NAIH (Hungary) - NAIH-3443-1/2026

NAIH - NAIH-3443-1/2026
Authority:	NAIH (Hungary)
Jurisdiction:	Hungary
Relevant Law:	Article 5(1)(c) GDPR Article 5(1)(a) GDPR Article 6(1) GDPR Article 6(1)(a) GDPR Article 6(1)(e) GDPR Article 9(1) GDPR Article 9(2)(g) GDPR Article 9(2) GDPR Article 9(2)(b) GDPR Article 13(1)(d) GDPR Article 13(1)(b) GDPR Article 13(1)(c) GDPR Article 13(1) GDPR Article 13(1)(e) GDPR Article 13(1)(f) GDPR Article 13(2) GDPR
Type:	Investigation
Outcome:	Violation Found
Started:	20.06.2025
Decided:	20.02.2026
Published:	05.05.2026
Fine:	2,000,000 HUF
Parties:	University of Szeged
National Case Number/Name:	NAIH-3443-1/2026
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Hungarian
Original Source:	NAIH (in HU)
Initial Contributor:	ap

The DPA fined a private university HUF 2,000,000 (approximately €5,286) for processing excessive data of students applying for accommodation scholarships. The DPA considered that the university had processed data beyond what was necessary under national law.

English Summary

Facts

The University of Szeged (SZTE, the controller) is a Hungarian private university. Under national law, the controller has the obligation to provide need based scholarships, including for student accommodation. During its dormitory admission procedure, the controller processed personal data of students. The legal basis was public interest (Article 6(1)(e) GDPR), and Article 9(2)(b) and (g) GDPR (legal obligation and public interest respectively) for special categories of personal data. This is because national law allowed the controller to provide dormitory accommodation on the basis of an application. Under national law, the controller could process a wide range of data related to data subjects, such as their address, medical and disability expenses, academic performance, or family background and living situation. The controller argued that not processing this data to take into consideration the data subject’s background would be a violation of national law. Furthermore, the processing of personal data ensured that the controller provided equal opportunities for data subjects with disabilities. Data subjects consented to the data processing by accepting the declaration on the data form, which could not be submitted without this consent.

In terms of data minimisation, the controller claimed that it complied with Article 5(1)(c) GDPR by requesting data subjects to substantiate their individual circumstances with a single supporting document. It also accepted documents where unnecessary data was redacted. Finally, while documents were stored for five years, the controller revoked the reviewing committee’s access after the application process had ended (access was limited to dormitory data processors).

The DPA began an ex-officio investigation in 2025.

Holding

Data minimisation and legal basis

The DPA first noted that the controller had the obligation to comply with provisions under the GDPR, even if the legislator does not include data protection obligations in its law allowing the processing under Article 6(1)(e) GDPR. This means it must not go beyond what is established in national law and the GDPR. This includes complying with Article 9 GDPR when processing special categories of personal data, as well as the principle of data minimisation (Article 5(1)(c) GDPR).

In terms of personal data related to disabilities, the DPA stated that the controller processed data related to health beyond what was necessary under national law. The controller’s requirement of providing original copies of documents implied that the controller requested data subjects to provide complete medical certificates. Therefore, the controller accessed medical details of a purely private and sensitive nature, which put data subjects in a vulnerable position. The DPA stated that such a large scale processing could not be justified under Article 6(1)(e) GDPR, as national law did not require the controller to process complete medical documents. The controller did not have a legal basis under Article 9(2) GDPR, as it lacked a legal basis under Article 6(1) GDPR. This also applied to processing data related to medical expenses arising from the data subject’s medical condition (or that of a relative living in the same household).

The DPA considered that the controller had processed excessive personal data of third persons related to the data subject applying for accommodation. According to the DPA, the controller required documentation to demonstrate aspects of the data subject’s living and family situation (e.g. complete housing contracts, divorce judgments, and court records).

Overall, the DPA considered that the comprehensive background assessment of data subjects lacked a legal basis under Article 6(1) GDPR, and violated the principle of data minimisation (Article 5(1)(c) GDPR).

Transparency

The DPA found a violation of the principle of transparency (Article 5(1)(a) GDPR) and the controller’s transparency obligations (Articles 13(1) and (2) GDPR). The DPA found that the controller required data subjects to check information from several different documents to determine which data processing activities they were subject to. In addition, the controller did not provide information in its College Regulations on data protection, but instead simply repeated the relevant provisions under national law. The DPA also found that the controller cited the wrong relevant law in its information, stating that the Dormitory Regulations were subject to the Information Act. Finally, the controller provided incorrect information regarding legal bases for processing; this meant that students were mislead into believing that they could consent (or not) to the processing (Article 6(1)(a) GDPR) when the processing was based on Article 6(1)(e) GDPR. This was a violation of Articles 13(1)(b)-(f) GDPR.

The DPA fined the controller HUF 2,000,000 (approximately €5,286). In addition, the DPA ordered the controller to cease its data processing activities that violated the GDPR, erase the personal data stored in a non-compliant manner, and provide appropriate information.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.

