authority maintained its statements made during the data protection authority inspection and supplemented them by stating the following:
(43) The Authority has not previously established a data protection infringement against MATE.
MATE cooperated during the prior authority inspection and also cooperated with the Authority in the authority procedure. It answered the questions in full, sent the requested documentation, and complied with the relevant deadlines.
(44) MATE conducts the social situation assessment procedure based on the Government Decree, however,
as the Authority has decided in its procedure for examining the compliance of another university's data processing with the requirements of the General Data Protection Regulation when submitting applications for regular social scholarships and assessing them
NAIH/2020/54/4. In its resolution no. 111, it also highlighted that “the legislator did not precisely define the scope of data to be processed, so the University was responsible for considering which data to process in order to take into account the aspects defined by the legislator.” No changes have been made to the legal provisions since then, so the definition of the scope of data to be processed continues to cause significant uncertainty for data controllers, including MATE. (45) Pursuant to Section 21 (4) of the Government Decree, “the social situation of the student – with the exception of applications for extraordinary social scholarships – shall be examined uniformly once per academic semester, at the institutional level – within the circle of applicants referred to in Section 11 (3) – by the committee designated for this purpose, and the results shall then be used to assess both social scholarships and dormitory admissions, as well as all other need-based benefits.” Due to this provision, MATE must carefully consider whether to request all necessary documents, as it will not be able to request additional documents later in the given academic semester in the framework of other procedures that require an assessment of the social situation.
(46) The aim of the social situation assessment is to ensure that the support is actually received by those in social need, as this is related to the public task of MATE. In order to fully clarify the facts and to avoid abuse, it is necessary to support the statements with documents.
(47) MATE was established in 2021. Its establishment and transformation, integrations, legal succession and harmonization of regulations coming from different institutions attached to MATE, development and standardization of procedures is a multi-stage process that requires significant resources and time. The internal regulation on the detailed analysis system of the social situation assessment sent to the Authority was revised in January 2025, and the spring 2022 procedure was already carried out on the basis of the new regulation. The amendments made in January 2025 are included in the table sent to the Authority as Annex 2 to the reply letter with registration number MATE-K/206-4/2025. In April 2025, MATE carried out a further, comprehensive review, in consultation with the fields of expertise and the EDJB. (48) MATE also stated that it intends to initiate an amendment to the Nftv. at the ministry of expertise, also covering the social situation assessment, highlighting the need for a shorter storage period for special data, by harmonizing the principle of limited storage. In MATE's opinion, in order for universities to be able to properly perform their public tasks in this area, it is necessary to expand and not restrict their rights, while limiting the duration of data processing to the minimum. (49) According to MATE’s statement, although there was no specific data processing information for the dormitory admission application, several points of the information obligation stipulated in Article 13 of the General Data Protection Regulation were implemented in the dormitory regulations, on the form or via the data protection subpage of MATE’s website. Following the deficiency detected during the Authority’s data protection audit, MATE, according to its statement, immediately prepared and published the missing document. The contact details of the Administration, Data Protection and Educational Law Department, as well as the name and contact details of the DPO, have been publicly available for years in the data protection menu item of MATE’s central website (which can also be clicked directly from the homepage: https://uni-mate.hu/adatvedelem), where any requests or complaints can be submitted. MATE has not received any data protection complaints regarding either the dormitory admission or the social situation assessment application. (50) MATE has listed in detail which legal basis it applies to the given data in the context of the dormitory admission and social situation assessment procedure during the period under review – which additional legality requirement under Article 9 of the General Data Protection Regulation in the case of health and other sensitive data. Based on this, MATE acts on the basis of the following legal provisions:
- Section 8 (2) a), Section 10 (2), Section 11 (3), Section 12, Sections 15-17, Section 21 of the Government Decree.
- Section 12 (5), Section 41, Section 84 (2) a), Section 85/B, Section 85/C of the National Act on the Protection of Personal Data. §-
a, § 110. (1) point 13, Annex 3. Part I. point I/B.
- Act XX of 1996 on identification methods replacing personal identification marks and on the use of identification codes (hereinafter: Szaztv.).
- Act XX of 1996 on the use of identification codes (hereinafter: Szaztv.).
- Act 325. (1) points a) and b) of the Code of Civil Procedure of 2016 (hereinafter: Pp.).
(51) In connection with the social situation assessment – both in the case of applicant students and their relatives and those living in the same household – MATE referred to the 2nd paragraph of its response letter to the Authority, registration number MATE-K/206-4/2025. annexes, which is included in paragraph (25) of this decision. The legal basis for the processing of the personal identification data and signatures of the student, his/her household members and witnesses is Article 6(1)(c) of the General Data Protection Regulation, while the legal basis for the processing of all other personal data included in the table is Article 6(1)(e) of the General Data Protection Regulation. In the case of sensitive data, the condition set out in Article 9(2)(b) of the General Data Protection Regulation is also met. (52) According to its statement, MATE reiterated in connection with the dormitory admission procedure that the legal basis for the processing is Article 6(1)(b) and (e) of the General Data Protection Regulation. There are two separate legal situations, purposes and data groups. One is the assessment of applications, the other is the preparation of the dormitory accommodation contract. MATE concludes a dormitory accommodation contract with the students, therefore MATE processes this data of the data subject in order to take steps at the request of the data subject prior to the conclusion of the contract, and is not subject to mandatory legal requirements. (53) According to MATE's statement, during the dormitory admission procedure and the social situation assessment, applicants have the opportunity to redact documents and data, so MATE accepts any redacted document that contains the data necessary for the assessment. If the applicant uploads a document that, after redacted, does not contain the data necessary for the assessment, the assessors will draw the attention of the data subject to the need to supplement the necessary data. MATE also referred to paragraph 1 of the response letter with the registration number MATE-K/206-4/2025 sent to the Authority during the official inspection. annexes, which contain, taking into account the principle of data economy, exactly what data is required for each document, thus allowing the applicant to send the necessary documents by covering up the rest of the document. Based on this, HJT - Appendix No. 4 (2022-2024) contains the following in connection with the social situation assessment:
- I., I.A a) sub-point: copy of an official document certifying the address;
- II. a) sub-point: address on the address card;
- list of documents to be attached: point 1. f) sub-point: copy of the relevant part of the bank account statement;
- list of documents to be attached: point 6: part of the court decision on divorce and child support;
- list of documents to be attached: point 18: sublease agreement part containing the rent;
- in the case of benefits, only the title, amount or fact of termination of the benefit is requested (list of documents to be attached: points 9, 10, 15, 16).
(54) According to the statement of MATE, it does not apply named cases in the dormitory admission procedure, however, the above are the guiding principles for the social situation assessment that can be taken into account as part of the procedure.
(55) In response to the Authority's question as to whether MATE based its data processing related to the social situation assessment and the dormitory admission procedure on Article 6(1)(b) and (e) of the General Data Protection Regulation, what is the reason for the fact that, in the screenshots of the forms created for the social situation assessment and the dormitory admission procedure, the "declaration" section at the bottom of the forms states that "I acknowledge that if I submit an application via the Neptun Study System, the submission of the application shall be considered as my unequivocal consent to the University forwarding the documentation submitted as part of the personal and application materials related to the application to the person or committee authorized to verify the implementation and decision of the application, and to the persons assessing the application to become familiar with the data contained in the application materials", MATE stated that, following the Authority's observations, the referred sentence was removed from the forms.
(56) MATE also sent a copy of the data processing information available on the social situation assessment form during the period under review.
The link referred to on the dormitory admission procedure form did not point to a data processing information during the period under review, which was rectified by MATE in 2025.
(57) According to MATE’s statement, by income assessment, it is understood that the income of people living in the same household is assessed based on supporting documents, which can be used to determine the income per capita of people living in the same household, and in the case of self-supporting students, the student’s income. According to Section 21 (2) of the Government Decree, when calculating income, the average of the last three months must be taken into account for incomes that can be measured regularly on a monthly basis, and the twelfth of the last year must be taken into account for other incomes. However, the NAV only issues income certificates for the financial year closed with a tax return, so its substantive data content can be up to 1-1.5 years earlier than the date of submission of the social situation assessment. This justifies the need for documents and certificates requested during the income assessment. (58) According to the MATE statement, based on Section 21 (1) c) of the Government Decree, the costs of the student's social situation must be taken into account when assessing the student's social situation if the student does not live in a shared household as defined in Act CXXII of 2019 on those entitled to social security benefits and the coverage of these benefits (hereinafter: the Act). A self-supporting (independent) student must prepare a statement of income and expenses so that his/her costs can be determined and taken into account, and because it can be established on this basis whether the student's income is able to cover his/her expenses. If the student's expenses permanently exceed his/her income, he/she cannot be considered a student leading an independent life, since in such a case it can be assumed that the student is supported by his/her parents, and therefore he/she is not entitled to receive points on this basis. According to its statement, MATE processes employment-related data in connection with the social situation assessment, given that the applicant can credibly prove social need and entitlement to social benefits with these documents.
(59) Regarding the data and documents handled by MATE in relation to the assessment of the household income situation of self-supporting students, it referred to the table described in paragraph (25) of the decision.
(60) According to MATE's statement, the reviewer's responsibilities include scoring the applications submitted by students on the basis of the supporting documents submitted by the student, and, if necessary, sending a notice of deficiency to the student concerned via Neptun to prove a missing circumstance. The reviewer does not have decision-making competence in relation to the student's application; the EDJB has decision-making competence. The legal basis for data processing here, as well as in the case of third parties, is Article 6(1)(c) and (e) of the General Data Protection Regulation.
(61) In the case of credit data, it is sufficient for the student to prove that the transaction has taken place. The student may submit any document suitable for proving this, and may also have the right to remove any excess data. (62) MATE also commented that the Authority stated in its decision No. NAIH-9574-6/2025 that the subject of the data protection authority inspection and then the data protection authority procedure is the examination of the compliance of MATE's data management practices related to dormitory admissions with the General Data Protection Regulation, including the examination of the application of the principles of data management, the legal basis for data management, and the appropriate prior information. However, during the proceedings, the Authority examined not only the data management practices related to the dormitory admission procedure – which was the subject of the proceedings – but also the data management practices of the social situation assessment, despite the fact that the Authority also stated in paragraph (10) of the order that the dormitory admission procedure and the social situation assessment are two separate procedures. As the Authority also refers to in paragraph (11) of the order, during the dormitory admission procedure, MATE – with regard to Section 21 (4) of the Government Decree – only uses the results of the social situation assessment. This provision states that the student’s social situation is examined once per academic semester, uniformly at the institutional level, by the committee designated for this purpose, and then uses the results – among other things – to assess dormitory admissions. The result of the social situation assessment is a score, i.e. only one score is taken into account during the dormitory admission procedures. Since the score given to the social situation of the 25 students is made up of several items (income per capita, transportation between the place of residence and the place of training, the student's own social situation, and the situation of those living in the same household with the student), no data on the income situation, health status, etc. of the student or those living in the same household can be obtained from this score, but no conclusions can be drawn regarding this, given that it cannot be determined from this score for which items the student received points. (63) Based on all of this, MATE requested the Authority to clarify the points of the facts that relate to the data management practices of the MATE social situation assessment [(16); (17); (18); (19); (20); 21); (22); 23); (24); (25); 27); (33); (37 except the first sentence); (38).], examine
above.
I I I . 3 . M A T E G E N T R E A N D O C T I O N
(64) MATE attached the following
documents to its response letters in the official inspection and in the official procedure:
- MATE dormitory applications 2022-24;
- Dormitory regulations (November 15, 2023 and September 17, 2024);
- Dormitory admission application form (for semesters 2024-25/1 – 2024-25/2);
- Data processing information for dormitory admission applications (January 9, 2025)
- Dormitory admission information for first-year and senior students (2022-2023
and 2024-2025 academic years);
- Dormitory Regulations (2021.06.25., 2023.11.15. and 2024.09.17.)
- Unified dormitory admission points system 2021.05.31
- Screenshots of dormitory admission applications for senior years
(2023-24-1 and 2023-24-2 semesters, and 2024-25-1 and 2024-25-2 semesters)
- Screenshots of dormitory admission applications for freshmen (2023-24-1 and
2023-24-2 semesters, and 2024-25-1 and 2025-25-2 semesters))
- Data processing information for social scholarship application-2022.
- Data processing information for the social scholarship application-2024.
- Screenshots of applications for social situation assessment (2021-22-2-
2024-25-1 and 2024-25-2)
- Organizational and Operational Regulations - III. Student Requirements System - III.2.
Student Benefits and Reimbursements Regulations (February 16, 2024);
- Organizational and Operational Regulations - III. Student Requirements System - III.2.
Student Benefits and Reimbursements Regulations - Appendix No. 2: On the Unified University Dormitory Admission Points System (May 31, 2021);
- Organizational and Operational Regulations - III. Student Requirements System - III.2.