........................................................................................................................................................................................................................................................................................
1055 Budapest Tel.: +36 1 391-1400 naih.hu/adatkezelesi-tajekoztatok
Falk Miksa utca 9-11. KR ID: 429616918 ugyfelszolgalat@naih.hu
Case number: NAIH-3443-1/2026. Subject: decision establishing an infringement
(NAIH-10128/2025.)
D E R C I O N
The National Data Protection and Freedom of Information Authority (hereinafter: Authority) makes the following decisions in an ex officio data protection authority proceeding regarding the compliance of the data processing practices of the University of Szeged (seat: Szeged, Dugonics tér 13.; hereinafter: SZTE) with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: General Data Protection Regulation) in relation to dormitory admissions, including the examination of the validity of the data processing principles, the legal basis for data processing, and the appropriate prior information.
1. The Authority condemns SZTE for negligently infringing Article 5(1)(a) and (c), Article 6(1), Article 9(2) and Article 13(1)-(2) of the General Data Protection Regulation.
2. The Authority prohibits SZTE from processing data in violation of the principle of data economy and without legal grounds for the future, as set out in Section V.5 of the Decision, with effect from the date of notification of this Decision. To this end, the Authority orders SZTE to erase all unlawfully processed personal data.
3. The Authority further orders SZTE to provide adequate information on its data processing and to provide the Authority with proof of this.
4. The Authority obliges SZTE to pay a data protection fine of HUF 2,000,000, i.e. two million forints, for the violations established in point 1.
5. The Authority further orders the publication of the decision on its website.
SZTE must confirm in writing to the
Authority that it has taken the measures prescribed in points 2 and 3 within 45 days of receipt of this decision, including the submission of supporting evidence,
such as a deletion protocol and a data processing information sheet.
The data protection fine must be paid within 30 days of receipt of this decision to the Authority's centralized revenue collection target settlement forint account (10032000-
01040425-00000000 Centralized collection account IBAN: HU83 1003 2000 0104 0425
0000 0000). When transferring the amount, reference must be made to the NAIH-3443/2026. BÍRS. number.
If SZTE fails to meet its obligation to pay the fine within the deadline, it shall pay a late payment surcharge to the above
account number. The rate of the late payment surcharge is the statutory
2
interest, which is the same as the central bank base interest rate valid on the first day of the calendar half-year affected by the delay.
In the event of failure to comply with the obligations under points 2 and 3, and failure to pay the data protection fine and the late payment fee, the Authority shall order the enforcement of the decision.
Until the expiry of the deadline for filing an action to challenge the decision, or until the final decision of the court in the event of an administrative lawsuit, the data affected by the disputed data processing may not be deleted or destroyed.
There is no right of appeal against this decision through administrative means, but it may be challenged in administrative proceedings by means of a statement of claim addressed to the Metropolitan Court within 30 days of its notification. The statement of claim shall be submitted to the Authority electronically1,
which shall forward it to the court together with the case documents. The request for a hearing shall be indicated in the statement of claim. For those not entitled to full personal exemption, the administrative lawsuit fee is HUF 30,000, and the lawsuit is subject to the right to record the subject matter fee. Legal representation is mandatory in the proceedings before the Metropolitan Court.
The Authority publishes the decision on its website with identification data.
JUSTIFICATION
I. P a r e c t i o n s , a u t i o n a l i t i o n (1) On December 18, 2024, the Authority launched a data protection authority audit of the data processing practices of SZTE related to dormitory admissions - including the validity of the principles of data processing, the legal basis for data processing, and the appropriate prior information - with the General Data Protection Regulation, under number NAIH-12627/2024. The period under review covered the application period for the 2022-2024 academic year.
(2) During the audit, the Authority called on SZTE to make a statement on two occasions (orders numbered NAIH-12627-3/2024 and NAIH-1273-5/2025), which calls were complied with by SZTE on both occasions within the deadline (documents filed under numbered NAIH-1273-3/2025 and NAIH-1273-6/2025).
(3) During the audit, the Authority reviewed the data processing process of SZTE related to its dormitory admissions and closely related social situation assessment procedure, in accordance with the subject of the audit.
(4) In this context, the Authority received information regarding the period under review – indicating the number of data subjects – about what personal data SZTE processes for the two procedures, on what legal grounds, and which additional legality requirement under Article 9 of the General Data Protection Regulation it applies in the case of the processing of health and other sensitive data. SZTE also provided information about what documents it requests from applicants in the two procedures to verify each piece of data and on what legal grounds, including how it complies with the data protection requirements in relation to the handling of documents. 1 The form called NAIH_K01 is used to initiate administrative proceedings: NAIH_K01 form (2019.09.16.) The form can be filled in using the general form filling program (ÁNYK program). The form is available at the following link: https://naih.hu/kozig-hatarozat-birosagi-felulvizsgalata
3
principles. SZTE also presented the way in which it provides information on data processing. SZTE supported its responses by sending documents.
(5) After reviewing and evaluating SZTE's statements and the documents attached to them, the Authority detected a suspicion of a violation in the period under review regarding the validity of the principle of data minimization, the legal basis for data processing, and the information on data processing, in view of the documents requested for the application materials, the legal references prescribing data processing, and the non-uniform data processing information.
(6) Based on the information revealed during the official inspection, the Authority closed the official inspection on 28 April 2025 due to a suspected violation of the provisions of the General Data Protection Regulation and on the same day initiated an ex officio data protection official procedure to examine the compliance of the data processing practices of the SZTE dormitory admissions with the General Data Protection Regulation.
I I . A U T I O N notified SZTE in its order No. 
, in which order it also called upon it to make a statement in order to clarify the facts.
(9) SZTE responded to the Authority's order in its submission dated 12 May 2025
(registered under number NAIH-10128-2/2025).
(10) Since, after reviewing the submissions made by SZTE in its response, further clarification of issues regarding the data processing under examination became necessary, the Authority called upon SZTE again in its order No. 
NAIH-10128-3/2025 dated 20 June 2025
to make a statement in order to clarify the facts.
(11) SZTE responded to the Authority's order in its submission dated 18 July 2025 (filed under number NAIH-
10128-4/2025).
(12) The Authority used the documents, data and the public interest notification (NAIH-12627-1/2024) of the data protection authority inspection initiated under number NAIH-12627/2024 in the present data protection authority procedure, about which the record number NAIH-10128-5/2025 was prepared.
(13) Based on the evidence at its disposal, the Authority issued a decision dated 25 September 2025,
NAIH-10128-6/2025. In its order No. 10128/2025, the Authority informed SZTE that the evidentiary procedure in the data protection authority procedure had been completed and drew its attention to the fact that it could examine the evidence uncovered during the clarification of the facts, taking into account the rules for access to documents, and could make further evidentiary motions.
(14) SZTE requested access to documents in its submission dated 9 October 2025 (registered under number NAIH-10128-7/2025).
(15) In its order No. NAIH-10128-8/2025, dated 27 October 2025, the Authority granted SZTE's request for access to documents.
(16) In its submission dated 5 November 2025, SZTE requested the Authority to send a copy of the procedural documents
4
(registered under number NAIH-10128-9/2025).
(17) The Authority sent a copy of the procedural documents to SZTE as an attachment to its order dated 12 November 2025, number NAIH-10128-10/2025.
(18) After reviewing the documents, SZTE made a statement in its submission dated 25 November 2025 (registered under number NAIH-10128-11/2025).
I I I . E x t a t i o n of the facts
I I I . 1 . D e s t a t i o n s f o r m i n g s u p t i o n s 
(19) According to the document of the official inspection annexed to the memorandum no. NAIH-10128-5/2025, SZTE submitted the following in its submissions registered under numbers NAIH-1273-3/2025 and NAIH-1273-6/2025:
(20) According to the statement of SZTE, the purpose of data processing related to the dormitory admission procedure is - in addition to identifying and maintaining contact with applicants - to properly assess applications and determine the score of each applicant. This is to ensure student access to dormitory care, and to ensure dormitory care for students who are most in need, by assessing and taking into account their social situation.
(21) SZTE no longer had data on the number of students who initiated the dormitory admission procedure in the period 2022-2024, but it provided the internet links under which downloadable tables contain information on how many applicants were admitted to SZTE dormitories in the four semesters concerned. Based on this, 3,526 were admitted in the first semester of 2022/2023, 3,210 in the second semester of 2022/2023, 3,657 in the first semester of 2023/2024, and 3,361 in the second semester of 2023/2024. The total number of permitted places in SZTE dormitories is 3,807.
(22) According to the statement of SZTE, Chapter VI. 1.1. of the Dormitory Regulations (June 26, 2022) on the conditions and procedure for dormitory admission states that “the procedural and organizational order of dormitory admission is determined by the SZTE regulations on the scoring system and the procedural and organizational order for assessing dormitory applications. The specialized dormitories may operate their own admission system.” Furthermore, within the meaning of Section VI.1.6. “dormitory placement can be obtained through an application. During the dormitory admission procedure, the Member Dormitory Committee decides on admission applications and appeals in the first instance. The Dormitory Board of Directors decides on legal remedies.” The method of submitting the application is specified in Sections VI.2.1-2.3. of the Dormitory Regulations. points, according to which the application for admission must be submitted on the electronic form set up for this purpose, basically via the Modulo system. The documents specified in the call for applications must be attached to the application. (23) According to the statement of SZTE, Section 12 (1) of Government Decree 51/2007. (III. 26.) on the benefits of students participating in higher education and the certain fees to be paid by them (hereinafter: Government Decree) authorizes higher education institutions to provide dormitory accommodation on the basis of an application. During this application, data processing becomes necessary, which thus takes place on the basis of the authorization of the Government Decree and on the legal basis of the performance of a task in the public interest pursuant to Article 6 (1) e) of the General Data Protection Regulation. Given that the dormitory admission is related to the social situation assessment, the scope of data processed during data management is determined by the Government Decree and the provisions of Act CCIV of 2011 on National Higher Education (hereinafter: Nftv.). The Government Decree lists the personal data that must be taken into account when assessing the social situation of the student during the dormitory admission procedure, not only in relation to the applicant, but also in relation to his/her relatives or those living in the same household, i.e. third party affected persons. SZTE has summarized in the form of a table which personal data of the applicants it processes in connection with the dormitory admission procedure, in accordance with Article 6 (1) e) of the General Data Protection Regulation, and with regard to which provisions of the Government Decree. Accordingly, the following personal data is processed by SZTE on the basis of the following legal grounds:
(24) Pursuant to Article 6(1)(e) of the General Data Protection Regulation, with regard to Article 21(1) of the Government Decree:
- the student's address
- the number of persons living together in the property at the student's address, registered there or having a place of residence
- the income status of persons living together in the property at the student's address, registered there or having a place of residence
- the distance between the place of training and the place of residence
- the duration of the journey between the place of training and the place of residence
- the cost of the journey between the place of training and the place of residence
- whether the student lives in a common household as defined in the Code of Civil Procedure
- if the student does not live in a common household as defined in the Code of Civil Procedure during his/her studies lives in a shared household according to the definition,
the costs of this
- the amount spent on the purchase and maintenance of special equipment due to disability
- the amount spent on special travel needs due to disability
- the amount spent on the use of a personal assistant or sign language interpreter due to disability
- the amount of the student's regular health expenses due to his/her health
- the amount of the close relatives living in the same household as the student
- the number of dependents living in the same household as the student, with particular regard to children living with him/her
- the costs of caring for the student's dependent relative.
(25) Pursuant to Article 6(1)(e) of the General Data Protection Regulation, with regard to Article 12(3) of the Government Decree:
- data on the student's academic performance
- data on the student's work for the community
- the work schedule of the student's training
- data on the student's exemption.
(26) Pursuant to Article 6(1)(e) of the General Data Protection Regulation, with regard to Article 4(4) of the Government Decree:
- the student is an orphan
- guardianship has ceased due to his/her coming of age
- the student is a breadwinner
- dormitory work.
(27) Pursuant to Article 6(1)(e) of the General Data Protection Regulation, with regard to Article 12(3) of the Government Decree:
- data on preference.
(28) Pursuant to Article 6(1)(e) of the General Data Protection Regulation, with regard to the Nftv. In view of Section 41 (1)
6
of the Act:
- is he/she disadvantaged
- is he/she receiving an infant care allowance
- is he/she receiving an adoption allowance
- is he/she receiving childcare assistance allowance
- is he/she receiving child-rearing allowance
- is he/she on unpaid leave to care for his/her child
- is he/she receiving a child care allowance
- is he/she receiving a care allowance for caring for a child at home
- is he/she receiving a childcare allowance
- is he/she having a disability
- does he/she belong to a nationality.
(29) Based on Annex 1 of the Regulations of the University of Szeged on the Scoring System for Dormitory Applications, the Procedural and Organizational Rules for their Assessment (hereinafter referred to as the Scoring Regulations) (2011) and Annex 1 of the Regulations of the University of Szeged on the Electronic Application System for Regular Social Scholarship Applications (November 25, 2013 and October 30, 2023), the applicant student will receive different scores in the following circumstances: I. In the case of those with a family background: 1. Income-dependent factors: points given for per capita income 2. Income-independent factors: 2.1. Points awarded to parents/caregivers
a) orphans or state-provided non-self-supporters 35 points
b) 10 points per retired parent
c) 10 points per disabled parent
d) 10 points per unemployed parent
e) 25 points per single parent
2.2. Dependents living in the same household and points awarded to them
Among those living in the same household, family members who contribute to the family income
(e.g. grandparents, earning siblings) are not taken into account
a) 10 points per unemployed sibling
b) 20 points per sibling who is a minor and/or studying in public education
c) 25 points per seriously ill sibling
d) 25 points per sibling studying in higher education
2.3. Points awarded for distance from place of residence Distance from place of residence to place of training (1 point/15km) maximum: 25 points
3. A maximum of 20 points as subjective points for socially justified circumstances
which are not included in the above points calculation (for example, high cost of medicine, parent on permanent sick leave, unique, difficult family circumstances, special expenses)
II. In the case of self-supporting applicants:
1. Income-dependent factors: points awarded for per capita income
2. Income-independent factors
2.1. Points awarded for parents/supporters: the applicant as a self-supporting person (single supporter) 25 points
2.2. Points awarded for dependents:
If the self-supporting person has children 25 points per child
35 points in the case of self-supporting after orphanhood or state care
2.3. Points awarded for distance from residence: distance from residence to training location (1 point/15 km) maximum: 25 points
3. A maximum of 20 points as subjective points for socially justified circumstances
that are not included in the above score calculation (for example, high medication costs,
7 a parent who is permanently ill, unique, difficult family circumstances, special expenses)
(30) According to its statement, SZTE asks for the following data in the general social situation assessment form
in the following order and grouping:
Personal data and within it special data:
- the applicant's Neptun study system (hereinafter: Neptun) code, full name,
mother's birth name, date of birth, place of birth, citizenship
- permanent address: postal code, city, street, house number
- the applicant's notification address: postal code, city, street, house number, contact information from the
study system
- the applicant's e-mail address, phone number, mobile number
Applicant's academic data:
- parent institution, training(s)
Benefits not included in income, for informational purposes only:
- social scholarship
- study scholarship
- ministerial scholarship
- student loan
- orphan's allowance
- child support fee
- other income: their name and amount
Marital status
Does he/she meet the requirements for preference
Other circumstances:
- was in state care
- orphan and under 25 years of age
Preference categories:
- orphan
- breadwinner
- disabled or in need due to health condition
- cumulatively disadvantaged
- large family
- half-orphan
- guardianship terminated due to age of majority
- disadvantaged
Residence data:
- commuter
- lives in a university dormitory
- first-year student, with his/her guardians lives
- lives in a sublet
- other
Lives in a sublet at a permanent address.
Monthly cost: … HUF/month
8
Distance from permanent residence: … km
Certificate of address issued by the local government
Data of breadwinners in a common household (or the student as a self-supporter)
- name
- breadwinner
- date of birth
- characteristics: seriously ill
- employee
- entrepreneur
- primary producer
- pensioner
- unemployed
- other
Address card
Divorce decision or separation declaration
Dependents living in a common household
Other comments, to be announced, expenses, costs
- medicine costs
- relative in need of care
- the applicant is seriously, permanently ill,
- rent costs
- other.
(31) During the scoring process, additional points may be awarded to the applicant in the case of, among other things, a serious illness, lactose intolerance, gluten sensitivity, other allergies and similar illnesses.
(32) According to the statement of the SZTE, the processing of the personal data of the applicant students is prescribed by Section 12 (3) of the Government Decree, and failure to use them would create an unlawful situation: “The points system shall take into account the student’s social situation, academic performance, work done for the student community, the work schedule of his/her training, exemption according to Section 4 (4), and if the student is to be given priority in the assessment of the dormitory application based on Section 41 (1) of the National Student Act, the existence of the condition for giving priority specified in the National Student Act.”
(33) According to the statement of SZTE, the further lawfulness of the processing of special data from the personal data it processes is ensured by Article 9 (2) (b) and (g) of the General Data Protection Regulation. All this is done in order to ensure equal opportunities for applicants with disabilities. The student consents to the processing of data by accepting the declaration on the data sheet, without which the data sheet cannot be submitted. (34) According to the statement of SZTE, it is necessary to name serious, long-term illnesses because they are awarded different points. In the case where the applicant is seriously ill, long-term, +10 points, and in the case of lactose intolerance, celiac disease, other allergies and similar diseases, +3 points are awarded. In order to curb various abuses, SZTE requests a medical certificate for a long-term illness based on Section 21 (1) (e) of the Government Decree, according to which “when assessing the social situation of the student, the medical expenses regularly incurred due to the health condition of the student or his/her close relative living in the same household shall be taken into account.” The legality of data processing is also supported by the conditions set out in Article 9 (2) of the General Data Protection Regulation. (35) According to the statement of SZTE, regarding the processing of the personal data of the applicants’ relatives and those living in the same household, Section 21 (1) of the Government Decree authorizes higher education institutions to process the personal data of the applicants’ relatives or natural persons living in the same household as specified in the regulation in the framework of the dormitory admission procedure, in order to assess social need. (36) SZTE summarized in the form of a table which personal data of the applicants' relatives are processed in connection with the dormitory admission procedure, in accordance with Article 6(1)(e) of the General Data Protection Regulation, in view of Section 21(1) of the Government Decree. Among the personal data relating to relatives or persons living in the same household as the applicant, the legality requirement for the processing of data relating to health status according to Article 9 of the General Data Protection Regulation is Article 9(2)(b) and (g), as SZTE also referred to in the case of the applicants. Based on this, SZTE processes the following personal data of the applicants' relatives:
- the address of the relative or person living in the same household.
- the number of people living together, registered or residing in the property at the address of the relative or household