Student Benefits and Reimbursements Regulations – Appendix No. 4: Analysis system of the social
situation assessment (2022-2023-2024);
- Social situation assessment_documents, personal data – which can be considered as the form of Appendix No. 4 of the HJT
in the table;
- Social situation assessment 2022-2024 - statement table;
- Organizational and Operational Regulations (March 1, 2022, February 1, 2023, June 22, 2023, November 15, 2023, January 1, 2024, April 12, 2024);
- […] data processing agreement (August 3, 2023);
- Data protection training materials (video, summary of basic data management skills);
- Confidentiality Statement;
- Employment Contract and Employment Contract Amendment
- Data Protection Policy (August 26, 2021)
26
I I I . 4 . A n d e f i c a l l i t i o n s t i o n (65) According to the information available on its website, MATE “has been operating as one of the largest agriculturally focused, multidisciplinary training and research institutions in Europe since its foundation on 1 February 2021. Our aim is to provide world-class training to young people who graduate from our university and who take a leading role in the development of the Hungarian agriculture and food industry, which has a long history and excellent potential, with a secure living and an inspiring career.”3 (66) Based on the statements made by MATE and the documents sent by it, it can be stated that the purpose of data processing related to dormitory admission is to properly assess applications, to provide dormitory accommodation to the most needy students by assessing and taking into account their social situation. (67) The dormitory admission procedure and the social situation assessment can be started on the student interface of the Neptun study system running on MATE's own server, as separate applications, since the social situation assessment can be linked to other applications, so it is an independent procedure from the dormitory admission procedure. Completing the social situation assessment is not mandatory in connection with the dormitory admission procedure, so it is not a condition for it, however, if the student wishes to take his/her social circumstances into account - and avoid receiving zero points for these circumstances - during the dormitory admission procedure, then it is necessary to submit the social situation assessment application prior to the dormitory application. According to the Dormitory Admission Information, "submitting the social situation assessment application is not mandatory, however, without submitting the social situation assessment application, his/her social score will be zero". (68) In the dormitory application, the content of the social situation assessment is invisible,
only the achieved social score and a yes/no flag are raised, indicating whether a special circumstance occurred during the social assessment that justifies giving preference to the applicant, so MATE only processes this information about the social situation in the dormitory admission procedure.
(69) As stated in paragraph (23), MATE indicated for each personal data item the legal basis for processing the given data in the dormitory admission procedure: Article 6(1)(b) and (e) of the General Data Protection Regulation. According to its statement, there are two data groups and legal situations in this case. One is the assessment of applications, the other is the preparation of the dormitory accommodation contract. MATE concludes a dormitory housing contract with the students, therefore MATE processes this data of the data subject prior to the conclusion of the contract in order to take steps at the request of the data subject, and not on the basis of a mandatory legal requirement.
(70) Additional legal bases cited by MATE are the provisions of the National Social Security Act, the Government Decree, the Public Security Act, the Civil Service Act, and the Personal Data Act. In addition, according to its statement, sensitive data, as well as the personal data of applicants’ relatives and those living in the same household, are not processed in connection with the dormitory admission procedure, but in the procedure aimed at assessing the social situation.
(71) MATE conducts the social situation assessment every six months. A newsletter is prepared on the social situation assessment every six months, which the MATE Education Directorate publishes on its website4. The EDJB decides on the students’ social situation score. A tabular summary of the submitted social situation assessment applications is prepared as a decision-preparatory material for the decision of the 3 https://uni-mate.hu/k%C3%B6sz%C3%B6nt%C5%91
4 https://oig.uni-mate.hu/szocialis-hlyzetfelmeres
27
A tabular summary of the submitted social situation assessment applications is prepared as a decision-preparatory material for the decision of the 27
EDJB, which is shared privately with the members of the committee via the university's repository5. This aggregated material no longer contains certificates or documents.
(72) In connection with the procedure for assessing the social situation, MATE processes the personal data of the applicants and their relatives, as well as of other third parties (including, for example, those certifying the given certificate) on the basis of Article 6(1)(e) of the General Data Protection Regulation. The processing of special categories of personal data is necessary for the exercise of specific rights of data subjects arising from legal provisions governing social protection [Article 9(2)(b) of the General Data Protection Regulation].
(73) MATE has provided the Authority with a separate table in accordance with paragraph (25) with details of which personal data MATE processes in connection with the procedure aimed at assessing social situation, the necessity of their processing, and what kind of verification is required to support the given data and circumstances.
(74) Part of the assessment of social situation is the assessment of financial situation, and MATE has provided a detailed statement on its implementation in accordance with paragraphs (57)-(58).
(75) Documents must be attached to applications so that the points that can be awarded can be verified. The legal basis for processing documents is the same as the legal basis for processing personal data.
(76) When requesting the given verification, MATE complies with the principle of data saving by requesting only the documents necessary to prove eligibility. The documents are stored by Neptun, and the student can upload them to his or her own storage space as attachments to the application.
(77) Following the principle of data economy, MATE requests incomplete documents in certain cases. In some cases, MATE also draws attention to the fact that documents have been redacted. These are included in the table sent to the Authority in accordance with paragraph (26).
(78) MATE also sent the Authority the sample certificates used in the period under review.
(79) MATE presented the data security measures it uses to store the personal data of the data subjects in the Neptun system in connection with the dormitory admission procedure.
(80) It also presented which organizational units and positions of MATE have access to dormitory application forms and personal data processed during the dormitory admission procedure.
(81) MATE did not have a separate data management information for the dormitory admission procedure between 2022 and 2024. According to its statement, the relevant internal university regulations and the internet platforms provide some information on data management (for example, on the scope of personal data managed, the purpose of data management, the identity of the data controller, the contact information of the data protection officer). Furthermore, the data related to study results, institutional, professional, scientific and public activities managed within the framework of the application are already managed by MATE, only the purpose of data management changes, so in its opinion, the data subjects already had information on the management of these data. However, MATE examined this issue at the request of the Authority and established the deficiency, therefore, in order to promote transparency and provide full information, it prepared a separate data management information sheet for the submission of the dormitory admission application in addition to the existing regulations, which MATE sent to the Authority and also published on the website and the Neptun internal student interface.
(82) MATE has a separate data management notice – also sent to the Authority – on the data management related to the social scholarship application, which – according to its statement – also contains information on the processing of personal data of third parties.
(83) Data subject rights can be exercised in several ways in connection with the dormitory admission procedure. The data subject can exercise some data subject rights himself, but if necessary, he can also contact the
Administration, Data Protection and Educational Law Department, the data protection officer or the
Education Directorate.
(84) MATE also provided information on the information and data protection training that its employees receive regarding the application for assessing the social situation and the tasks to be carried out within the framework of the dormitory admission procedure, and the confidentiality obligation that they are subject to.
(85) Students do not perform any tasks within the framework of the dormitory admission procedure. They participate in the assessment of social situation assessment applications, in order to perform the tasks specified in paragraph (33), following the training described in paragraph (34).
(86) MATE also presented in detail what material facts and circumstances the Authority should take into account in determining the amount of the fine in the event of a finding of a violation of the law and the imposition of a potential data protection fine.
(87) The regulations it sent also contain information corresponding to the statements submitted by MATE, which did not change significantly from a data protection perspective during the period under review.
(88) According to Section 16 (3) of the HJT, the rules related to dormitory admission are determined by the Dormitory Regulations.
(89) Section 37 of the HJT provides for the assessment of social situation. According to this, the condition for the use of social-based grants is the examination of the student's social situation in accordance with the Government Regulation. In accordance with § 21. The social situation of the student shall be examined once per academic semester, uniformly at the institutional level, the results of which shall be used, among other things, for the assessment of the dormitory admission procedure. The system for the detailed analysis of the student's social situation is contained in Appendix 4 of the HJT, which also includes the certificates required by the MATE, in such a way that the appendix to the appendix also contains sample documents for this purpose. The application for a student's social situation assessment shall be submitted to Neptun, and the assessment shall be carried out by the EDJB with the involvement and cooperation of the EHÖK. (90) The Dormitory Regulations – their § 5 – state that during the admission procedures, the assessment of the admission shall be based on the uniform dormitory admission point system according to Appendices 2 and 4 of the HJT. During the dormitory admission procedure, students’ admission-related data shall be handled in accordance with the university’s data management rules. When assessing dormitory applications, preference shall be given to those with the following social situations:
a) orphans;
b) half-orphans;
c) breadwinners;
d) large families;
e) multiple disadvantaged;
f) disadvantaged;
g) disabled or in need due to their health condition;
h) permanently ill
h) permanently ill;
i) belonging to a group of applicants belonging to a nationality;
j) Hungarians of Hungarian nationality abroad;
k) participants in doctoral training;
l) students who have participated in the public education Arany János Talent Development Program.
(91) Appendix No. 2 of the HJT on the unified university dormitory admission point system
contains that the rules of this appendix shall be taken into account during the calculation of points,
and the point system specified therein shall be applied. The appendix also includes that the social situation shall be taken into account during the calculation of points, based on Appendix No. 4 of the HJT on the social situation analysis
system.
(92) Appendix No. 4 of the HJT on the social situation analysis system contains information on the data handled, the documents to be submitted, and also contains the declaration templates prepared and intended to be used by MATE.
The Declaration templates can be found at the end of Appendix No. 4, which are the following:
• Appendix No. 1: Declaration form from the relative
• Appendix No. 2: Declaration form from the student
• Appendix No. 3 Annex 1: Certificate of regular social scholarship based on the student's
disability or health condition
• Annex 4: Declaration on costs arising from the applicant's
health condition
• Annex 5: Declaration on costs arising from the health condition of a natural person living in the same household as the applicant
(93) In Annex 1, the declaration to be made by the relative on the relationship
, the necessary information can be provided in a free text section. The declaration
also includes the name, place and date of birth of the person concerned, the mother's name, and address,
and in the case of two witnesses, their names, signatures, and addresses. The annex also includes in the footnote
the link where the data management information for the social situation assessment can be accessed6, and another link where MATE can be contacted in data protection matters7.
(94) In Annex 2 Annex 2, the declaration to be given by the student can also include the necessary information in a free text section. The declaration also includes the name, place and date of birth of the person concerned, the name and address of his mother, and in the case of two witnesses, their names, signatures and addresses. Similar to Annex 1, Annex 2 also includes in a footnote the link where the data processing information for the social situation assessment is available, and another link where you can contact MATE in data protection matters. (95) Annex 3 Annex, the certificate to be filled out by the applicant's family doctor based on the student's disability or health condition for the regular social scholarship shall include the following:
"According to the expert opinion/official document presented to me,
Name:
Date of birth:
Permanent address:
According to Government Decree 51/2007 (III.26.) on the benefits of students participating in higher education and certain payments to be paid by them,
a person with a disability or in need due to his/her health condition, considering that
- he/she needs constant or increased supervision and care due to his/her disability,
or who regularly needs personal and/or technical assistance and/or services due to his/her disability, or
- he/she has lost at least 67% of his/her working capacity or has suffered at least 50% health impairment suffered from, and this condition has lasted for one year or is expected to last for at least one more year.
I have issued the above certificate to the named person based on the opinion/expert opinion/certificate of the body/authority/doctor with the appropriate competence and competence, which was presented to the named person in advance for the purpose of issuing this certificate.”
(96) This Annex No. 3 contains in a footnote what MATE considers to be such disabilities in accordance with Law 87/2015 on the implementation of certain provisions of Act CCIV of 2011 on National Higher Education. Government Decree § 62, which MATE takes into account during the social situation assessment: people with limited mobility, hearing impairment (deaf, hard of hearing), visually impaired (blind, partially sighted, low vision), speech impairment (dysphasia, dyslalia, dysphonia, stuttering, slurring, aphasia, nasal speech, dysarthria, mutism, severe speech perception and comprehension disorder, central deafness, delayed speech development), psychological developmental disorder (dyslexia-dysgraphia-dysorthography, dyscalculia, hyperactive, struggling with attention deficit disorder, behavioral regulation disorder (disorders of socio-adaptive processes, behavioral characteristics showing weakness of emotional control, aggression towards oneself or others, anxiety, self-regulation, adaptability, goal-directed behavior, self-organization, and those with autism, who struggle with metacognition
different development.
(97) According to Annex 3, the specific disability does not need to be listed on the certificate, but only the one that is typical of the student and X-marked.
(98) Based on Annex 3, taking into account the table in paragraph (26), MATE processes the following personal data in connection with the disability: name, date of birth, permanent address, signature of the general practitioner, address of work, fact of disability or fact of reduced working capacity and name of the general practitioner.
(99) Annex 4, completed and signed by the student and signed by two witnesses, is a declaration of the costs incurred in view of the applicant's health condition.
The content of this is as follows:
31
The undersigned … (name of the applicant student) ...(date of birth), … (permanent address) as a student applying for a regular social scholarship/funding grant at the Hungarian University of Agricultural and Life Sciences, aware of my criminal liability,
declare that – in the case of the autumn semester, for the period between April 1 and June 30 of the given year, and in the case of the spring semester, for the period between October 1 and December 31 of the previous year -

The circumstances requested to be taken into account when determining the social situation
Amount of expenses incurred on average monthly
as a student with a confirmed disability
the purchase and maintenance of special equipment, my special travel
needs, expenses arising from the use of a personal assistant or a sign language interpreter
… HUF
My regular medical expenses arising from my confirmed health condition
… HUF
(100) Annex 4, in accordance with Annex 3, contains in a footnote what MATE considers to be a disability. In addition, Annex 4 – similarly to Annexes 1 and 2 – also contains in a footnote the link where the data management information for the social situation assessment can be accessed, and another link where MATE can be contacted in data protection matters.
(101) Based on Annex 4, taking into account the table described in paragraph (26), MATE processes the following data in relation to the health expenses related to the health of the applicant student: name, date of birth, address, health status, health expenses, names and addresses of witnesses.
(102) Annex 5 Annex A declaration on the costs incurred due to the health status of the natural person living in the same household as the applicant student, which includes the following: I, the undersigned … (name of the person living in the same household as the applicant) ... (date of birth), … (permanent address), declare, aware of my criminal liability, that I live in the same household as the student … (name of the student) … (date of birth) … (permanent address) applying for a regular social scholarship/basic allowance, and – in the case of the autumn semester, for the period between April 1 and June 30 of the given year, and in the case of the spring semester, for the period between October 1 and December 31 of the previous year - Circumstances requested to be taken into account when determining the social situation My health status (underline the appropriate one) as a close relative of the student - disabled - permanently ill - changed I am able to work as a relative of the student - disabled - permanently ill - with altered working capacity When determining the social situation Amount of expenses incurred monthly 32 circumstances requested to be taken into account on average As a close relative of the student My regularly arising health expenses due to my certified health condition My health expenses ... HUF As a relative of the student in need of care Costs related to my care ... HUF (103) Annex 5 contains in a footnote the concepts of relative and close relative, as well as the link where the data management information for the social situation assessment is available8, and another link where you can contact MATE in data protection matters9. (104) Annex 5 no. Based on Annex 1, taking into account the table described in paragraph (26), in connection with the verification of the costs arising from the health condition of a close relative living in the same household as the applicant student, MATE processes the following data: name of the relative, date of birth, address, health condition, health costs, names and addresses of witnesses, with the proviso that, as a result of an amendment in 2025, in Annex 5, MATE only asks the relative to provide the costs, not the health condition. (105) Appendix 4 of the HJT on the social situation analysis system contains how to verify living in the same household. In order to establish this, the applicant must attach an original official certificate/certificate issued by the county government office, local district office (government window), local government, or notary, no older than 3 months, stating the number, names, and dates of birth of the persons living in the same household, including the student, and a photocopy of the authority certificate (hereinafter referred to as the address card) certifying the applicant's address. If the student does not attach a certificate of the persons living in the same household, no points can be awarded for the per capita income. If the persons living there are not listed by name on the certificate, a copy of the address cards must also be attached. If the certificate of cohabitation includes a person who does not actually live there, a copy of the person's address card is required, which shows a different address or place of residence than the one on the certificate of cohabitation. If the person on the certificate of cohabitation but not living in the same household has no other registered address, a document (such as a tenancy agreement) or a declaration (written on the form in accordance with Annex 1) regarding the place of residence must be attached. If a person who is not on the certificate of cohabitation lives with the student in the same household, the person living together may prove this by making a declaration in a personal document in accordance with Annex 1. (106) Appendix 4 on the analysis system of the social situation assessment also determines how many points can be awarded to the student for each circumstance. Based on this, 20 points are awarded for disability or need due to a health condition, while a permanently ill student receives 5 points for a monthly regular cost of over 10,000 HUF, 4 points for a monthly regular cost of between 5,000 and 10,000 HUF, and 3 points for a monthly regular cost of between 1,000 and 5,000 HUF. 
8 https://oig.uni-mate.hu/szocialis-helyzetfelmeres
9 https://uni-mate.hu/adatv%C3%A9delem
33
(107) To prove this, according to the Social Situation Assessment_documents, personal data
document, certificates 3 and 4 must be submitted, with which the following data is processed by MATE. In connection with disability: name, date of birth, permanent address, signature of the family doctor, address of workplace, fact of living with disability or fact of reduced working capacity and name of the family doctor. In connection with health expenses related to the health of the applicant student: name of the student/relative, date of birth, address, health status, health expenses, names and addresses of witnesses. (108) According to Appendix 4 on the analysis system of the social situation assessment, plus points can be awarded to the applicant and his/her relative in case of long-term illness or inadequate health status. A student with a chronic illness will receive 5 points for a monthly regular cost of over 10,000 HUF, 4 points for a monthly regular cost of between 5,000 and 10,000 HUF, and 3 points for a monthly regular cost of between 1,000 and 5,000 HUF, while 20 points will be awarded for an inadequate health condition. In addition, 5 points may be awarded per person for a disabled or chronically ill close relative. Based on the health expenses that regularly arise due to the health condition of the close relative (disability, invalidity or long-term illness), 5 points can be awarded for a regular cost of over 10,000 HUF per month, 4 points for a regular cost of between 5,000 and 10,000 HUF per month, and 3 points for a regular cost of between 1,000 and 5,000 HUF per month. (109) To prove all these circumstances, according to the Social Situation Assessment_Documents, Personal Data document, certificates 3 and 4 must be submitted with regard to the student, as detailed in the above point. Regarding close relatives, certificate 5 must be submitted, with which the following data is processed by MATE. The name, date of birth, address, health status, medical expenses, names and addresses of witnesses of the relative, with the MATE requesting only the relative's expenses in Annex No. 5, as a result of an amendment in 2025, and not the health status. (110) In accordance with Annex No. 4 of the HJT on the social situation analysis system, regarding the number of people living together in the property at the student's address, registered there or having a place of residence, MATE requests an original official certificate/certificate issued no older than 3 months by the county government office, local district office (government window), or local self-government or notary competent for the applicant's place of residence, regarding the number, names and dates of birth of the applicant and the persons living in the same household, as well as a photocopy of the student's residence card. If the certificate does not list the residents by name, a copy of their address cards must also be attached. If the certificate of residents at the same address lists a person who does not actually live there, a copy of the address card is also required.
(111) Appendix 4 of the HJT on the social situation analysis system also includes proof of the income situation of those living in the same household. According to this:
“An official and original certificate signed by the employer must be attached for all income of those living in the same household, unless it is specifically stated that a photocopy certified by the applicant’s signature and dated is also acceptable.
When determining the monthly net income per person, the amount of alimony, pension, dependents' allowance, disability allowance, family allowance, jobseeker's allowance, orphan's allowance must be taken into account based on the document proving its amount,
furthermore, if the applicant does not live in the same household as his parents, the parents' statement No. 1 stating the amount of support they provide to the student per month.
34
The income certificates of the persons living in the same household must clearly establish who earned the income and in what period.
If the applicant's sibling has an income and his permanent address or place of residence is the same as the applicant's, i.e. it is stated on the official certificate, it is also necessary to attach documents regarding his income. If the applicant's sibling does not live in the same place as his/her usual place of residence, then No. 1 must be confirmed by a statement according to Annex 1.
When calculating the income per capita, the income of family members who do not have a regular income that ensures their livelihood (e.g. the income of a sibling studying in secondary school, full-time, from temporary student work) shall not be taken into account.
(For the purposes of the social situation assessment, a household is understood as a group of persons who jointly decide on the use of their income, typically connected by ties of kinship. The cohabitation of several generations (grandparents, parents, children) is also considered a household. The income of the supporting parent's partner must also be taken into account).
When calculating income, the average of the last three months shall be taken into account for income that can be measured regularly on a monthly basis, and the twelfth of the last year shall be taken into account for other income. […]”
(112) Income can also be supported by an income certificate issued by the National Tax Agency. According to Appendix No. 4 of the HJT
on the social situation analysis system, the following should be attached to the certificate issued by the National Tax Agency:
“a) In the case of employees/employees, to prove income from employment: an income certificate issued by the employer no older than 1 month, in a company style, on the average income for the previous 3 months from the date of submission of the application (including income earned abroad). If the current income certificate shows a lower amount than the NAV certificate, please
explain the reason for this in a statement (a statement from the breadwinner is required)!
b) In the case of entrepreneurs: only an income certificate issued by the National Tax Agency for the tax year closed prior to the academic year of the application. […]. If the business has ceased in the meantime, please
attach the a document confirming this.
c) In the case of primary producers: submission of a certificate from the primary producer family farm register (ŐCSI register) that can be downloaded from https://portal.nebih.gov.hu, and in addition, a primary producer income certificate from the National Tax Agency for the year preceding the submission of the application to prove income;
d) In the case of unemployed persons: a certificate issued no older than 30 days by the District Employment Department of the competent District Office on the amount of jobseeker's allowance/lack thereof, as well as a certificate issued by the competent district and the competent local government on the amount of settlement support/lack thereof;
e) In the case of old-age pensioners or relatives' pension recipients: a copy of the pensioner's ID card, a notice issued by the Hungarian State Treasury Pension Payment Directorate in the previous calendar year on the benefit paid and the current change in the amount of the benefit, or a copy of the last monthly pension slip, or a copy of the relevant part of the bank statement in case of transfer to a bank account;
f) In the case of a person receiving disability or rehabilitation benefit: in the case of a student applicant, the disability must be confirmed on the certificate in accordance with Annex 3, and the amount of the disability or rehabilitation benefit must be confirmed with a document proving the amount paid in the month preceding the submission of the application (e.g. bank statement, postal receipt). In the case of a person living in the same household as the student, the amount of the disability or rehabilitation benefit must be confirmed with a document proving the amount paid in the month preceding the submission of the application (e.g. bank statement, postal receipt).
(113) MATE processes various data in relation to employment. For example, the legal title under which the student lives together in the property at his/her home address, is registered there or has a place of residence, what type of income he/she has (for example, employee, sole proprietor) and how much monthly income he/she has (what amount of income the breadwinner has). Furthermore, for example, name or name of sole proprietorship, net income, tax identification number or tax number, amount of tax paid in the tax year, primary producer registration number, home address, date of birth, job, monthly net income and its average, employer: name, tax number, seat and name of the person issuing the certificate and the name of the employer's legal representative, sole proprietor's name, tax number, registration number, seat, date of termination, amount of settlement support, amount of jobseeker's allowance, pension, amount of disability benefit, amount of various additional subsidies and benefits. (114) Appendix 4 of the HJT on the social situation analysis system states that in order to verify the distance between the place of training and the applicant's place of residence, the duration and cost of the trip, the student's place of residence must be processed, as well as the distance between his place of residence and MATE as the place of training and the duration of the trip. Based on the MATE social situation analysis system, in this round, the student - in accordance with Section 21 (1) b) of the Government Decree - receives points on the one hand for how far his place of residence is from the place of training. In this case, the points are determined by the distance between the place of residence and the place of training, the duration and cost of the trip. (115) According to Appendix No. 4 of the HJT on the social situation analysis system, if the student lived in a “sublet”, this was proven until 2025 by attaching the part of the “sublet” contract containing the rent. From 2025, a modification was made, according to which, in the case of an applicant living in a “sublet”, the “sublet” contract must be attached in such a way that the personal and additional data of the landlord, except for the name of the landlord, in the case of a joint lease, the personal and additional data of the co-tenant(s), except for the name of the co-tenant(s), and the additional costs, except for the rent and the overhead costs, are redacted. (116) According to Appendix 4 of the Social Situation Analysis System of the Hungarian Social Security Administration, students are awarded points if they have their own children, as follows: 5 points for one child/fetus, 10 points for two children/fetuses, and 15 points for three or more children/fetuses. A copy of the child(ren)'s birth certificate or school attendance certificate, or a copy of the maternity book, is required to verify the child(ren). (117) In the case of an orphan student, 20 points are awarded, while in the case of a half-orphan or a student whose guardianship has ceased due to reaching the age of majority, 10 points can be awarded. In the case of an orphan or half-orphan applicant, an official certificate from the Pension Payment Directorate regarding the amount of orphan's benefit to be paid for the given year must be attached, or if the applicant is no longer receiving orphan's benefit, a copy of the death certificate. In 2025, a modification was made, as a result of which the decision on the termination of the orphan's allowance must be attached, and the death certificate has been deleted.
(118) A disadvantaged student may be entitled to 10 points, while a cumulatively disadvantaged student may be entitled to 20 points. In the case of disadvantaged or cumulatively disadvantaged students, the decision of the competent notary/guardian office establishing the situation must be attached.
(119) If the student is self-supporting, 5 points can be awarded. In the case of a self-supporting applicant, a declaration in a private document by the parents must be attached stating that the applicant does not receive any benefits from them if he lives in the same household as the parents. It is also necessary to attach a NAV 36 income certificate from the self-supporting applicant.
(120) The student can also receive 10 points if his or her parent or breadwinner is divorced, widowed, or single for some other reason. In the case of divorced parents, a copy of the part of the court decision on divorce that provides for divorce and child support is required, or if a separate decision has been made on child support, a copy of the document providing for it. In the case of parents living separately, MATE requests a fully probative statement in a private document about the fact of separation and the amount of child support paid/not paid. In the case of a widowed breadwinner, an official certificate from the Pension Payment Institute is required about the amount of the benefit to be paid for the given year, or, if he or she does not receive a widow's pension, a decision on the termination of payment must be attached. (121) If the student has a sibling who is a full-time/part-time student in public education or higher education, or who is not yet participating in public education, he/she can receive 5 points/person, but a maximum of 15 points. If the student's sibling receives nursery care, a certificate from the nursery is required. In the case of a sibling participating in public education, if the sibling still lives in the same household as the applicant, a certificate of kindergarten/school attendance is required. If the sibling is participating in higher education, a certificate of student status for the current semester must be attached. If the related student is unable to attach a certificate of status for the given semester, a statement must be attached to the certificate of status for the previous semester stating that he/she wishes to continue his/her studies. In the case of related students who have not yet enrolled in the higher education institution, the admission decision must be attached to the declaration.
(122) If a close relative with a disability or a chronic illness lives in the same household as the student, 5 points can be awarded.
(123) If an unemployed adult who does not receive benefits lives with the student, 5 points can be awarded. If an adult who receives unemployment benefits lives with the student, 2 points can be awarded.
(124) In the event that a retired parent or breadwinner lives with the student, 5 points can be awarded per person.