- the income situation of the people living together, registered or residing in the property at the address of the relative or household

- whether the relative or household member lives in a common household as defined in the Civil Code
- if the relative or household member does not live in a common household as defined in the Civil Code, the costs of this
- the amount of the health expenses regularly incurred due to the health condition of the close relative living in the common household
- the number of dependents living in the common household
- the costs of caring for the relative in need of care.
(37) According to the statement of SZTE, as a first step when submitting an application, students must fill out the general social situation assessment form sent to the Authority on the Modulo interface, since the admission scoring is based on the points received on the general social situation assessment form based on the student's social situation. The uniform evaluation point system is contained in the Scoring Regulations (2011) made available to the Authority. Annex 1 to the Scoring Regulations determines which factors and aspects relating to the applicant's social situation are taken into account by SZTE during the scoring process. According to the Scoring Regulations, the overall score is the sum of the points given for the student's social situation, academic performance and work for the community. In addition to the data from the form filled out by the applicant and the documents attached to it, SZTE also receives personal data from Neptun. All of this is in accordance with the National Funding Act. and the authorization of the Government Decree, as well as the provisions of the relevant SZTE internal regulations (for example, the Dormitory Regulations, the Scoring Regulations, the Data Protection Regulations).
(38) Several declarations can be found at the bottom of the general social situation assessment form. Their acceptance is mandatory by checking the checkbox next to them. After accepting the declarations, the applicant has the opportunity to submit the general social situation assessment form and then submit the dormitory application, as an attached form.
Therefore, if the social situation assessment form is not completed, the dormitory application cannot be submitted. SZTE does not have data on how many students completed the general social situation assessment form in the period under review.
(39) The social situation assessment form must be completed every six months, and the dormitory application is made once a year: for seniors, the application period is April-May of the given year, while for first-years, the dormitory application can be submitted in July-August.
(40) SZTE also stated that during the dormitory admission procedure, its data processing activities also include the processing of personal data categories whose processing is based on the voluntary consent of the person concerned. SZTE also stated in relation to the provision of voluntary consent that the consent is made by accepting the statements found on the social situation assessment form. The data processed based on the consent is included in paragraph (105) of the resolution.
(41) The general social situation assessment form, available on the Modulo interface and also sent to the Authority, included five statements during the period under review that the applicant had to accept in order to submit the form. These are named: “Declaration 00”,
“Declaration 01”,
“Declaration 02”,
“Declaration 03”,
“Declaration 04”. Of these declarations,
“Declaration 04” is relevant from a data protection perspective, and contains the following:
“I declare that I expressly consent to the fact that the persons entitled under the relevant regulations and
higher legal acts, in connection with the assessment of individual student benefits, will use my data (data, facts, certificates) currently provided by me and otherwise recorded in the “ETR” electronic system
to the extent necessary for the assessment of individual student benefits (data processing, data transfer);
I do not wish to express any other position in this regard. I acknowledge that the persons entitled will not forward this data to third parties not involved in the procedure.
I also agree that those authorized to process data may contact me by email or telephone to the extent necessary via my provided contact details (in particular: email address, phone number). I acknowledge the information that, in connection with the processing of my personal data, the provisions of Act LXXIII of 1992 on the Protection of Personal Data and the Disclosure of Data of Public Interest, Act CCIV of 2011 on Higher Education, and the relevant regulations of the University of Szeged shall apply; in the event of a suspected violation of my rights related to data processing, I may report it to the head of the organizational unit concerned by the service.”

(42) According to the statement of SZTE, since the period under review, the wording of “Declaration 04” has been modified as follows: the “ETR” electronic system has been replaced by the “Neptun” electronic system, and instead of the ineffective Act LXXIII of 1992 on the Protection of Personal Data and the Public Disclosure of Data of Public Interest, a reference has been made to the General Data Protection Regulation. (43) According to the statement of SZTE, the provision of “Declaration 04” according to which “I further consent to the persons authorised to process data contacting me by e-mail or telephone to the extent necessary via my provided contact details (in particular: e-mail address, telephone number)” should be interpreted as meaning that the Modulo system notifies the applicant via its e-mail address of any changes to the status of the data sheet, for example, in the event of a deficiency being filled. The purpose of managing the e-mail address and telephone number is to maintain contact with the applicant, and the legal basis is the student's voluntary consent to the management of these data. The 11 students are primarily contacted via the e-mail address, and only if the applicant does not respond to the e-mail notification will the staff of the University Student Government (hereinafter: EHÖK) attempt to contact them by telephone. (44) SZTE stated in relation to the documents required to verify the data that EHÖK publishes an updated list every semester, which also includes which certificate must be used to verify which personal data. SZTE summarized in the form of a table – and by sending the lists of certificates used in the semesters of the period under review – which certificate it accepts for which data, since in its absence the social situation of the applicant cannot be assessed on a sound basis. According to its statement, the legal basis for requesting the documents and the processing of the personal data contained therein is Article 6(1)(e) of the General Data Protection Regulation.
(45) Based on this, the following documents and certificates are accepted by SZTE to verify the following personal data:
- for verification of address, an official certificate certifying the address (hereinafter referred to as:
address card). According to the list of certificates, “both sides of the address card, which is mandatory for every person indicated in the application, and a certificate issued by the local government or the regionally competent district office or the regionally competent government office regarding the people living at the same address”. In the case of a foreign address, “instead of the address card known in Hungary, a certificate issued by the authority (organ) that maintains the register containing citizens’ address data, clearly indicating the address of the supporter or the supporter, and a Hungarian translation prepared or reviewed by the Foreign Affairs Committee (or translation agency) of the SZTE EHÖK is required.”
- benefits not included in income: these data are not relevant to the scoring algorithm, they serve only as information for the assessor when determining (subjective) points based on the assessment.
This data does not need to be verified.
- Preference circumstances
• to prove disability or need due to health, an expert opinion issued by the Expert and Rehabilitation Committee or the National Institute of Rehabilitation and Social Experts, or (in the case of a student in need due to health) an expert opinion issued by a specialist. According to the verification lists, an expert opinion is required, stating in text and numbers that the applicant has lost at least 67% of his or her working capacity or has suffered at least 50% health impairment, and that this condition has lasted for one year or is expected to last for at least another year.
• to prove a cumulatively disadvantaged situation
a) a notary certificate or
b) a notary certificate of being placed under notary protection or of receiving regular child protection benefits, and at least two of the following certificates:
• a voluntary declaration of at most primary school education by both parents raising the young adult together, the parent raising the child alone or the guardian taking the child into the family
• a certificate from the labour authority that the parent raising the young adult, the parent raising the child alone or the guardian taking the child into the family
is registered as a job seeker
• an environmental study supporting the young adult's inadequate living environment,
c) a certificate of a young adult being placed under foster care or
d) a certificate of a young adult receiving aftercare,
12
e) any of the following documents as of 1 September 2013 (Act on the Protection of Children and the Administration of Guardianship) A document (e.g. admission decision) issued by the body authorized to conduct the procedure after the entry into force of the amendment to Act XXXI of 1997, which credibly states that this circumstance was accepted and assessed as additional points when applying for higher education admission. • to prove the status of a breadwinner, the birth certificate of your child
or a local government certificate of the existence of the child or a local government
certificate of the childcare fee
• in the case of a student with a large family:
a) birth certificates (in the case of a sibling under the age of 7),
b) school attendance certificates or, in the absence thereof, a copy of the student ID
(in the case of a sibling under the age of 18)
c) proof of student status or, in the absence thereof, a copy of the student ID
(in the case of a sibling studying in higher education)
d) in the case of a sibling over the age of 18 with an income, a certificate of employment or
e) a certificate from the guardianship authority (even if the parents are not biological parents)
• in the case of an orphaned student under the age of 25:
a) death certificates or
b) death certificates and divorce decree / declaration, or
c) if the birth certificates have been lost, a certificate issued by the pension provider (with a coupon containing the amount of the orphan's benefit).
• In the case of a disadvantaged student under 25 years of age
a) a notary's certificate, which expressly states that the student is disadvantaged
;
b) a notary certificate of being placed under notary protection or of receiving regular child protection benefits, and one of the following certificates:
• a voluntary declaration by both parents raising the young adult together, the parent raising the child alone or the guardian taking the child into the family
of at most primary school education,
• a certificate from the employment authority that the parent raising the young adult, the parent raising the child alone or the guardian taking the child into the family
is registered as a job seeker,
• an environmental study supporting the young adult's inadequate living environment
• a certificate from the guardianship authority to prove that guardianship has been terminated due to the child reaching the age of majority (he was in state care)
• in the case of a half-orphan student, a death certificate or, if the certificate has been lost, a certificate issued by the pension provider. The other parent must be fully certified if the parents are divorced or do not live together, then the divorce decree (if the procedure is still in progress, with any document proving that the procedure has been initiated), a declaration in the case of separated parents, which declaration must be certified by two witnesses, and a certificate of the amount of alimony or the lack thereof (for example, a pink check, a declaration certified by two witnesses) - Data on the alimony recipients in a common household: according to the certification lists, the certificate in this category covers a total of three facts; all three facts must be certified separately for each alimony recipient: The identity of the alimony recipient (what kind of relationship the alimony recipient has to the student, and the alimony recipient's marital status; for example, a divorced mother, a single father). There are 13 cases of this according to the list of certificates:
• “My mother, who is married (to my father or to her current husband following a new marriage)”
The required certificate: a certificate issued by the local government or the regionally competent district office or the regionally competent government office on the people living at the same address (the certificate must include the names of those living at the same address, numerically is not sufficient) and both sides of the address card. Further certificates depend solely on the nature of the employment relationship.
• “My mother, who is divorced (divorced from my father) and has not remarried”
The required certificate: a decision made by the court following the divorce proceedings; or if the proceedings are still ongoing, any document indicating that the proceedings have been initiated. (If the court decision in the divorce case does not include alimony, it is not necessary to prove it). In addition, a certificate issued by the local government or the regionally competent district office or the regionally competent government office on the people living at the same address (the certificate must include the names of those living at the same address, numerically is not sufficient) and both sides of the address card are required.
• “My mother, who is a widow (my father is deceased) and has not remarried”
The required certificate: the deceased father’s death certificate, or
if the death certificate has been lost, a certificate issued by the pension provider (a [green, tabular format] document indicating the type of payment containing the fact of orphan’s benefits, i.e. a “pension coupon”). A certificate issued by the local government or the regionally competent district office or the regionally competent government office on the people living at the same address (the certificate must include the names of the people living at the same address, the numbers are not sufficient) and both sides of the address card. • “My mother, who lives separately (lives separately from my father)” The required certificate: a statement signed by the student or parent containing the fact of living separately, signed by two witnesses and their addresses, or a document issued or received by any third body or authority containing the fact of living separately. A certificate issued by the local government or the regionally competent district office or the regionally competent government office on the people living at the same address (the certificate must include the names of the people living at the same address, the numbers are not sufficient) and both sides of the address card. • “My mother, who is single (not married)”
The required certificate: a certificate issued by the customer service of the regionally competent district office
(government window) and no older than the beginning of the application period
(extract from the data stored in the central data and address register),
which contains the indication of single marital status. In addition,
a certificate issued by the local government or regionally competent district office or regionally competent government office on the people living at the same address is required (the
certificate must include the names of the people living at the same address,
numbers are not sufficient) and both sides of the residential address card
• “My father, who is married (with my mother or with his current wife following a new marriage)”
If the non-self-supporting student also indicates the data of both parents (mother and father),
the kinship relationship/marital status itself does not need to be confirmed. A certificate issued by the local government or the regionally competent district office or the regionally competent government office on the people living at the same address (the certificate must include the names of the people living at the same address, numerically is not sufficient) and both sides of the address card are required.
• “My father, who is divorced (from my mother) and has not remarried”
14
The required certificate: the decision made by the court following the divorce proceedings; or if the proceedings are still ongoing, any document proving that the proceedings have been initiated. (If the decision made by the court in the divorce proceedings does not include alimony, it does not need to be certified). A certificate issued by the local government or regionally competent district office or regionally competent government office regarding the people living at the same address (the certificate must include the names of the people living at the same address, numerically is not sufficient) and both sides of the address card are required.
• “My father, who is a widower (my mother is deceased) and has not remarried”

The required certificate: the deceased mother’s death certificate, or
if the death certificate is lost, a certificate issued by the pension provider. A certificate issued by the local government or the regionally competent district office or the regionally competent government office on those living at the same address is required (the certificate must include the names of those living at the same address, numerically is not sufficient) and a residence card.