(125) The data management information related to the dormitory admission application includes the data of MATE as the data controller, the applicable legislation (General Data Protection Regulation, Nftv., Government Decree, Onytv.), the processed personal data specified in paragraph (23) of the resolution – the social score also as described in paragraph (23) – indicating the purpose and legal basis of the data management. It also includes the duration of the data management (10 years) in accordance with what was presented by MATE, the data security measures, the rights of the data subject and legal remedies.
(126) The data management information related to the social situation assessment also includes the data of MATE as a data controller, the applicable legislation (General Data Protection Regulation, Nftv., Government Decree, Pp., Szaztv.). Regarding the personal data processed, it is stated that the information records the nature of the documents and data necessary for determining the ranking, the specific documents and information regarding the point system, based on the authorization of Section 21 (3) of the Government Decree, are contained in Volume III of the MATE Organizational and Operational Regulations, Appendix No. 2 and 4 of the HJT, which are available at the links published in the information. (127) The data processing information related to the social situation assessment also includes the purpose of the data processing:
37
- identification of the data subjects included in the declarations and the validity of the declarations, the legal basis of which is a legal obligation pursuant to Article 6 (1) c) of the General Data Protection Regulation, taking into account Section 325 (1) a) and b) of the Pp. and Section 4 of the Szaztv.)
- “we need it to calculate the points that can be awarded based on the income situation and to support the declarations; we need it to calculate the points that can be awarded based on the family situation; we need it to establish and prove the costs of visits and other charges; we need it to support the points that can be awarded based on the health expenses that arise due to the health condition.”, the legal basis of which is statutory authorisation based on Article 6(1)(e) and Article 9(2)(b) of the General Data Protection Regulation, with regard to Sections 16, 17 and 21 of the Government Decree,
(128) In addition, the data processing information related to the social situation assessment
includes the duration of data processing (80 years) in accordance with what was presented by MATE, the data security measures, the rights of the data subject and the possibilities of legal remedy.
(129) The Dormitory Admission Information for first-year students also contains information on the certificates to be submitted, referring to the relevant parts of the HJT, as follows:
- “You can request a decision/official certificate/certificate on the number of people living in a household according to their lifestyle from the County Government Office, local District Office (Government Window), local Municipality, or notary public competent for your place of residence.
- The distance of the trip must be proven with a photo of the “Google Maps” screen, where the
distance (km) is clearly visible.
- It is advisable to prove the cost of the trip with a photo of the MÁV/Volán/BKV website screen. Here
it is very important to calculate the price of a one-way student ticket. The duration of the trip must also be proven with a photo of the “Google Maps” route planner screen.
- The applicant’s net monthly income is not the same as the net monthly income per person. If the applicant has his/her own income, please indicate the amount in this field. NEPTUN automatically generates the net monthly income per person from the earnings of his/her family members. The income certificate issued by NAV must be uploaded for each person living in the same household as the applicant and having an income. - Please note that the income certificate issued by NAV and the income certificate issued by the employer are not the same. Both documents must be attached to the application. - If you wish to submit a personal document/statement with full evidentiary value about a fact: The Declaration Samples can be found at the end of Appendix 4 of HKR III. 2. HJTSZ, as follows (Please DO NOT UPLOAD your personal and relatives' medical documents in case of illness): • No. 1. Annex 1: Declaration form from the relative (word)
• Annex 2: Declaration form from the student (word)
• Annex 3: Certificate for regular social scholarship based on the student's
disability or health condition (word)
• Annex 4: Declaration on costs arising from the applicant's
health condition (word)
• Annex 5: Annex: Declaration on the costs incurred due to the health of a natural person living in the same household as the applicant student (word)”
(130) The Dormitory Admission Information Sheets also contain a link – for both first and senior students – to the 38th data management information sheet on the social situation assessment.
(131) According to the screenshots of the dormitory admission applications, the following statements can be found at the end of the application:
“The undersigned, Teszt Ella, acknowledge that if I submit an application via the Neptun Electronic Study System, submitting the application shall be deemed to be my express consent to the University forwarding the documentation submitted as part of the application and the application materials to the person or committee authorized to verify the implementation and decision of the application, and to the persons assessing the application to use the data contained in the application materials get acquainted with it.
I also acknowledge that if I do not upload a suitable supporting document for the points I have indicated during the error correction period of the application, the elements in question will be counted with zero points in the ranking.
By signing the application, I declare that I have read the Data Management Information of the Hungarian University of Agricultural and Life Sciences, I have understood its contents and I consider it binding on me.
(132) In connection with this form, MATE stated that the link referred to did not point to a data management information during the period under review, which deficiency MATE will rectify in 2025 and send the information.
(133) According to the screenshots of the applications for social situation assessment, the following statements can be found at the end of the application:
"By submitting the application for social situation assessment, I understand and acknowledge that only those aspects will be assessed for which the supporting documents in accordance with Appendix 4 of the HJT have been uploaded.
I understand and acknowledge that if I do not attach the documents required for the application, I will receive 0 points for the missing document(s) during the application assessment.
I acknowledge that if I submit an application via the Neptun Study System, submitting the application shall be considered as my unequivocal consent to the University using the documentation submitted as part of the application and the personal and application materials submitted as part of the application to a person or committee authorized to verify the implementation and decision of the application. and that the persons assessing the application are familiar with the data in the application material.
By signing the application, I declare that I have read the Data Management Information of the Hungarian University of Agricultural and Life Sciences, I understand its contents and I consider it binding on me”.
(134) In connection with this form, MATE sent a copy of the data management information available during the period under review.
(135) In relation to both forms, MATE stated that following the Authority’s observations, the part of the declarations that states “I acknowledge that if I submit an application via the Neptun Study System, the submission of the application shall be considered as my unequivocal consent to the University forwarding the personal and application-related documentation submitted as part of the application to the person or committee authorized to verify the implementation and decision of the application, and to the persons assessing the application to become familiar with the data in the application material”.
39
I V . APPLICABLE L A G E R U S I O N (136) The processing of data falling within the scope of the General Data Protection Regulation is subject to the provisions of the Infotv. According to Section 2(2), the General Data Protection Regulation shall apply with the additions specified in the provisions specified therein.
(137) Pursuant to Section 60(3) of the Infotv., the Authority shall initiate a data protection authority procedure ex officio if, based on its investigation, it establishes that a legal infringement has occurred or there is an imminent threat of such an infringement in connection with the processing of personal data and a fine may be imposed in accordance with the provisions of the General Data Protection Regulation.
(138) Pursuant to Section 7 of Act CL of 2016 on General Administrative Procedure (hereinafter: Ákr.), the provisions of the Ákr. shall apply to the data protection authority procedure. According to Section 103(1) of the Ákr., in the official procedure initiated ex officio, the Ákr. provisions relating to procedures initiated upon request shall be applied to the Ákr. shall apply with the derogations set out in Articles 103 and 104.
(139) According to Article 4(1) of the General Data Protection Regulation: “personal data” means any information relating to an identified or identifiable natural person (“data subject”);
an identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, a number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
(140) According to Article 4(2) of the GDPR: “processing” means any operation or set of operations which is performed upon personal data or upon sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.” (141) According to Article 4(7) of the GDPR: “controller” means the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union or Member State law, the controller or the specific aspects relating to the designation of the controller may also be determined by Union or Member State law.”
(142) Pursuant to Article 5(1)(a), (b) and (c) of the General Data Protection Regulation:
Personal data:
a) shall be processed lawfully and fairly and in a manner transparent to the data subject (‘lawfulness, fairness and transparency’);
b) personal data shall be collected:
only for specified, explicit and legitimate purposes and shall not be processed in a manner incompatible with those purposes;
Article 89
In accordance with Article 1(1), further processing for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes shall not be deemed to be incompatible with the original purpose ('purpose limitation').

(c) they shall be adequate and relevant in relation to the purposes for which the processing is carried out and shall be limited to what is necessary ('data economy').

(143) According to Article 6(1) of the GDPR: “The processing of personal data shall be lawful only if and to the extent that at least one of the following is met:
40
a) the data subject has given his consent to the processing of his personal data for one or more specific purposes;
b) the processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
c) the processing is necessary for compliance with a legal obligation to which the controller is subject;
d) the processing is necessary to protect the vital interests of the data subject or of another natural person;
e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
f) the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the exercise of their tasks. (144) Article 9(1) of the GDPR states: “The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health and personal data concerning a natural person’s sex life or sexual orientation shall be prohibited.” (145) Article 9(2)(b) and (c) of the GDPR states: “Paragraph 1 shall not apply where:
[…]
b) processing is necessary for the performance of obligations or the exercise of specific rights of the controller or of the data subject arising from legal provisions governing employment, social security and social protection, where Union or Member State law provides for appropriate safeguards for the protection of the data subject’s fundamental rights and interests, or where collective agreements under Member State law so permit;
[…]
g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law, which is proportionate to the aim pursued, respects the essence of the right to the protection of personal data and provides for suitable and specific measures to safeguard the fundamental rights and interests of the data subject;
[…]”
(146) Article 13 of the GDPR states: “(1) Where personal data relating to the data subject are processed by the collected from the data subject, the controller shall provide the data subject with all of the following information at the time of obtaining the personal data:
a) the identity and contact details of the controller and, where applicable, of the controller's representative;
b) the contact details of the data protection officer, where applicable;
c) the purposes of the intended processing of the personal data and the legal basis for the processing;
d) in the case of processing based on point (f) of Article 6(1), the legitimate interests of the controller or a third party;
e) where applicable, the recipients or categories of recipients of the personal data, where applicable;
f) where applicable, the fact that the controller intends to transfer the personal data to a third country or to an international
organisation and the existence or absence of an adequacy decision by the Commission or, in the case of transfers referred to in Articles 46, 47 or the second subparagraph of Article 49(1) an indication of the appropriate and suitable safeguards and the means by which a copy of the personal data can be obtained or a reference to their availability.
(2) In addition to the information referred to in paragraph 1, the controller shall, at the time of obtaining the personal data, provide the data subject with the following additional information in order to ensure fair and transparent processing:
a) the period for which the personal data will be stored or, where that is not possible, the criteria for determining that period;
b) the right of the data subject to obtain from the controller access to, rectification, erasure or restriction of processing of personal data concerning him or her and to object to the processing of such personal data, as well as the right of the data subject to data portability;
c) in the case of processing based on point (a) of Article 6(1) or point (a) of Article 9(2) of the GDPR, the right to withdraw consent at any time, without prejudice to any rights granted before the withdrawal. the lawfulness of the processing based on consent;
d) the right to lodge a complaint with a supervisory authority;
e) whether the provision of personal data is based on a legal or contractual obligation or is a prerequisite for entering into a contract, and whether the data subject is obliged to provide the personal data, and the possible consequences of not providing the data;
f) the fact of automated decision-making referred to in Article 22(1) and (4), including profiling, and at least in such cases, intelligible information on the logic involved and the significance and foreseeable consequences of such processing for the data subject.
(3) Where the controller intends to process personal data for purposes other than those for which they were collected, the data subject shall be informed of such purposes and of all relevant information referred to in paragraph (2) prior to the further processing. additional information.
(4) Paragraphs (1), (2) and (3) shall not apply if and to the extent that the data subject already has the information.”
(147) Pursuant to Article 58(2) of the General Data Protection Regulation, the supervisory authority shall, in exercising its corrective powers, for example:
(b) order the controller or processor where its processing activities infringe the provisions of this Regulation;
(c) order the controller or processor to comply with the data subject’s request to exercise his or her rights under this Regulation;
(d) order the controller or processor to bring its processing operations into compliance with the provisions of this Regulation, in a manner and within a specified period, as the case may be.
(148) The Infotv. According to Section 61(4)(b), the amount of the fine may range from one hundred thousand to twenty million forints if the budgetary body obliged to pay the fine imposed in a decision taken in a data protection authority procedure is a budgetary body, in the case of a fine imposed pursuant to Article 83 of the General Data Protection Regulation.
(149) According to Section 71(2) of the Infotv.: “The Authority may use documents, data or other means of evidence lawfully obtained during its procedures in other procedures.”
(150) According to Section 8(7) of the Nftv.: “In order to ensure the housing conditions of students, a dormitory may be operated as part of a higher education institution, or a student dormitory may be established as an institution not organizationally belonging to the higher education institution. A student dormitory is a legal person, operating as a budgetary body or a non-budgetary body, depending on the founder.”
42
(151) According to Section 41(1) of the Nftv.: “The Government shall ensure equal opportunities for a) disadvantaged group of applicants and students, b) those on unpaid leave to care for their child, those receiving infant care allowance, adoption allowance, childcare allowance, child-rearing allowance, child-care allowance for home care of children, care allowance for home care of their child or childcare allowance, c) those belonging to the group of applicants and students with disabilities, d) those belonging to the group of applicants and students belonging to a nationality when determining the number of students supported by Hungarian state (partial) scholarships in higher education studies, and in the group specified in point d). (152) According to Section 2 (1) b) of the Government Decree, an orphan is a student under the age of 25,
whose both parents, or the unmarried, divorced or separated parent who lived in the same household, have died and have not been adopted.
(153) According to Section 2 (1) e) of the Government Decree, a family breadwinner: a student,
ea) who has at least one child,
eb) who is entitled to a care allowance pursuant to Act III of 1993 on Social Administration and Social Benefits.
(154) According to Section 4 (4) of the Government Decree: “A student who is disadvantaged, an orphan, a breadwinner, or whose guardianship has ended due to his or her age of majority may be exempted from the obligation to pay the dormitory fee due to his or her social situation. The institution may provide a discount or exemption from the dormitory fee for students performing dormitory work, as specified in its compensation and benefits regulations.”