• “My father, who lives separately (lives separately from my mother)”

The required certificate: a statement signed by the student or parent containing the fact of living separately, signed by two witnesses and with the address of residence, or a document issued by or received by any third body or authority containing the fact of living separately. A certificate issued by the local government or the regionally competent district office or the regionally competent government office on the people living at the same address (the certificate must include the names of the people living at the same address, the numbers are not sufficient) and a residence card.
• “My father, who is single (not married)”
The required certificate: issued by the local government, not older than the beginning of the application period, (extract from the data stored in the central data and address register), which contains the indication of single marital status.
A certificate issued by the local government or the regionally competent district office or the regionally competent government office on the people living at the same address (the certificate must include the names of the people living at the same address, the numbers are not sufficient) and both sides of the residence card.
• “Grandparent”
The required certificate: a certificate issued by the local government or the regionally competent district office
or the regionally competent government office on the people living at the same address (the certificate must include the names of those living at the same address, numerically is not sufficient) and both sides of the address card. In addition to this
copy, the following certificate(s) are also required in connection with the parent(s) not specified:
- a decision made by the court following a divorce case; or if the
proceedings are still pending, any document from which it is clear that the
proceedings have been initiated; or a declaration signed by the student or parent stating the fact of separation, signed by two witnesses and with their residential address, or a document issued by or received by any third party
organization or authority stating the fact of separation. (If the decision made by the court in the divorce case does not include alimony, it is not necessary to prove it).
- in the case of deceased parent(s), death certificate(s), or if the death certificate is lost, a certificate issued by the pension provider.
- if the grandparent(s) is/are indicated in the application and is economically independent of his/her parents (and the orphan category does not apply), a statement must be made about the family structure in front of two witnesses.
15
If a grandparent is the sole breadwinner, his/her status (divorced, separated, widowed) must be proved.
• “My brother/half-brother/stepbrother”
The required certificate: a certificate of the sibling’s address issued by the local government or the regionally competent district office or the regionally competent government office on people living at the same address (The certificate must include the names of people living at the same address) and both sides of the “address card”,
a copy of which is also required if the applicant is under the guardianship of his/her sibling/half-brother/stepbrother,
a certificate to this effect issued by the social and guardianship authority,
a certificate of the sibling/half-brother/stepbrother’s income (employer’s income certificate or NAV income certificate)
• “My foster parent/adoptive parent/my mother’s husband following a new marriage”
In the case of a foster parent/adoptive parent, the required certificate: a certificate issued by the guardianship authority. In the case of a new marriage, no certificate is required. In addition, a certificate issued by the local government or the regionally competent district office or the regionally competent government office on the people living at the same address (the certificate must include the names of the people living at the same address, not sufficient in terms of numbers) and both sides of the address card are required.
• “My foster parent / adoptive parent / my father’s wife after a new marriage”
In the case of a foster parent / adoptive parent, the required certificate is: a certificate issued by the guardianship authority. In the case of a new marriage, no certificate is required. In addition, a certificate issued by the local government or the regionally competent district office or the regionally competent government office on the people living at the same address (the certificate must include the names of the people living at the same address, not sufficient in terms of numbers) and both sides of the address card are required.
• “My legal guardian”
The required certificate: a certificate issued by the guardianship authority.
In addition, a certificate issued by the local government or the regionally competent district office or
the regionally competent government office on the people living at the same address
(the certificate must include the names of the people living at the same address,
not sufficient in terms of numbers) and both sides of the address card are required.
• “Other”
The required certificate is a certificate issued by the local government or the regionally competent district office
or
the regionally competent government office on the people living at the same address (the certificate must include the names of the people living at the same address,
not sufficient in terms of numbers) and both sides of the address card.
In addition, it is necessary to certify with a statement made by the breadwinner in front of two witnesses (in order to make the family structure shown in the application easier to understand). The necessary templates can be found in the annexes of the document

The employer's employment (under what legal title and type of income the employer has; for example, employee, self-employed person) and monthly income

(what amount of income the employer has; for example, net monthly earnings of HUF 73,500)

• In the case of self-supporting students, a declaration of self-supporting status signed by the student, made before a notary and certified by a notary (except in the case of orphans, married students, students living in a civil partnership, when this declaration is not required)

16
• Residence data in the case of a visiting student: a monthly rent slip from the last three months and a copy of the student ID