(155) According to Section 12 of the Government Decree: “Section 12 (1) Dormitory accommodation can be obtained through an application. Applications must be decided on the basis of the points system specified in the compensation and benefits regulations. (2) The points system must be made available for review before submitting applications. (3) The points system must take into account the student’s social situation, academic performance, work done for the student community, the work schedule of his/her training, exemptions pursuant to Section 4 (4), and if the student is subject to the provisions of Section 41 of the National Funding Act.
Based on paragraph (1) of §, priority shall be given when assessing dormitory applications,
then the condition for priority specified in the Nftv. shall also be met.
(4) Dormitories and student dormitories operating as specialist dormitories may also apply a point system different from paragraph (3).
(5) Housing conditions shall be supported within the framework of social support.”
(156) According to Section 21 (1) of the Government Decree: “(1) When assessing the social situation of a student, the following shall be taken into account: a) the number and income of those living together in the property at the student’s address, registered there or having a place of residence, b) the distance between the place of training and the place of residence, the duration and cost of the trip, c) if the student does not live in a common household as defined in the Tbj. during his studies, the costs thereof, d) the amount of money that a disabled student must spend on the purchase and maintenance of special equipment, special travel needs, and the use of a personal assistant or a sign language interpreter, e) the health expenses regularly incurred due to the health condition of the student or a close relative living in the same household, f) the number of dependents living in the same household with the student, with particular regard to children who are dependent on the student for him,
g) the costs associated with the care of a relative in need of care.”
(157) Act XXXI of 1997 on the Protection of Children and the Administration of Guardianship According to Section 67/A (1)-(2) of the Act (hereinafter: Gyvt.): “(1) A child entitled to regular child protection benefit and a child who has reached the age of majority is in a disadvantaged position if one of the following circumstances exists: a) the low level of education of the parent or the foster parent, if it can be established from both parents raising the child together, the parent raising the child alone or the foster parent – based on their voluntary declaration – that they have at most a primary education when applying for regular child protection benefit, b) the low level of employment of the parent or the foster parent, if it can be established from any of the parents raising the child or the foster parent that they are entitled to the care of active-age people according to Section 33 of the Act when applying for regular child protection benefit or that they are not entitled to the care of active-age people according to Section 33 of the Act at the time of applying for regular child protection benefit a person who has been registered as a jobseeker for at least 12 months within the preceding 16 months,
c) the child's inadequate living environment or housing conditions, if it can be established that the
child lives in a living environment declared as segregated in the integrated settlement development strategy for the settlement, or in semi-comfortable, uncomfortable or emergency housing,
or in housing conditions where the conditions necessary for his or her healthy
development are limited.
(2) A person with multiple disadvantages
a) is a child entitled to regular child protection benefits and a child who has reached the age of majority, in whose case at least two of the circumstances specified in points a) to c) of paragraph (1) exist,
b) a child taken into foster care,
c) a young
adult receiving aftercare and having a student or pupil status.”
The Infotv. Pursuant to Section 61(2)(b), the Authority may order the publication of its decision – by publishing the identification data of the controller or the processor – if it was made in connection with the activities of a body performing public tasks.
V . Decision
V . 1 . The controller
(158) According to the definitions of the General Data Protection Regulation, a controller is a natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
(159) In relation to the determination of the data controller, the Authority has established the following:
(160) Based on the quotations from the HJT, the Dormitory Regulations, the data management information on dormitory admissions and the social situation assessment in paragraphs (87)-(135) of this resolution,
the MATE determines the scoring system for dormitory applications - including the social situation assessment - and the procedural and organizational order for their assessment.
The MATE also decides on the use of the 44 templates and certificates related to the operation and procedures of dormitories.
(161) The above documents and regulations, including the data management information on dormitory admissions and the data management information on the social situation assessment, designate MATE as the data controller.
(162) Based on all of this, it can be stated that MATE makes a decision on the data management related to the dormitory admission procedure - including the social situation assessment -, on what personal data can be processed to gain admission to the given dormitory, taking into account the provisions of the Nftv. and the Government Decree, and what forms and certificates confirming and containing personal data can be accepted during the procedure, taking into account that, pursuant to Section 8 (7) of the Nftv., MATE, as a higher education institution, is entitled to operate a dormitory, while pursuant to Section 12 (1) of the Government Decree, applications must be decided on the basis of the scoring system specified in the compensation and benefits regulations. (163) Consequently, the Authority concludes that MATE qualifies as a data controller within the meaning of Article 4(7) of the General Data Protection Regulation for the processing of data related to the dormitory admission procedure and the related social situation assessment.
V . 2 . P r o m e s t o f d a t e r s t o f d a t i o n (164) Before commencing its data processing activities, the data controller must take into account what it intends to achieve, whether the processing of personal data is necessary to achieve its purpose, and if so, how the processing of the data serves the achievement of the purpose. The data controller must focus on defining a range of data that is aligned with and compatible with the purpose. The purpose must be described clearly, obviously, and in understandable language so that data subjects are aware of all the essential circumstances of the data processing, the specific purposes, and the range of data aligned with them.
(165) It can be stated that MATE, as the data controller, decided on the data processing related to the dormitory admission procedure, as well as the closely related social situation assessment that forms part of it, if applicable. The National Housing and Student Services Act and the Government Decree legitimize the purpose of the data processing, the dormitory admission procedure, since the Government Decree states that dormitory accommodation can be obtained through a competition. Applications must be decided on the basis of the scoring system specified in the reimbursement and benefit regulations. Section 12 (2) of the Government Decree stipulates that the social situation of the student must be taken into account as a criterion in the scoring system. The purpose and objectives of the data processing are therefore lawful, and the data processing related to the dormitory admission procedure, which also includes the social situation assessment, complies with the principle of purpose-bound data processing regulated by Article 5 (1) (b) of the General Data Protection Regulation. (166) Since the two data processing, the dormitory admission procedure and the social situation assessment, are closely related, the social situation assessment is part of the dormitory admission procedure, one of its criteria, and although it is not mandatory, without it the student receives zero points in the dormitory admission procedure, the Authority examined both procedures in the present procedure.
V . 3 . L a g e s t o f d a t e r m i n g (167) A further requirement for the lawfulness of data processing is that data processing can be carried out with reference to a legal basis pursuant to Article 6(1) of the General Data Protection Regulation.
45
(168) MATE processes data related to the dormitory admission procedure on the basis of Article 6(1)(e) of the GDPR, taking into account the provisions of the Nftv., the Government Decree, the Onytv., the Szaztv. and the Pp., of which the Nftv. and the Government Decree are the most relevant in the present case. MATE also submitted that the legal basis for the processing of data associated with the conclusion of the dormitory contract at the end of the dormitory admission procedure, after the student has been admitted, is Article 6(1)(b) of the GDPR.
(169) In connection with the procedure for assessing the social situation, MATE processes the personal data of applicants and their relatives, as well as other third parties, on the basis of Article 6(1)(e) of the GDPR. The processing of special categories of personal data is based on Article 9(2)(b) of the General Data Protection Regulation. (170) Regarding the processing necessary for the performance of a task in the public interest and the exercise of official authority as a legal basis for data processing, it can be said that according to the domestic legal environment and the practice of the Constitutional Court, the fundamental rights of the data subject – including the right to informational self-determination – may be restricted by the state only to the extent necessary and proportionate, in order to enforce a fundamental right or protect a constitutional value, i.e. in the public interest. Therefore, the application of this legal basis is conditional on the controller’s data processing activities necessary for the exercise of its public authority tasks and powers or for the performance of other tasks carried out in the public interest being based on a legal provision or an EU norm for a purpose based on the public interest. However, in many cases, this legal provision only defines the public task, procedural scope and obligation of the data controller, but not the detailed rules of the related data processing operations. (171) The legal basis for data processing based on legal provisions defining the public tasks of a data controller exercising public authority or performing public tasks is therefore Article 6(1)(e) of the General Data Protection Regulation. It is also important to highlight that a body performing public authority or other public tasks – as a budgetary body – can be the subject of all public and private law relationships and data processing relationships related to it exclusively in connection with the performance of its public tasks, its quality other than this is conceptually excluded, and the additional legal bases otherwise applicable under the General Data Protection Regulation are, as it were, merged into this legal basis. Consequently, the contractual legal basis under Article 6(1)(b) of the GDPR relied on by MATE is also merged into the legal basis under Article 6(1)(e) of the GDPR.
(172) If the legislator has not laid down detailed rules for these data processing activities, disregarding the provisions of Section 5(3) of the Infotv., the data controller is obliged to carry out its data processing activities in accordance with the general data protection rules - in particular the criteria of the basic principles and the necessity of the legal basis - and to prove its lawfulness in accordance with the principle of accountability.
(173) Based on all this, the Authority's position regarding the legal basis for data processing is the following:
(174) During the dormitory admission and social situation assessment procedure, MATE processes the personal and special data of the student and those living in the same household based on the provisions of the Nftv. and the Government Decree (as well as the Onytv., the Szaztv., and the Pp.).
(175) MATE must define the personal data to be processed – and the range of certificates and documents required to be submitted – in such a way that it can judge whether the circumstances exist on the basis of which the student – taking into account his/her social situation – is entitled to dormitory accommodation, but it must not extend beyond the necessary aspects and data scope prescribed by the Nftv. and Government Decree and thus comply with Article 5 (1) (c) and Article 6 (1) (e) of the General Data Protection Regulation. (176) According to its organizational and operational regulations10 available on its website, MATE is a state-recognized, public-service, private higher education institution operating as a public benefit organization maintained by the Hungarian Agricultural and Life Sciences University Foundation, and the sectoral rules applicable to this institution are fundamentally laid down in the Nftv. and Government Decree. It is clear from these regulations that MATE is obliged to use a certain part of the support provided to it to pay social scholarships to students. These regulations also determine which aspects MATE – and all higher education institutions – must take into account when assessing eligibility, which limits the scope of data to be processed. These regulations bind MATE, i.e. MATE cannot decide to take into account other aspects in addition to those specified by the regulations during the procedure, as this would generate additional data processing. (177) Since the provision of dormitory accommodation is a task of MATE, the framework of which – namely the circumstances under which a student is entitled to it – is set by law, MATE cannot decide to go beyond these regulations and prescribe additional aspects and related data in its internal regulations, thereby requiring further data processing. “Mandatory data processing” is manifested in the fact that the data controller has a task defined by law, which necessarily entails data processing, or there is a data scope defined by the legislator (in this case, a strictly defined set of criteria), and MATE must act within the framework of these regulations.
(178) Based on the above, the legal basis for the processing of all personal data included in submitted applications can only be Article 6(1)(e) of the General Data Protection Regulation.
If MATE takes into account a new set of criteria during the dormitory admission and social situation assessment that is not defined by the Nftv. and the Government Decree, and requests data for this, or requests data not defined by the legislation for the criteria defined by law, then its data processing is without legal basis, i.e. infringes Article 6 of the General Data Protection Regulation.
(179) Since MATE claimed that the data processing is based on the Nftv. and the Government Decree (as well as the Onytv., the Szaztv., and the Pp.), thus - although the compensation and benefit regulations themselves may determine the detailed rules for the dormitory admission procedure and the determination of social status - when determining the scope of data, documents, and certificates to be submitted, they may not expand beyond the provisions of Annex 3, Subsection I/B., Point 1, Subsection (be) of the Government Decree, as well as Section 12 (3) of the Government Decree - as well as Section 4 (4) referred to therein and Section 12 (4) of the Nftv. In the light of the aspects listed in Section 41 (1) and Section 21 (1), i.e. in the development of the point system, it may not determine any circumstances to be verified or data to be processed that are not required to be taken into account in the dormitory admission procedure and when determining the social situation in Section 12 (3) and Section 21 of the Government Decree. If MATE nevertheless determines in its internal regulations aspects that go beyond these legal provisions and additional data to be processed, then the processing of such data is not carried out on the basis of the authorization of the National Education Act and the Government Decree 10 https://uni-mate.hu/documents/d/global/mate-szmr-i-kotet-2025-04-01-pdf 47 – i.e. not on the basis of Article 6 (1) (e) of the General Data Protection Regulation, therefore the data processing has no legal basis. (180) Section 12(3) and Section 21(3) of the Government Decree therefore authorize higher education institutions – including MATE – to determine which aspects to take into account when determining the eligibility for dormitory accommodation and the social situation and which personal data to process in connection with them, while the detailed rules to be determined in the two procedures, in particular taking into account the basic principles and the legal basis, shall be laid down in institutional regulations. (181) The Authority notes that the Privacy Act Section 5(3) stipulates that in the case of data processing as defined in Article 6(1)(e) of the General Data Protection Regulation (hereinafter: mandatory data processing), the types of data to be processed, the purpose and conditions of data processing, the accessibility of the data, the person of the data controller, and the duration of data processing or the periodic review of its necessity shall be specified in the law or local government decree ordering the data processing. These data processing circumstances are not included in either the Nftv. or the Government Decree, therefore they do not comply with the requirements of the Infotv. However, the Authority did not assess the legislator's shortcomings to the detriment of MATE, and proceeded from the fact that if MATE does not expand beyond the Nftv. and the Government Decree, processes the data necessary for them,
then its data processing complies with the requirement set out in Article 6(1)(e) of the General Data Protection Regulation and the principle of data minimisation.
(182) The Authority also notes that health data are special categories of personal data according to Article 9 of the General Data Protection Regulation, the processing of which is prohibited in principle and may only be lawful in special cases according to Article 9(2) of the General Data Protection Regulation.