• Residence data in the case of a subtenant student: a lease (subtenancy) contract signed by two witnesses and with their addresses (which includes the monthly rent) and a declaration issued by the landlord (main tenant) with their signatures and addresses of two witnesses, which also includes the monthly expected utility costs (the declaration is only required if the contract does not include the latter) or (in the absence of a contract) a declaration issued by the landlord (main tenant) or the tenant, signed by two witnesses and with their addresses, which also includes the monthly rent and the monthly expected utility costs • in the case of students living in other accommodation: a contract for the use of a free apartment or room, signed by two witnesses and with their addresses; or a declaration with the authentic, company signature of the head of the institution/representative of the legal entity, confirming the fact of living in the property; or a certificate issued by the higher education institution concerned or the organiser of the student exchange programme (for example: Erasmus, student exchange-visiting student status)
• in the case of an employee, an employer's income certificate stating the net income of the three months preceding the date of submission of the application. An income certificate issued by the National Tax and Customs Administration is not required.
• in the case of an entrepreneur (partner, member with an ownership interest in a business association): an income certificate issued by the National Tax and Customs Administration regarding the income situation for the given year + a self-employed person's certificate
or a certificate or company extract issued by the body keeping the register in accordance with Section 9 of Act CXV of 2009 on the business association in which the person has a share of a business that is sufficient to ensure their daily livelihood.
• in the case of a primary producer, an income certificate issued by the National Tax Agency (NTA) regarding the income situation of the given year, + primary producer certificate
• in the case of an old-age pensioner, a certificate from the pension payment directorate (certification of the pension amount and title). An income certificate issued by the National Tax Agency is not required.
• in the case of a disability pensioner, a certificate issued by the pension payment directorate or by the body acting in connection with the entitlement to social benefits established in connection with health impairment, altered working capacity, or reduced working capacity, or
any certificate issued by the body authorized to do so or from which the title and amount of the disability pension (a document containing the fact of the disability pension and indicating the type of payment, i.e. "pension coupon"); (or social benefits according to the above) can be established in a manner that excludes doubt. An income certificate issued by the National Tax Agency is not
necessary.
• in the case of a registered unemployed person, a certificate issued by the labor authority on the fact of unemployment, and a certificate issued by the body authorized to pay the benefit on the benefit (or lack thereof). An income certificate issued by the National Tax Agency is not
necessary.
• in the case of an unregistered unemployed person, a declaration made by the student or the breadwinner before a notary and certified by a notary, which contains the monthly average
sum, calculated net, and expressed in Hungarian forints, from which the declarant (or if the student declares, the breadwinner) earns the income necessary for everyday life.
17
Data on dependents living in a common household
The certificate covers a total of three facts; all three facts must be proven separately for each dependent:
Relationship (what kind of relationship the dependent is to the student;
for example, a child, sibling);
• “My brother/half-brother/stepbrother”
The required proof: a certificate issued by the local government or the regionally competent district office
or the regionally competent government office on those living at the same address (the certificate must include the names of those living at the same address, numerically is not sufficient) and both sides of the address card;
in addition, a birth certificate (before public education), or
(during public education) a school attendance certificate or, in the absence thereof, a copy of the student ID card, or (during higher education) a certificate of student status or, in the absence thereof, a copy of the student ID card. In higher education, in the case of non-registration for the semester in question ("passive" semester), the decision to this effect or the higher education admission decision.
In case of studies not conducted in Hungary, according to a different schedule (for example, a semester starting in November or April), the higher education admission decision. If the sibling has completed primary or secondary education and admission to the next level of education cannot yet be verified, in this case, the category corresponding to the completed level of education must be indicated and verified.
• “Grandparent”
The required certificate: a certificate issued by the local government or the regionally competent district office or the regionally competent government office on those living at the same address (the certificate must include the names of those living at the same address) and both sides of the residence card. If the supporting grandparent is the sole breadwinner, his or her status must be verified (divorced, separated, widowed).
• “My own child”
The required certificate: a certificate issued by the local government or the regionally competent district office
or the regionally competent government office on the people living at the same
address (the certificate must include the names of the people living at the same
address, numerically is not sufficient) and both sides of the address card.
In addition,
a birth certificate (before public education),
or
(during public education) a school attendance certificate or, in its absence, a copy of the student ID card,
or
(during higher education) a student status certificate or, in its absence, a copy of the student ID card.
In higher education,
in the case of non-registration for the semester in question (a “passive” semester),
the decision to this effect, or the higher education admission decision.
Not in Hungary, in the case of studies conducted according to a different schedule
the higher education admission decision.
• “My mother under guardianship or guardianship”
The required certificate: a certificate issued by the guardianship authority. A certificate issued by the local government or the regionally competent district office or the regionally competent government office on the people living at the same address is required (the certificate must include the names of the people living at the same address, not the numbers) and both sides of the residence card.
• “My father under guardianship or guardianship”
The required certificate: a certificate issued by the guardianship authority. A certificate issued by the local government or the regionally competent district office or the regionally competent government office on the people living at the same address is required (the certificate must include the names of the people living at the same address, not the numbers) and both sides of the residence card.
• “My minor child under my guardianship”
The required certificate: a certificate issued by the guardianship authority. A certificate issued by the local government or the regionally competent district office or the regionally competent government office on the people living at the same address (the certificate must include the names of the people living at the same address, the numbers are not sufficient) and both sides of the address card are required.
• “Other”
The required certificate: a certificate issued by the local government or the regionally competent district office or the regionally competent government office on the people living at the same address (the certificate must include the names of the people living at the same address, the numbers are not sufficient) and both sides of the “address card”.
B) the dependent's employment (under what legal title, what type of income the dependent has; for example, employee, sole proprietor) and monthly income (what amount of income the breadwinner has) • employee The required certificate: an income certificate issued by the employer, which contains the average income of the last three months, calculated as a monthly amount, net, and expressed in Hungarian forints (therefore, a "wage card", wage list is not acceptable). In the case of a recent employment relationship (if the employee cannot yet obtain an income certificate from the employer), an employment contract is acceptable. An income certificate issued by the National Tax and Customs Administration is not required. • entrepreneur (partner, member with an ownership interest in a business partnership, member of a limited partnership)
Two certificates are required: on the one hand (for sole proprietorship) a sole proprietorship certificate, or (in the case of sole proprietorship activity started after 1 January 2010) a sole proprietorship certificate or a certificate issued by the body keeping the register in accordance with Section 9 of Act CXV of 2009; or if the breadwinner is not a sole proprietor, but has a business share in a business partnership of such a size that it ensures their daily livelihood, in that case a company extract from the business partnership issued by the court of registration, no older than 3 months. On the other hand, an income certificate issued by the National Tax and Customs Administration, relating to the income situation for the given year. If
the sole proprietor does not have a NAV income certificate for the given year, in that case a decision including the refusal to issue the certificate must be attached.
• primary producer
Two certificates are required: on the one hand (for the agricultural primary producer legal relationship) an agricultural primary producer certificate; on the other hand, an income certificate issued by the NAV, relating to the income conditions for the given year.
If
the agricultural primary producer does not have a NAV income certificate for the given year, in that case a decision including the refusal to issue the certificate must be attached.
• old-age pensioner
The required certificate: a certificate issued by the pension provider; or
any certificate issued by an authorized body. An income certificate issued by the NAV is not required.
• disability pensioner
The required certificate: a certificate issued by the pension provider or by the body acting in connection with the entitlement to social benefits established in connection with health impairment,
changed working capacity, or reduced working capacity
19; or any certificate issued by the authorized body. An income certificate issued by the National Tax Agency
is not required.
• registered unemployed
The required certificate: a certificate issued by the labor authority on the fact of unemployment, and a certificate issued by the body authorized to pay the benefit on the benefit (or lack thereof). An income certificate issued by the National Tax Agency
is not required.
• not registered unemployed
The required certificate: a declaration made by the student or the breadwinner/dependent before a notary and certified by a notary, which contains the monthly average amount, calculated net, and expressed in Hungarian forints, from which the
declarant (or if the student declares, the breadwinner/dependent) earns the income that is fundamentally necessary for everyday life.
• other
If the breadwinner does not have any other income, then the required certificate for GYES,
GYED, family allowance, care allowance, alimony and similar benefits: a certificate issued by the authorized body (for example, local government), from which the legal title and amount of the other income can be established without any doubt. If the breadwinner also has other income, then GYES, GYED, family allowance, care fee, alimony and similar benefits are for information only, these data do not need to be confirmed in this case. An income certificate issued by the National Tax and Customs Administration is not required. • other comments, disclosures, expenses, costs The required certificate: a statement containing the indicated facts and data, signed by two witnesses and with their addresses, other documents depending on the content (for example: a certificate signed by a specialist or family doctor on the fact of a long-term illness, a certificate signed by a specialist or family doctor or pharmacist on the necessary regularly taken medications, which are listed item by item with price). The future change in income that you want to prove must also be detailed in this block and supported by facts and data. The required certificate: a document issued by a third party (e.g. a letter of termination, notice of a change in salary) that credibly indicates the change in income that is to be proven. (46) When requesting the given certificate, in connection with the application of the principle of data economy, the SZTE stated that the concept of the dormitory admission system is that each circumstance can be supported by a single document, and that the assessment practice is consistent in that certificates are accepted even if unnecessary data is covered up during the assessment of the situation assessment form, thus complying with the principle of data economy. However, experience shows that some certificates are difficult or take a long time to obtain, so in many cases the list of certificates tries to name alternative solutions, which may necessarily entail the obligation for the applicant to provide additional data. The certificates are stored electronically in the Modulo system for five years.
(47) Regarding why SZTE requests the attachment of a certificate of income even if the student declares that his parents' salary is higher than the prescribed amount, so that he does not claim any extra points from this when assessing the dormitory situation, he stated that the basic idea of the system is that the applicant must support the statements he has made with a certificate.
This case does not create an exception, which is why the certificate of income is required.
An additional technical reason is the design of the Modulo form and data sheet, which also follows the principle of mandatory attachments. In accordance with the principle of data saving, SZTE will develop the interface in the future in such a way that it allows for a differentiated upload of attachments.
(48) Regarding the data security measures related to the storage of data related to the admission process, SZTE stated that it takes all possible organizational and technical measures to guarantee the security of personal data processed during the dormitory admission process. All personal data of the data subjects is stored in the closed, internal system, Modulo. Access to the system is determined by strict authorization rules. SZTE employees involved in data management perform their work under a strict obligation of confidentiality.
(49) According to the statement of SZTE, the principle of limited storage applies in such a way that, after the assessment, the social situation assessment form and the certificates attached to it are stored electronically in the Modulo system for five years, after which they are deleted. After the assessment, neither the students commissioned by the EHÖK nor the dormitory data processors have access to these data, as SZTE terminates their access rights.