(183) The relevant legislation, the Nftv. and the Government Decree, MATE may take the following
aspects into account during the dormitory admission and social situation assessment procedure, and may process the data related to them:
(184) Based on Section 12 (3) of the Government Decree, the following points shall be taken into account in the point system applied during the procedure related to the use of dormitory services:
- the student's:
- social situation,
- academic performance,
- work done for the student community,
- work schedule of his/her training,
- whether there is a circumstance on the basis of which he/she may be exempted from the obligation to pay the dormitory fee due to his/her social situation,
- whether there is a circumstance on the basis of which he/she should be given preference due to the condition set out in Section 41 (1) of the Nftv.
(185) In relation to the social situation to be taken into account during the procedure for the use of dormitory accommodation pursuant to Section 12(3) of the Government Decree, Section 21(1)-(2) of the Government Decree stipulates that the following aspects shall be taken into account when assessing the student's social situation: - the number and income status of those living together in the property at the student's address, registered there or having a place of residence, - the distance between the place of training and the place of residence, the duration and cost of the journey, - if the student has not been granted a residence permit during his/her studies, lives in a common household according to the 

section, the costs thereof,

- the amount of money the disabled student must spend on the purchase and maintenance of special equipment

48, special travel needs, and the use of a personal assistant or sign language interpreter,

- the health expenses regularly incurred due to the health of the student or a close relative living in the same household,

- the number of dependents living in the same household with the student, with particular regard to the number of children living with him,

- the costs associated with the care of a relative in need of care.

(186) When calculating income, the average of the last three months shall be taken into account for income that can be measured regularly on a monthly basis, and one twelfth of the last year for other income.

(187) The cases of exemption from the obligation to pay the dormitory fee, which are also to be taken into account during the procedure related to the use of dormitory care, according to Section 12 (3) of the Government Decree, are included in Section 4 (4) of the Government Decree, which are the following:
- disadvantaged student,
- orphan student,
- family breadwinner, or
- a student whose guardianship has ended due to his/her coming of age.
(188) Furthermore, the Nftv. Cases of preferential
sharing according to Section 41 (1):
- disadvantaged applicants and student groups,
- those on unpaid leave to care for their child,
- those receiving childcare allowance, adoption allowance, childcare allowance, child-rearing allowance, child-care allowance, child-care allowance, child-care allowance, care allowance or child-care allowance for their child at home,
- applicants and students with disabilities,
- applicants and students belonging to a group of nationalities.
(189) The concept of disadvantaged situation is defined in Section 67/A. (1) of the Gyvt., while the concept of orphan
is defined in Section 2. (1) (b) of the Government Decree, and the concept of breadwinner
is defined in Section 2. (1) (e) of the Government Decree.
(190) Based on the above legal provisions, the processing of special data during the application procedure arises, on the one hand, when assessing the social situation, when Section 21(1)(d) and (e) of the Government Decree stipulates that when assessing the social situation of the student, the amount of money the disabled student has to spend on the purchase and maintenance of special equipment, special travel needs, as well as the use of a personal assistant or a sign language interpreter, as well as the health expenses regularly arising due to the health condition of the student or a close relative living in the same household. (191) On the other hand, when, in the case of the student, the preferential condition pursuant to Section 41(1)(c) of the National Health Insurance Act applies, i.e. the student has a disability. (192) MATE may not take into account any further circumstances to be examined beyond the criteria specified in the above legislation, and may not process any other personal data than the data required for them in connection with the dormitory application and the social situation assessment procedure that forms part of it.
49
(193) Based on all of this, the Authority assumed that if MATE acted in accordance with the provisions of the Nftv. and the Government Decree, and decided to take into account criteria to be examined and to process personal data related to them that comply with those specified in the legislation, then the Authority deemed the data processing to be lawful. In other cases, when MATE prescribed the criteria to be examined beyond the statutory authorisation, the data processing was assessed as violating the principle of data economy and without legal basis.
V . 4 . P r i c e of d a t i c e s i n c e s i n g (194) The Authority refers back to the fact described above in the legal basis for data processing that in the case of the dormitory admission procedure and social situation assessment as mandatory data processing, the legislator did not set out detailed rules for data processing, disregarding the provisions of Section 5(3) of the Infotv., but only defined the aspects and circumstances to be taken into account during the procedures. MATE, as a data controller, is therefore obliged to carry out its data processing activities in accordance with the general data protection rules – in particular the basic principles and the legal basis’s necessity standard – and to prove its lawfulness in accordance with the principle of accountability. (195) Based on this, data processing must also comply with the principle of data economy pursuant to Article 5(1)(c) of the General Data Protection Regulation. Personal data may be processed to the extent and for the period necessary to achieve the purpose. They must also be adequate and relevant. The so-called necessity criterion, also known as the data economy principle, means that before starting data processing, it must be examined whether personal data are necessary at all to achieve the purpose. (196) On this basis, only as much and such personal data as are necessary and sufficient to achieve the purpose of data processing may be processed. The requirement for the “relevance” of data resonates with the expectation arising from the purpose limitation principle that the scope of personal data to be processed must be designated and defined in accordance with the purpose and objectives of data processing. In this context, it should be noted that the data processing notice must precisely list the personal data to which the data processing applies. It is not sufficient for data controllers to define the scope of personal data processed using a collective term. (197) Therefore, if MATE processed personal and special personal data during the dormitory admission and social situation assessment procedures that are not necessary for establishing the criteria specified by the Nftv. and the Government Decree, or in addition, it also determined additional criteria to be examined involving the processing of personal data, the Authority also examined the enforcement of the principle of data economy. (198) The Nftv. and the Government Decree therefore determine criteria to be examined in connection with the two procedures, and in support of these, it requests the submission of documents and documents specified by it, as specified in Appendix No. 4 of the HJT. In this regard, a distinction should be made between the data principle and the document principle. The fact that certain documents contain the data that are necessary for establishing the criteria to be examined does not mean that MATE is entitled to process all personal data recorded in the given document, i.e. the entire document. Based on the data principle, unnecessary data must be removed from the given document. Establishing the authenticity of the document is a considerate interest from the MATE side, however, sensitive data concerning the student or his/her relative that is unnecessary from the perspective of the two procedures may not form part of the procedures and may not be included in the MATE electronic records.
50
V . 5 . P r o s s e c t i o n s d a t e r s (199) The Authority reviewed the documents sent by MATE, based on which it established the following in relation to the processed data and requested certificates.
(200) For the aspects specified by the Nftv. and the Government Decree, MATE processes data and requests documents in accordance with its declarations and the documents sent to the Authority, described in paragraphs (25).
(201) Special health data is taken into account for the assessment of the student's social situation on the basis of Section 21 (1) d) and e) of the Government Decree. The handling of special data is of paramount importance, therefore the Authority starts the analysis by handling these data. V.5.1. How much money should a disabled student spend on the purchase and maintenance of special equipment, special travel needs, and the use of a personal assistant or a sign language interpreter (202) In the Authority's opinion, the disability of the applicant student is an aspect that is in accordance with Section 21 (1) d) of the Government Decree and the National Funding Act. It is in accordance with Section 41 (1) c), however, Section 21 (1) d) of the Government Decree – in addition to the fact of disability – only covers the costs arising in this regard and the management of their verification. (203) According to the analysis system of the social situation assessment, the student may receive points for disability or need due to health conditions, as specified in paragraphs (106). (204) In order to verify disability and need due to health conditions, MATE requests the submission of Annexes 3 and 4. Annex 3, filled in by the GP, states the fact of living with a disability or the fact of reduced working capacity. Annex 4 in the annex, filled in by the applicant and signed by two witnesses, the applicant's health status and health costs in relation to health expenses related to the student's health status.
(205) These aspects are required to be proven by the legislation, so there is a legal basis for the processing of the data, so the Authority also examined whether the processed data scope is necessary for them. In this regard, the Authority took into account that MATE only processes the fact of disability or need due to a health condition - and the costs related to the health condition - but does not specifically determine what the given disability or need due to a health condition is, so it does not process health data in this context. According to the Authority's position, MATE thus processes data necessary for the aspects of the National Health Insurance Act and the Government Decree, so MATE is acting lawfully in relation to these aspects.
V.5.2. Regularly incurred health expenses due to the health of the student or his/her close relative living in the same household
(206) According to the Authority, the health of the student or his/her close relative living in the same household is also a consideration that is in accordance with Section 21 (1)
point e) of the Government Decree, however, Article 6
51
(1)
point e) of the General Data Protection Regulation – in addition to the fact of inadequate health – only covers the case of the handling of the health expenses arising in this regard and their verification.
(207) According to the analysis system of the social situation assessment, an additional point can be given accordingly in the case of a long-term illness or inadequate health of the applicant and his/her relative, based on what is written in paragraph (108).
(208) In order to verify all these circumstances, nos. 3 and 4 a certificate must be submitted in respect of the student, as detailed in the above point. With regard to close relatives, it is necessary to submit certificate number 5, with which MATE processes the data relating to the relative's health status and health costs, with the proviso that, as a result of an amendment in 2025, MATE only asks the relative to provide the cost, not the indication of the health status. (209) These aspects are required to be certified by the legislation, so the processing of the data has a legal basis, so the Authority also examined whether the processed data scope is necessary for them. In this connection, the Authority took into account that MATE only processes the fact of the health status - and the costs related to the health status - but not specifically the specific health status of the applicant or his/her relative, close relative, so it does not process health data in this context. According to the Authority's position, MATE is thus processing data necessary for the aspects of the Nftv. and the Government Decree, and thus MATE is acting lawfully in relation to these aspects.
(210) The Authority's position on the verification of close family relationships and common household is contained in the following paragraphs of the decision.
V.5.3. Number and income status of persons living together in the property at the student's address, registered there or having a place of residence
(211) In order to be able to establish - in accordance with Section 21 (1) a) of the Government Decree - the per capita income of the persons living in the student's household, the MATE must know how many persons live in the property and what their income was during the period under review.
(212) As stated in paragraph (110), regarding the number of people living together, registered there or having a place of residence in the property at the student's address, MATE requests an original official certificate/certificate issued by a government office, district office, local government or notary, no older than 3 months, stating the number, names and dates of birth of the applicant student and the people living in the same household, as well as a photocopy of the student's address card. If the certificate does not list the people living there by name, it is also necessary to attach a copy of their address cards. If the certificate about people living at the same address lists a person who does not actually live there, a copy of the address card is also required. (213) One side of the address card contains the person's surname and first name, place and date of birth, mother's name, place of residence, place of residence, time of registration of the place of residence, place of residence, validity period, date of issue, name of the issuing authority and document identifier. The other side of the address card contains the person's surname and first name, personal identifier and document identifier. (214) According to the Authority's position, based on the principle of data economy, it is sufficient to send a certificate issued by the local government or district office to certify the persons living in the same household. The certificate issued by the local government or district office is subject to the provisions of Act CXXX of 2016 on the Code of Civil Procedure. According to Section 323 of the Act, a public document which proves with full evidentiary force that the issuer has taken the measure or made a decision with the content contained therein, the reality of the data and facts certified by the public document, the making of the declaration contained in the public document, its time and manner, and shall be deemed genuine until proven otherwise. According to the Authority, this certificate can be used to adequately prove who lives in the given property. (215) In addition to this certificate, it is not necessary to record a copy of the address card, and neither the National Education Act nor the Government Decree requires the processing of the student's personal identifier and the identifier of his document, nor the data relating to the issuance of his document. The Authority would accept a request for a copy of the address card if the applicant does not have a certificate issued by the local government or district office. However, in this case, the copy of the address card must be made with unnecessary personal data redacted. That is, the copy may contain the natural identification data of the data subject – surname and first name, place and date of birth, mother’s name – and the data on the place of residence, given that these data can be used to identify the data subject and establish his or her place of residence. The processing of data other than these – document identifier, personal identifier, data relating to the issuance of the document – for this purpose violates the principle of data saving as set out in Article 5(1)(c) of the General Data Protection Regulation and, without legal basis, violates Article 6(1)(c) of the General Data Protection Regulation. (216) In this context, another aspect to be examined is the income situation of those who live together in the property at the student's address, are registered there or have a place of residence. (217) An official and original certificate signed by the employer, or a NAV income certificate, must be attached for all income of those living in the same household, as described in paragraphs (111)-(112). (218) In this context, MATE processes employment data as described in paragraph (113). (219) In connection with the income situation, in accordance with Section 21 (1) a) of the Government Decree, the analysis system of the social situation assessment includes that, as stated in the Government Decree, the average income of the last three months per person of those living in the same household with the applicant must be taken into account for the income that can be measured regularly on a monthly basis, and for other income, the twelfth of the last one year. (220) For this purpose, the Authority considers it appropriate for MATE to request income certificates issued by the employers of those persons living in the property, in terms of the average of the last three months, while in the case of persons with other income – for example entrepreneurs (partners, members with a shareholding in a business association), primary producers, old-age pensioners, disability pensioners, registered unemployed, unregistered unemployed – income certificates issued by the National Tax and Customs Administration (NAV) in terms of the last twelfth of a year. Based on these certificates and data, it can be established how much income a given person has earned in a given period and what his or her income situation is. (221) The Authority also considers it appropriate to request certificates issued by the pension provider for those receiving pension benefits and to process the personal data recorded therein, with the proviso that in the case of disability pensions, the certificate may contain the fact of health impairment, altered working capacity, reduced working capacity, but not other data relating to health status.
53
(222) For these reasons, the Authority does not establish a violation of the law in relation to income certificates.
V.5.4. Distance between the training place and the applicant's place of residence, duration and cost of travel
(223) In this context, it is necessary to process the student's place of residence, as well as the distance between his place of residence and MATE
as a training place and the duration of the trip.
(224) Based on the MATE social situation assessment analysis system, in this round, the student – in accordance with Section 21 (1) b) of the Government Decree – receives points on the one hand for how far his/her place of residence is from the training place. In this case, the points are determined by the distance between the place of residence and the training place, the duration and cost of the trip. (225) In this round, it is necessary to process the student’s address data, which, as already mentioned above, can be verified with a certificate issued by the local government or the regionally competent district office or the regionally competent government office or with the student’s address card, and in addition, whether he/she is staying in an “apartment” or other accommodation. A copy of the given pass or ticket is also required. (226) According to paragraph (115), until 2025, living in a “sublet” had to be proven by attaching the part of the “sublet” contract containing the rent. Following the amendment in 2025, the “sublet” contract must be attached in such a way that the personal and additional data of the landlord, except for the name of the landlord, and in the case of a joint lease, the personal and additional data of the co-tenant(s), except for the name, and the additional costs, except for the rent and the overhead costs, are redacted. (227) The Authority’s position was that it was also appropriate to attach only the part of the “sublet” contract containing the rent, but the amendment introduced in 2025 is a more precise change. However, since the procedure before 2025 was also appropriate, the
Authority does not establish a violation.
V.5.5. If the student does not live in a joint household as defined in the Tbj. during his studies,
the costs of this
(228) Similarly to the above case, the student's place of residence is also relevant in this context, provided that he does not live in a joint household as defined in the Tbj. at his place of residence.
(229) Given that the current Tbj. does not define the concept of a joint household,
however, Act LXXXIII of 1997 on compulsory health insurance benefits,
its
5/B. § i) does, the Authority took this concept into account. Based on this, a joint household:
a community of natural persons living together in a residential property as a way of life. According to the Authority, this category includes students who do not live with their parents or close relatives, but, for example, in a “rented apartment” or other accommodation as described in the previous paragraph. In this case, the data and certificates described in paragraph V.5.4 may be required. V.5.6. Number of dependents living in the same household as the student, with particular regard to the number of children living with the student (230) For this aspect, MATE primarily needs to know who lives in the same household as the student and whether the student is a dependent or dependent. The following are the cases, as described in paragraphs (116)-(124): (231) If the student is self-supporting, points may be awarded under paragraph (119). In the case of a single-parent applicant, a private declaration by the parents must be attached stating that the applicant does not receive any benefits from them if he/she lives in the same household as the parents. It is also necessary to attach an income certificate from the NAV on the part of the single-parent applicant. (232) The student may also receive points if his/her parent or supporter is divorced, widowed, or single for some other reason. In the case of divorced parents, a copy of the part of the court decision on divorce and child support is required, or if a separate decision was made on child support, a copy of the document providing for it. In the case of separated parents, MATE requests a fully probative private declaration on the fact of separation and the amount of child support paid/not paid. In the case of a widower, an official certificate from the Pension Payment Institute is required regarding the amount of the benefit to be paid for the given year, or, if you do not receive a widower's pension, a decision to terminate the payment must be attached.
(233) If a student has a sibling who is a full-time/part-time student in public education or higher education, or who is not yet participating in public education, he or she may also receive points.
If the student's sibling receives nursery care, a certificate from the nursery is required. In the case of a sibling participating in public education, if the sibling still lives in the same household as the applicant, a certificate of kindergarten/school attendance is required. If the sibling is participating in higher education, a certificate of student status for the current semester must be attached. If the related student cannot attach a certificate of status for the given semester, a declaration must be attached to the certificate of status for the previous semester stating that he or she wishes to continue his or her studies. In the case of related students who have not yet enrolled in the higher education institution, the admission decision must be attached to the declaration.
(234) If a close relative with a disability or a long-term illness lives in the same household as the student, points may also be awarded.
(235) The student is entitled to points even if an unemployed adult who does not receive benefits lives with the student, or if an adult receiving unemployment benefits lives with the student, and even if the student is a retired parent or breadwinner.
(236) In this regard, the Authority first refers to the Government Decree, according to which the number of dependents living in the same household with the student, with particular regard to children who are dependent on him, must be taken into account, but not if, for example, the student's parents have dissolved their marriage. In this context, the breadwinner-dependent relationship must be proven with regard to those living in the household.
(237) In this context, the Authority is of the opinion that judgments on divorce also contain personal data, the processing of which is not necessary to prove the existing or terminated family relationship affecting the student, so it is appropriate for MATE to request a copy of the part of the court decision on divorce that provides for divorce and child support.
The Authority considers the verification of the other circumstances to be appropriate.
55
V.5.7. Costs associated with the care of a relative in need of care
(238) In this regard, the Authority refers back to the statements made in points V.4.4-V.4.6. regarding the verification of the family relationship and the state of health.
(239) The student's dependent relative must be taken into account in such a way that the certificate can establish the relationship, the fact of the condition requiring care and the associated costs, without specifying specific, detailed health data or diseases.
V.5.8. Cases of exemption from the obligation to pay the dormitory fee
(240) The Government Decree stipulates that the points system must also take into account whether there are circumstances on the basis of which the student is exempted from the obligation to pay the dormitory fee. These cases are as follows:
V.5.8.1. Disadvantaged situation
(241) Disadvantaged situation is an aspect that MATE considers in accordance with Section 4 (4) of the Government Decree
and the National Funding Act. 41. Section (1) a) is obliged to take into account, thus the data processed in order to establish this aspect are considered data processed in accordance with Article 6. (1) e) of the General Data Protection Regulation.
(242) As stated in paragraph (118), MATE gives points in the event that the student is in a disadvantaged or cumulatively disadvantaged situation. In these cases, the student must attach the decision of the competent notary/guardianship office on establishing the situation, which can be used to prove that the student is in a disadvantaged or cumulatively disadvantaged situation, taking into account the concepts in Gyvt. 67/A. Section (1)-(2).
(243) The Authority's position regarding the attachment of the decision of the notary or guardianship office is that it contains a significantly wider range of data than the verification of the disadvantaged or cumulatively disadvantaged situation. The justification for the decision may also include circumstances affecting the private sphere of the student and his/her family, the handling of which is unnecessary and without legal basis by MATE. According to Section 67/A. (1)-(2) of the Gyvtv., the decision or its justification may include data on the parents’ – where applicable – low educational attainment, low employment, long-term job-seeking status, as well as data on the student’s inadequate living environment or housing conditions that do not ensure his/her healthy development, or that the student is in foster care or receiving aftercare. The processing of full decisions containing a detailed examination of these circumstances and the personal data recorded in them is without legal basis and is unnecessary in order to determine whether the student is disadvantaged or cumulatively disadvantaged and may be entitled to dormitory accommodation. (244) For this reason, the processing of full notary and guardianship authority decisions establishing a disadvantageous or cumulatively disadvantageous situation by MATE violates the principle of data saving pursuant to Article 5(1)(c) of the General Data Protection Regulation and, since the processing of the data is also without legal basis, it also violates Article 6(1)(c) of the General Data Protection Regulation.
56
V.5.8.2. Orphanhood
(245) Orphanhood is an aspect that must be taken into account pursuant to Section 4(4) of the MATE Government Decree, thus the data processed in order to establish this aspect are classified as data processed pursuant to Article 6(1)(e) of the General Data Protection Regulation.
(246) As stated in paragraph (117), orphaned and semi-orphaned students are also entitled to points. In the case of an orphan or half-orphan applicant, an official certificate from the Pension Disbursement Directorate on the amount of orphan benefit to be paid for the given year or, if the applicant no longer receives orphan benefit, a copy of the death certificate must be attached.
(247) Orphanhood entails a certain financial implication, in view of which the MATE requests the submission of a certificate issued by the pension disburser, i.e. a document indicating the type of payment containing the fact of orphan benefit, which the Authority considers appropriate.
(248) The MATE requires the submission of certificates to prove the fact of orphanhood in such a way that if the student no longer receives orphan benefit, the death certificate must be attached, which procedure the Authority considers appropriate.
(249) An amendment was made in 2025, as a result of which it is necessary to attach a decision on the termination of the payment of orphan's allowance, the death certificate was deleted, which the Authority also considers appropriate.
V.5.8.3. Family breadwinner
(250) The quality of family breadwinner is also an aspect that MATE is obliged to take into account pursuant to Section 4 (4) of the Government Decree, thus the data processed in order to establish this aspect are considered to be data processed pursuant to Article 6 (1) (e) of the General Data Protection Regulation.
(251) Section 2 (e) of the Government Decree defines the concept of family breadwinner, and Section 2 (f) defines the concept of extended family.
(252) Based on these:
(253) Family breadwinner: a student who
- has at least one child,
- is entitled to a care allowance under Act III of 1993 on Social Administration and Social Benefits
;
(254) Large family: a student who
- has at least two dependent siblings or three children, or
- has at least two persons living in the same household in addition to their breadwinners (supporters), whose monthly income does not reach the minimum wage, or
- is the guardian of at least two minor children;
(255) According to the social situation assessment analysis system, a student is awarded points if
he has a child of his own as described in paragraph (116).
(256) The fact that the applicant student has his/her own child is an aspect that MATE is obliged to take into account pursuant to Section 4(4) of the Government Decree, given that MATE is obliged to take into account, considering that MATE is a family breadwinner pursuant to Section 2(1)(ea) of the Government Decree who has at least one child. Therefore, it is necessary to know that the applicant has his/her own child. The data processed in order to establish this aspect are considered data processed pursuant to Article 6(1)(e) of the General Data Protection Regulation. MATE requests that a copy of the child(ren)’s birth certificate or school attendance certificate, or a copy of the maternity book, be attached to the child(ren)’s certificate. (258) The birth certificate shall contain the child's family name and first name at birth, gender, place and date of birth, place of origin, family name and first name at birth of the father and mother, the fact, place and date of death of the registered person, the child's and parents' certified non-Hungarian citizenship, statelessness or unknown citizenship, the cessation of Hungarian citizenship, in the case of a declaration pursuant to the Act on the Protection of Children and Guardianship Administration, the fact thereof and the data of the biological parent or parents specified in Section 69/B. (1) b) sub-point ba) or – if the fact of adoption was registered in the paper-based birth certificate – the fact of adoption, as well as the information of the adoptive parent or parents specified in Section 69/B. § (1) paragraph b) sub-points ba) and bi)
, the Hungarian citizenship of the adopted child, if the child was adopted by parents who are not Hungarian citizens, the fact of the Hungarian citizenship of the child born in Hungary to stateless parents.
(259) According to the Authority's position, in order to prove that the student has a child,
it is sufficient to know the name and date of birth of the child, the names of the parents, since if the MATE compares this
data with the certificate of persons living in the same household, it can ascertain the number of dependents.
(260) However, as mentioned above, the full birth certificate contains a significantly wider range of data than these. Submitting a full copy of the birth certificate therefore conflicts with the principle of data economy, since it is not necessary to know all the personal data included in this document in order to establish whether the student has a child of his or her own. Furthermore, MATE has no legal basis for processing personal data beyond this. MATE's data processing therefore violates the principle of data economy and is in breach of Article 5(1)(c) of the GDPR, and is without legal basis and in breach of Article 6(1) of the GDPR.
(261) In the case of the MATE practice modified in 2025 and in the case of birth certificate(s), all additional data other than the data necessary for identification must be redacted, which modification
the Authority considers to be an appropriate measure.
V.5.8.4. Whose guardianship has ended due to the age of majority
(262) Whose guardianship has ended due to the age of majority is also an aspect that
MATE is obliged to take into account pursuant to Section 4(4) of the Government Decree, thus the data processed in order to establish this aspect are considered to be data processed pursuant to Article 6(1)(e) of the General Data Protection Regulation.
(263) The documents sent by MATE do not contain information on the confirmation of this fact, however, the Authority considers it appropriate to request, for example, a certificate issued by the guardianship authority.
58
V.5.8.5. Other circumstances
(264) Section 41(1) of the Nftv. defines the cases of preferential treatment:
- disadvantaged applicants and students,
- those on unpaid leave to care for their child,
- those receiving childcare allowance, adoption allowance, childcare allowance, child-rearing allowance, home care allowance for children,
- those receiving childcare allowance or childcare allowance for their child,
- those belonging to the group of applicants and students with disabilities,
- those belonging to the group of applicants and students belonging to a nationality.
(265) The Authority has analysed these cases above, in connection with other aspects, and therefore refers back to the statements written in
above and does not repeat them.
(266) Furthermore, MATE does not treat nationality as a preferential treatment according to the documents and statements sent to the Authority.
V . 6 . P r o v i c a t i o n o f d a t i o n (267) Article 5(1)(a) of the General Data Protection Regulation requires that personal data shall be processed lawfully and fairly and in a transparent manner for the data subject. Recital 39 of the General Data Protection Regulation specifies that natural persons shall have access to information on how their personal data are collected, used, accessed or otherwise processed. The principle of transparency is implemented through prior information to the data subject. The principle of transparency requires that information and communication relating to the processing of personal data be easily accessible and understandable and that it be expressed in clear and plain language. This principle applies in particular to the information to be provided to data subjects of the identity of the controller and the purposes of the processing, as well as to further information aimed at ensuring fair and transparent processing of the data subject's personal data and to the information that data subjects have the right to obtain confirmation and information about the data processed concerning them. The natural person must be informed of the risks, rules, safeguards and rights relating to the processing of personal data and of how to exercise the rights conferred on him or her in relation to the processing. (268) According to recital 60 of the General Data Protection Regulation, the data subject must be provided with all information necessary to ensure fair and transparent processing. (269) One of the requirements of lawful data processing is therefore that the controller, while ensuring the principle of transparency, provides prior information to the data subjects on the way and circumstances of the processing of their personal data. This right is intended, on the one hand, to make the data subjects aware that the controller intends to process personal data relating to them. On the other hand, the information enables the data subjects to assess the impact of the planned processing on their privacy and the other risks and dangers it entails. Finally, the information received enables the data subjects to exercise their right to informational self-determination.