(50) According to the statement of SZTE, the assessment of the social situation assessment forms and the certificates attached to them is carried out by members of the EHÖK Benefits and Reimbursement Committee. During the assessment, they have access to all documents and all personal data in the documents. However, they cannot look back at this data after the assessment, as SZTE terminates their access rights, and the data related to the assessment will also be deleted from the IT equipment of the EHÖK. (51) After the assessment, the member dormitory committees, also known as dormitory data processors, have access to the social scores. The members of the member dormitory committee have access to the submitted dormitory applications, and they only see the total social score of each student, but they no longer see the social data. The same is true for the study points. The EHÖK has no access to the dormitory admission forms. The end of the dormitory admission takes place in the dormitories, and the dormitory committees are responsible for making the final decision based on the scores they have learned. The dormitory data processors can add the additional dormitory points. The dormitory data processors are the members of the member dormitory committees: the director of the member dormitory, two dormitory teachers and two committee secretaries. The dormitory head and dormitory teachers are employees of SZTE, while the two committee secretaries are SZTE students. Previously, these students entered the extra community points into the Modulo interface,
now this task is performed by dormitory teachers, and they also record the final decision regarding dormitory admissions in the Modulo system. In the case of some dormitories, the final decision is recorded by the employees of the SZTE Information Technology and Services Directorate (hereinafter: ISZI)
based on the list sent by the given dormitory, containing the students' Neptun codes and the
decision.
(52) SZTE also submitted that the strict access rules determining access to the Modulo system are as follows: SZTE students entrusted by the EHÖK with the assessment of the social situation assessment will only be granted access to the forms uploaded to the Modulo system after they have successfully completed the one-month practical preparation. The assessment of the forms takes place on site, at the EHÖK premises, on the EHÖK IT equipment. Following the assessment, all data processed in connection with the assessment will be deleted from these IT equipment, and the access rights of the students participating in the assessment to the Modulo data sheets will also be deleted. Only the EHÖK reimbursement officer will retain access rights, in order to support the assessment of any student appeals. In addition, in accordance with the general practice of SZTE, user rights are tied to a natural person and cannot be transferred. In the event of information security incidents, the responsibility lies with the person with the rights.
(53) During the dormitory admission procedure, only data transfer within SZTE takes place between EHÖK, the member dormitories and one specialist dormitory (Móra Ferenc Specialist Dormitory), and ISZI.
The data to be transferred are:
- the social score and Neptun code of the applicants. EHÖK forwards these to the member dormitories and Móra Ferenc Specialist Dormitory.
- the Neptun code of the applicants and the dormitory application result (the decision). The list containing these is forwarded by individual member dormitories to ISZI.
(54) SZTE, according to its statement, does not use a data processor for data processing related to the admission procedure.
(55) Regarding the information provided to applicants regarding data processing related to the dormitory admission procedure, SZTE stated that applicants can obtain information from the Dormitory Regulations, the Scoring Regulations, the call for applications for the current semester published by the EHÖK on the online platform, and the following documents related to it:
- Simplified list of certificates,
- List of certificates including the declarations to be filled in,
- Points system,
- Subjective points system,
- Per capita income,
- Date criteria,
- Guide to the Modulo system,
- Frequently asked questions (FAQ), etc.
(56) According to the statement, the relevant information, consent and declaration regarding data processing related to the dormitory admission procedure are provided in accordance with the Dormitory Regulations (2022.06.27.) 2.4.-
2.6. points include: “2.4. By submitting the application, the applicant acknowledges and consents to the fact that the university organizational units and persons competent for the assessment of the application will process, store and use the personal data included in the application in accordance with the provisions of Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information to the extent, manner and time necessary for determining the basic support and regular social scholarship grants specified in the Student Benefits Regulations (hereinafter: HJSZ), if the applicant also submits an application for these grants for the period concerned by the dormitory application, or if this period is an academic year, for its first semester. 2.5. By submitting the application, the applicant declares whether he consents to the processing of his personal data included in the application by the university organizational units and persons competent for the assessment of the application for the purpose of the waiting list procedure for the processing of personal data. If
you do not consent to the processing of your personal data for the purpose of the waiting list procedure,
your application cannot be assessed and shall be deemed as if you had not submitted your application.
2.6. In order to verify the authenticity of the data or to more accurately assess the social situation of the applicant, additional certificates may be requested from the applicant.”
(57) According to its statement, SZTE ensures the rights of the data subjects as set out in its Data Protection Policy (hereinafter: ASZ). These are:
a) right to information,
b) right to access,
c) right to rectification,
22
d) right to object,
e) right to restriction,
f) right to erasure,
g) right to data portability,
h) right to legal remedy.
(58) According to its statement, the ASZ also provides information on the right to contact the data protection officer, the possibility of reporting in the public interest of data protection, and the right to contact the data protection authority and the court.
(59) In the statement included in the general social situation assessment form, SZTE informs the applicant that in the event of a possible alleged violation of his rights related to data processing, he may report it to the head of the organizational unit affected by the service. The students affected by the application may enforce the data subject rights set out in Articles 13-21 of the General Data Protection Regulation towards the EHÖK. Since the legal basis for data processing related to the dormitory admission procedure is the performance of a task in the public interest, this also determines the data subject rights that can be enforced.
(60) According to the statement of SZTE, since there is little data processing based on the legal basis of voluntary consent during the dormitory admission procedure, the right to withdraw consent can only be enforced in these few cases, as per paragraph (105) of the resolution. Furthermore, since the legal basis for data processing for the majority of personal data processed is the performance of a task in the public interest, SZTE is not obliged to comply with the request for deletion of the data subjects in the case of such data processing. In addition, the affected applicant may exercise the right to a legal remedy and appeal against the decision related to the dormitory decision. The body acting in the first instance is the EHÖK Presidency, while in the second instance – consisting of university students and lecturers – the Legal Remedies Council of the Rector's Office. (61) Section 54 of the SZTE ASZ provides for a general prohibition on copying documents in relation to the data processing activities of SZTE. Despite this, according to the SZTE statement, copies of both sides of the official ID card proving the address, the agricultural primary producer ID card, and the individual entrepreneur ID card are required during the admission process because the new data protection regulations of the SZTE were not yet in force during the period affected by the examination (2022-2024 academic years). Among other things, the content of the social situation assessment form, the requested certificates, and the Modulo interface are being reviewed and modified and developed in accordance with the provisions of the ASZ. ISZI, which operates the Modulo interface, will develop the interface before the next dormitory admission period – in accordance with the principle of data saving and the SZTE ASZ – so that the principle of differentiated upload applies instead of the principle of mandatory attachments related to the form. The aim of this development is, among other things, to ensure that applicants only have to upload relevant certificates and documents supporting their declarations to the platform, and only the relevant part of them for the assessment. (62) SZTE also stated that, prior to the assessment of the social situation assessment data sheet, the education of all SZTE students participating in the assessment process begins with the acquisition of the theoretical knowledge necessary for the assessment, which ends with the writing of a test. After successfully writing the test, the selected ones sign a confidentiality statement that is also sent to the Authority. After that, the candidates participate in a one-month practical preparation under the guidance of the EHÖK benefits and reimbursement officer. Following the successful completion of this, SZTE students are authorized to access the social situation assessment data sheets on the Modulo platform and to perform assessment tasks. The reimbursement officer checks the work of the reviewers on a random basis. The reviewers can see the data on the form and the documents attached by the applicant, but after the review, they will no longer be able to view this data, as their access rights will be deleted.
These data are further stored in the Modulo system.
(63) In addition to the annual general data protection training for employees, the SZTE employees participating in the dormitory admissions process received special oral training before starting their participation in the dormitory admissions process, which specifically concerned the data processing related to this process, and they also made a confidentiality declaration. For this reason, a common training topic for this area was not prepared, because the SZTE employees concerned participate in different stages of the admissions process, and therefore their data protection training is also differentiated on this basis. The data protection education system is currently undergoing a transformation,
during which, in cooperation with the SZTE data protection officer, an internal data protection education procedure will be prepared based on the SZTE ASZ effective from 1 May 2024,
for which basic, intermediate and special level curriculum packages will be developed. A special, differentiated curriculum will be developed for employees participating in the dormitory admission process.
(64) According to the SZTE statement, since 2022 there have been no faculty dormitories at the university, but all such institutions operate under the supervision of the SZTE Education Directorate. The admission procedure is therefore uniform - with the exception of specialist dormitories. SZTE has two specialist dormitories where all dormitory students are also members of the specialist dormitory. These colleges are the SZTE Eötvös Loránd College and the SZTE Móra Ferenc College. According to Section 12 (4) of the Government Decree, colleges and student residences operating as colleges may apply a different point system from other types of colleges. (65) According to its statement, in the case of the Eötvös Loránd College, data management does not take place via the Modulo interface, but rather the applicant must fill out a form for the college admission procedure, which will enable him to initiate the procedure. The completed forms are only used in the admission procedure. Those who are not invited to the oral audition or to the talent development camp organized for 20 talented students who have just graduated from high school, the so-called "HÍD camp", held in the summer, will have their forms destroyed at that stage of the admissions process. Being a vocational college, the social/financial situation of the applicants is not examined, and no social situation assessment is carried out. Only data related to the identification of the applicants, their contact with them, and their educational qualifications and study results are requested on a voluntary basis. No personal data, including proof of income, is requested for their relatives or those living in the same household. For data security reasons, the processed personal data of those not invited to the oral audition is deleted during the admissions process, and for the others, when the process is closed. The admitted students are included in the dormitory module of the Neptun system, and their data is stored there. The data of the applicants can be accessed by the members of the board of trustees of the college, all of whom carry out their activities at the request and by appointment of the lecturers and vice-rectors of SZTE. No data processor is used to process the data. (66) According to the statement of SZTE, the Móra Ferenc College also has independent admission decision-making authority, but the admission procedure – similarly to other colleges – takes place through the Modulo system. The data management of the admission procedure of the Móra Ferenc College differs from the general one in that in the case of first-year students, social situation is not taken into account at all, while in the case of senior students, social situation is only taken into account to a very minimal extent, and the college decides on admission based on the admission and academic results, as well as student activity. 24
I I I . 2 . D e s t a t i o n s f o r m a n t i o n s i n g the a c t i o n p r o c e d t i o n s
(67) SZTE registered under the number NAIH-10128-2/2025 dated 12 May 2025, registered under the number NAIH-10128-4/2025 dated 18 July 2025 and registered under the number NAIH-10128-11/2025 dated 25 November 2025. submitted the following in its submissions filed under number:
(68) SZTE supplemented its two statements made during the data protection regulatory audit with the fact that SZTE abolished the faculty dormitories in 2022, and since then all of them have been under the supervision of the SZTE Education Directorate. Therefore, the dormitory admission procedure was carried out uniformly during the period affected by the regulatory procedure.
(69) According to its statement, the National Act on the Protection of the Rights of Persons with Disabilities and the Government Decree give specific authorization to higher education institutions, including SZTE, to process personal data related to the dormitory admission procedure and dormitory placement. In addition to these regulations, it was equally mandatory for all SZTE dormitories to apply the provisions of the relevant internal regulations (such as the Dormitory Regulations and the Points Regulations). Furthermore, SZTE emphasized that all applicants are required to fill out a general social situation assessment form with the same content and must accept the statements included in it. The admission procedure of the Eötvös Loránd College is different in that no social situation assessment is carried out during the admission process, and the admission procedure does not take place on the Modulo platform where the other colleges are. (70) According to its statement, during the college admission procedures related to the 2022-2024 academic years, SZTE strived to carry out data management activities based on the authorization and regulations of the National Pensions Act, the Government Decree, and the relevant internal regulations for the purpose of properly assessing applications and providing dormitory accommodation to the most needy students by assessing and taking into account their social situation. SZTE emphasized that the intention of SZTE can be completely ruled out in relation to data processing that may be established during the official investigation and that is deemed unlawful. (71) The information of the applicants is guaranteed by the fact that the applicant can only submit the data form after actively accepting the four declarations on the general social situation assessment form – including the “Declaration 04” regarding data processing and modified since the examined period as previously presented. This built-in function of the Modulo interface for uploading applications ensures that the applicant cannot proceed to filling out the dormitory application form without ticking the checkbox corresponding to the consent declaration. (72) According to the SZTE statement, access to personal (including special) data uploaded during applications is limited, and only SZTE students who carry out the assessment and are commissioned by EHÖK have access to them. In addition, they may only start the assessment tasks after signing the confidentiality declaration. However, after the assessment, their access rights will also cease, and only the EHÖK reimbursement officer will have access to the data, but he or she may only process these data for specifically defined purposes, such as investigating the appeal submitted by the data subject or making the data available to the Authority during the current data protection procedure. (73) In addition, SZTE submitted that the application procedure takes place on the closed online Modulo interface, which is not operated by an external data processor, but by ISZI itself, and is therefore protected from external, unauthorized access. The ISZI employees operating the interface have also signed a confidentiality declaration regarding data protection. In accordance with the data saving principle of the General Data Protection Regulation 25 and the data protection regulations of SZTE, Modulo is being developed in such a way that the principle of differentiated upload applies instead of the principle of mandatory attachments to the form. One of the goals of this development is that applicants only need to upload relevant certificates and documents supporting their declaration to the interface, and only the part of them that is relevant for the assessment. Furthermore, the content of the general social situation assessment form and the requested certificates are being reviewed and modified and developed in accordance with the provisions of the General Data Protection Regulation and the ASZ. (74) According to the SZTE statement, the dormitory admission procedure for students in higher years began in May 2022, while for first-year students it will only begin in August 2022. Therefore, in May and June 2022, SZTE applied the dormitory regulations, which were amended several times and were in force between 1 July 2001 and 27 June 2022, and then the regulations dated 27 June 2022 and in force from this date. SZTE sent the amended version of the regulations on 24 September 2007. (75) According to the statement of SZTE, it also applied the Points Regulations dated 2011 during the entire period under review (academic years 2022-2024), which it also sent to the Authority. (76) Furthermore, according to its statement, SZTE applied the previous regulation on the electronic application system for the regular social scholarship application, which was in force between 25 November 2013 and 30 October 2023, during the dormitory admission procedures, prior to the entry into force of the new SZTE regulation on the electronic application system for the regular social scholarship application on 30 October 2023, which was also sent to the Authority. (77) SZTE stated that it updated the given list of certificates in accordance with the dating criteria in each semester affected by the investigation. The following text regarding documents issued abroad or in a foreign language has been changed in terms of content:
The original text content:
"In the case of documents issued abroad or in a language other than Hungarian, in addition to the document, a Hungarian translation prepared or certified by the Foreign Affairs Committee (or translation agency) of the SZTE EHÖK shall be attached. The Foreign Affairs Committee of the SZTE EHÖK shall translate the documents free of charge. (szteeehokkb@gmail.com)"
The amended text content:
"In the case of documents issued abroad or in a language other than Hungarian, in addition to the document, a Hungarian translation prepared or certified by the Foreign Affairs Committee (or translation agency) of the SZTE EHÖK shall be attached. The Foreign Affairs Committee of the SZTE EHÖK shall be attached free of charge. (kulugy.ehok@szte.hu)"
(78) Furthermore, in accordance with the dating criteria, the NAV and the pension provider The reference to the calendar year of certificates was updated for each new semester. SZTE sent the certificate lists for the four semesters covered by the period under review.
(79) According to the statement of SZTE, the number of applications for dormitory admissions has varied from period to period. However, in each admission period, approximately 20% of the applicants selected the category of preference due to health status and uploaded a certificate or other document regarding their health status. SZTE sent ten copies of the documents accepted as supporting evidence of the applicant's serious, long-term illness in a non-anonymized form during the period under review. The certificates include five expert opinions, two outpatient forms and three certificates issued for illness, each containing 26 facts and descriptions of the affected person's health status and illness, while one certificate only provided the BNO code of the illness, without further details.
(80) According to the SZTE statement, in connection with the health condition of the applicant's relative, the SZTE asks about the serious illness of the dependent(s) living in the same household on the general social situation assessment form, and the document(s) certifying this fact must be uploaded when submitting the application. The SZTE stores the certificates on the Modulo interface and deletes them 5 years after they were uploaded. After the admissions assessment, only the EHÖK reimbursement officer has access to these certificates for the purpose of conducting any appeal or subsequent verification procedure. (81) According to the SZTE statement, the exact name of the disease is not required. The certification document must only contain the name of the disease or the part certifying the fact of the serious or long-term disease. The applicant may cover up the other parts. However, the applicant who uploads the document usually does not redact the data and uploads the full certificate to the interface. Therefore, SZTE can only ensure the protection of this sensitive personal data by limiting the number of persons who have access to this data for the purpose of assessment to the narrowest possible circle. In this regard, SZTE referred to its previous statement submitted during the official inspection, in which it explained in detail who is entitled to access this data and how. (82) According to SZTE's statement, in each admission period, approximately 20% of applicants selected the category of preference due to the health status of the applicant's relative living in the same household with him or her, and uploaded a certificate or other document regarding the health status of their relative. (83) SZTE also sent ten copies of documents accepted as proof of the serious, long-term illness of the applicant's relative in a non-anonymized form during the period under review. The certificates include five certificates of a permanently ill or severely disabled child, an expert committee opinion on the qualification of altered working capacity and the determination of benefits for a person with altered working capacity, a specialist doctor's report, an outpatient form, a decision made in a family support case, and an outpatient specialist care form, all of which contain the fact and description of the health condition and illness of the person concerned, one certificate only contains the BNO code of the illness, without further details. (84) SZTE, according to its statement, provides applicants with the opportunity to remove unnecessary personal data, and applications will not be rejected even if the certificate contains the appropriate and necessary data. Information such as name, date and signature are required for all documents, and the existence of a part supporting the essence of the document is also required (for example, in the case of an income certificate, the net earnings; in the case of a health certificate, the fact of the health condition). (85) SZTE also stated that in the case of declarations, it considered it necessary to indicate the identity card numbers of the witnesses in the period under review in order to ensure the official format, legal certainty and the avoidance of abuse. (86) According to SZTE’s statement, pursuant to Section 18(1)(f) of the Higher Education Act, the higher education institution processes data “necessary for establishing, assessing and verifying the entitlement to benefits provided for in the legislation and in the organisational and operational regulations of the higher education institution”. The Higher Education Act According to Annex 3, point 1, subparagraph (b), the higher education institution may process data on student benefits, data necessary for assessing eligibility for benefits (social situation, parents’ data, maintenance data). Furthermore, it may process “in the case of providing student or housing support, if the student is entitled to infant care fees, childcare assistance, childcare allowance, childcare fee, regular child protection allowance, or due to his/her disadvantaged situation, the data on these fees and allowances.” (Nftv. Annex 3, point 1, subparagraph (g)). Based on the above, SZTE processed the personal data on the address card, including the personal identification number, on the legal basis of performing a task in the public interest. SZTE further stated that in order to avoid possible abuses, it was necessary to upload the address cards to the application interface, and in the case of persons appearing on the address certificate submitted by the applicants, the authenticity of the document was supported during the period under review. (87) SZTE reiterated that, in accordance with the principle of data saving, the IT development of the Modulo interface is in progress so that it is possible to upload attachments in a differentiated manner. For example, once it turns out during the completion of the social situation assessment form that the parent's net income exceeds the required minimum, it will no longer be necessary to upload any additional income-related documents. (88) According to the statement of SZTE, during the period affected by the procedure, during the dormitory admission procedure, in order to assess the income situation of the household, the following data was processed regarding the breadwinner or dependent persons who (actually) live together in the property at the student's address, have a registered or registered place of residence there, and the following documents were requested from the applicants to verify this data: - in the case of an employee, an employer's income certificate, which includes the average income of the last three months in monthly amounts, calculated net, in Hungarian forints; in the case of a new employee, an employment contract
- in the case of an entrepreneur, an income certificate for the given year issued by the National Tax Agency
and the individual entrepreneur certificate or other relevant certificate
- in the case of a primary producer, an income certificate for the given year issued by the National Tax Agency
and the primary agricultural producer certificate
- in the case of an old-age pensioner, a pension slip issued by the pension provider or
a certificate issued by any authorized body
- in the case of a disability pensioner, a certificate issued by the pension provider or other authorized body
- in the case of a registered unemployed person, a certificate issued by the labor authority on the fact of unemployment, and a certificate issued by the body authorized to pay benefits on the benefits (or lack thereof)
- in the case of an unregistered unemployed person, a declaration made by the applicant or the breadwinner before a notary public and certified by a notary public, stating the legal basis on which the income is earned for the daily living essential living conditions - in the case of other "earning activities" or income (e.g. GYES, GYED, family allowance, care allowance, alimony), a certificate issued by the authorized body, from which the legal title and amount of the other income can be established without any doubt. (89) According to the statement of the SZTE, this does not include the data processed by the SZTE in cases where the applicant student did not live in a joint household as defined in the Tbj. during his or her studies. These data were also taken into account when assessing the application. To document this, a certificate issued by the district office's customer service regarding the marital status of single/unmarried had to be uploaded to the platform. After April 29, 2024, a declaration made before a notary and certified by him or her was required to prove self-supporting status. 28
(90) SZTE submitted that Annex 1 to the Scoring Regulations contains the scoring system for applicants with a family background and for self-supporting applicants, detailing the factors that can be taken into account during the assessment, both income-dependent and income-independent, as well as the circumstances that establish the entitlement to subjective points that can be awarded in both cases. The proof of the existence of these factors justified the request for the supporting documents detailed above. Regarding the uploading of supporting documents to Modulo, SZTE submitted that in several cases the applicant also uploaded documents and certificates to the interface that were not requested by SZTE. SZTE could only ensure the protection of the personal data contained in them by deleting the documents concerned immediately after detection. Before submitting the general social situation assessment form, applicants must, among other things, check (i.e. actively accept) the following declaration regarding the documents to be uploaded: "I acknowledge that scanning of documents in color and/or black and white (color and black and white, or mixed colors) is acceptable; and that the student must have an original copy of the scanned documents, which the student must present and make available in original copies at the request of the person participating in the assessment/control of the regular social scholarship at any time during the semester concerned and for five years thereafter. I declare that the data and facts indicated by me on the application form are true, reflect the situation existing on the date of submission of the application and provide complete information on the individual issues, and I further acknowledge that the untruthfulness or incompleteness of the data, facts, and certificates shall be the responsibility of the may entail a procedure in accordance with the relevant regulations and higher laws.”

(91) According to the statement of the SZTE, § 4 of the Scoring Regulations details the admission procedure and the previously described roles and tasks of the staff participating in the various committees.
(92) According to the statement of SZTE, the legal basis for checking and processing personal data included in the documents requested to prove the income status of relatives is ensured by the relevant provisions of the Nftv. and the Government Decree. According to the subsection 1. be) of Annex 3 of the Nftv. on the management of student data, the higher education institution may process data on student benefits, data necessary for assessing eligibility for benefits (social situation, parents' data, maintenance data). Furthermore, it may process “in the case of providing student or housing support, if the person is entitled to a childcare fee, childcare assistance, childcare allowance, childcare fee, regular child protection allowance, or due to his/her disadvantaged position, the data on these fees and subsidies.”
(Nftv. Annex 3, subsection 1. g)).
(93) According to the