(270) The requirement for prior information to the data subject is detailed in Article 13 of the General Data Protection Regulation. Accordingly, the data subjects must be provided with detailed information containing the information referred to in Article 13(1) to (2) of the General Data Protection Regulation.
59
(271) In the present case, regarding the information provided to applicants on data processing related to the dormitory admission process, MATE stated that it did not have a separate data processing information for the dormitory admission process between 2022 and 2024.
According to its statement, the relevant university internal regulations and the internet platforms provide some information on data processing (for example, on the scope of personal data processed, the purpose of data processing, the identity of the data controller, the contact information of the data protection officer). Furthermore, MATE already processes the data relating to academic achievement, institutional, professional scientific and public life activities processed within the framework of the application, only the purpose of data processing changes, so in its opinion, the data subjects already had information on the processing of these data. However, MATE examined this issue at the request of the Authority and established the deficiency, therefore, in order to promote transparency and provide full information, it prepared a separate data management information sheet for the submission of dormitory admission applications in addition to the existing regulations, which MATE sent to the Authority and also published on the website and the Neptun internal student interface. (272) During the period under review, MATE also had a separate data management information sheet – also sent to the Authority – on the data management related to the social scholarship application, which – according to its statement – also contains information on the processing of personal data of third parties. (273) The Authority examined the extent to which the data subjects received information about the data processing conditions specified in Article 13(1)-(2) of the General Data Protection Regulation during the dormitory admission and social situation assessment procedures, the extent to which MATE complied with its obligation to provide information, and the extent to which the data processing of the subject complies with the requirement of transparency. (274) The Authority, given that MATE, as it also stated, did not have a separate data processing information on the dormitory admission procedure, examined the information on the social situation assessment. In view of this, the Authority makes the following
statements:
(275) Article 12(1) of the General Data Protection Regulation includes, among the requirements on transparent information, communication and measures for the exercise of the data subject's rights, that the controller shall take appropriate measures to provide the data subject with all the information referred to in Article 13 relating to the processing of personal data, each of which shall be provided in a concise, transparent, intelligible and easily accessible form, in clear and plain language.
(276) The “easily accessible” requirement means that the data subject does not have to search for the information, but it must be immediately clear to him where and how he can access it.11 All the information intended for the data subjects must be made available to them in one place or in a complete document, which they can easily access if they are interested in the information in its entirety.12
(277) Transparency is therefore facilitated and complies with the principle of transparency if a uniform regulation or document contains information on data processing.
11 Paragraph 11 of the Article 29 Working Party Guidelines on Transparency under Regulation (EU) 2016/679
The guidelines can be accessed at the following link: https://www.naih.hu/files/wp260rev01_hu.pd
12 Paragraph 33 of the Article 29 Working Party Guidelines on Transparency under Regulation (EU) 2016/679
60
(278) According to MATE, the fact that the relevant university internal regulations and the internet platforms provide information on the data processing related to the dormitory admissions process, or that MATE processes data in connection with it that is already processed for other purposes and that students have information about it, does not exempt MATE from the obligation to provide information. Data processing related to the dormitory admission procedure is a data processing with an independent purpose, which requires separate information. The purpose of data processing is at the heart of the data protection regulation, the definition of which is a necessary prerequisite for establishing the lawfulness of data processing and identifying the applicable data protection guarantees. Accordingly, information is required per purpose, so MATE should have had a separate data processing information on the dormitory admission procedure. (279) Given that MATE did not have such information in the period under review, it violated Article 13(1)-(2) of the General Data Protection Regulation. In connection with the new data processing information sent to the Authority on data processing related to dormitory admissions, the Authority draws attention to the fact that it is also necessary to indicate that a social situation assessment may be carried out upon the applicant's request, which MATE provides separate information about. In other words, at least information on the availability of the data processing information on the social situation assessment should be provided in the data processing information on the dormitory admissions procedure. (280) As explained in paragraphs (126)-(128) of the decision, the information on the social situation assessment contained all the circumstances of the data processing, thus complying with the requirements of Article 13(1)-(2) of the General Data Protection Regulation, and the Authority does not establish a violation in this regard.
(281) However, the declaration at the end of the dormitory admission procedure and the social situation assessment form incorrectly include the legal basis of consent as the legal basis for data processing. However, as explained above, the legal basis for data processing can only be Article 6(1)(e) of the General Data Protection Regulation. In view of this, the Authority finds that the declaration at the end of the two forms infringed the principle of transparency under Article 5(1)(a) of the General Data Protection Regulation by providing incorrect information on the legal basis.
V . 7 . C H A N G E R S T I O N D A T L e g a l i c a l c o n s t i o n s (283) The Authority has examined whether it is justified to impose a data protection fine on MATE and in this context the Authority has considered all the circumstances of the case on the basis of Article 83(2) of the GDPR. According to the Authority, due to the established infringements and the long-standing bad practice in this regard, as well as the specific and general prevention reasons, a warning is not a proportionate sanction and therefore a fine should be imposed. (284) Furthermore, due to the established infringements, the Authority ex officio orders MATE to comply with the provisions of Article 58(2)(d) of the GDPR, in accordance with Section V.6 of this Decision. modify the content of its data management information in accordance with the requirements set out in point 1 of this Decision and prove this to the Authority by sending the data management information and referring to the relevant points or by preparing and sending a new data management information. The Authority further instructs MATE to cease the data management practices described in points V.5.3. and V.5.8.1. of the Decision, which violate data economy and are carried out without legal grounds, and to delete the personal data stored in an inappropriate manner. (285) In determining the amount of the fine, the Authority first of all took into account that the infringements committed by MATE constitute infringements falling within the higher fine category pursuant to Article 83(5) of the General Data Protection Regulation. (286) When setting the amount of the fine, the Authority took into account the provisions of the European Data Protection Board’s Guideline No 4/202213 (hereinafter: the Guideline) on the calculation criteria for imposing administrative fines under the GDPR.
(287) In view of this, the amount of the fine was determined on the basis of the following criteria:
(288) MATE committed the infringements by means of a single conduct [infringement of Article 5(1)(a) and (c), Article 6(1) and Article 13(1)-(2) of the GDPR].
(289) The infringements committed by MATE – the infringement of the principles of data processing and the rights of data subjects – are classified as more serious infringements in the higher fine category pursuant to Article 83(5)(a) and (b) of the GDPR, for which the maximum fine is EUR 20 million or, in the case of an undertaking, 4% of its annual turnover, whichever is higher. According to MATE’s latest publicly available annual report for 202414, the annual net sales revenue is HUF 4,441,142 thousand. 4% of this amount is HUF 177,646 thousand, which corresponds to EUR 466 thousand, i.e. it does not reach the static maximum fine set out in Article 83(4) of the GDPR, the amount corresponding to EUR 20,000,000, so MATE can be fined a maximum of EUR 20,000,000 in the present case. (290) When determining the amount of the data protection fine, the Authority took into account as aggravating circumstances that: - the infringements occurred continuously over a longer period of time during the 2022-2024 academic year under review [Article 83(2)(a) of the GDPR];
- the violations affected a relatively high number of data subjects, in the period under review, a total of 5,838 people initiated the dormitory admission procedure, while 3,800 requested a social situation assessment. This number does not correspond to the actual number of data subjects, given that a data subject could be admitted in each semester, so
13 https://naih.hu/europai-adatvedelmi-testulet-iranymutatasai-uj-beta?download=812:04-2022-szamu-
iranymutatas-a-gdpr-szerinti-kozigazgatasi-birsagok-kiszamitasarol
14 https://uni-mate.hu/documents/d/mate/magyar-agrar-es-elettudomanyi-egyetem-2024-evi-beszamoloja-pdf
62
in such a case, their data could be recorded more than once. Even taking this circumstance into account, the number of persons affected by the data processing can be considered high [Article 83(2)(a) of the General Data Protection Regulation].
(291) When determining the amount of the data protection fine, the Authority took into account as a mitigating circumstance that
- MATE committed the infringements negligently, given that, based on the available information, the infringements resulted from an inadequate legal environment, a misinterpretation of the existing legal requirements, and not from MATE's deliberate intention to continue its data processing
[Article 83(2)(b) of the General Data Protection Regulation];
- MATE has not yet been found guilty of violating the GDPR [Article 83(2)(e) GDPR]
- MATE – after the period under review, during the Authority’s proceedings – sought to ensure legality and, according to its statement, provided a separate information sheet on data processing related to the dormitory admissions process and made amendments to the documents to be attached [Article 83(2)(f) GDPR];
- MATE qualifies as a private higher education institution operating as a public benefit organisation performing a public task [Article 83(2)(k) GDPR].
(292) In imposing the data protection fine imposed on MATE, the Authority established that the circumstances referred to in Article 83(2)(c), (d), (g), (h), (i), (j) GDPR did not exist.
(293) Taking into account the above aspects, the Authority has concluded that the infringements committed by MATE are of medium severity
(294) The Authority has determined the amount of the fine by acting within its statutory discretion.
(295) The fine imposed is proportionate to the gravity of the infringement and cannot be considered excessive.
(296) Furthermore, the decision will be published on the Authority’s website pursuant to Section 61(2)(b) of the Information and Communication Act.
(297) Based on the above, the Authority has decided as set out in the operative part.
V I I . O ther m a t i o n s
(298) The Authority’s competence is determined by Section 38(2) and (2a) of the Information and Communication Act, and its competence extends to the entire territory of the country.
(299) The present decision of the Authority is based on Sections 80-81 of the Act on the Protection of Personal Data and Section 61 (1) of the Information Act. The decision shall become final upon its publication pursuant to Section 82 (1) of the Act on the Protection of Personal Data. Pursuant to Sections 112, 116 (1) and (4) d) of the Act on the Protection of Personal Data, and Section 114 (1) of the Act on the Protection of Personal Data, the decision may be appealed against through administrative proceedings.
* * *
(300) Pursuant to Section 135 of the Act on the Protection of Personal Data, the debtor shall be obliged to pay a late payment surcharge in the amount corresponding to the statutory interest if he fails to fulfil his payment obligation within the deadline.
63
(301) Act V of 2013 on the Civil Code, Section 6:48. In the event of a financial debt, the debtor shall pay default interest equal to the central bank base rate valid on the first day of the calendar half-year affected by the delay, starting from the date of default. (302) The rules of administrative litigation are determined by Act I of 2017 on the Code of Administrative Litigation (hereinafter: the Code). (303) Pursuant to Section 12 (1) of the Code, administrative litigation against the decision of the Authority falls within the jurisdiction of the court; the Metropolitan Court has exclusive jurisdiction over the litigation pursuant to Section 13 (3) a) aa) of the Code. (304) Pursuant to Section 27 (1) b) of the Code, legal representation is mandatory in administrative litigation falling within the jurisdiction of the court. The Code According to Section 39(6), the filing of a claim does not have a suspensive effect on the entry into force of the administrative act.
(305) Pursuant to Section 29(1) of the Civil Procedure Code and, in this regard, Section 604 of Act CXXX of 2016 on the Code of Civil Procedure, and Section 19(1)(b) of Act CIII of 2023 on the Digital State and Certain Rules for the Provision of Digital Services, the client’s legal representative is obliged to maintain electronic contact.
(306) The time and place of filing a claim are determined by Section 39(1) of the Civil Procedure Code. The information on the possibility of requesting a hearing is based on Section 77(1)-(2) of the Civil Procedure Code.
(307) The amount of the administrative litigation fee is determined by Section 45/A. (1) of Act XCIII of 1990 on Fees
(hereinafter: Itv.). The party initiating the procedure is exempted from paying the fee in advance
by Section 59. (1) and Section 62. (1) h) of the Itv.
(308) If the MATE fails to adequately prove the fulfillment of the prescribed obligations, the Authority
will consider that it has not fulfilled its obligation within the deadline. According to Section 132 of the Ákr., if the
client has not fulfilled the obligation set out in the final decision of the Authority, it
may be enforced. The decision of the Authority shall become final upon notification according to Section 82. (1) of the Ákr. Pursuant to Section 133 of the Tax Code, enforcement shall be ordered by the authority that made the decision, unless otherwise provided by law or government decree. Pursuant to Section 134 of the Tax Code, enforcement shall be carried out by the state tax authority, unless otherwise provided by law, government decree or, in the case of a local government, a local government decree. Pursuant to Section 61 (7) of the Information Act, the Authority shall implement the decision in respect of the obligation to perform a specific act, to engage in specific conduct, to tolerate or to cease performing a specific act, to undertake a specific conduct, to tolerate or to cease performing a specific act.
Budapest, 30 January 2026.
Dr. habil. Attila Péterfalvi
President
c. university professor
Retrieved from "https://gdprhub.eu/index.php?title=NAIH_(Hungary)_-_NAIH-3344-1/2026&oldid=51690"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki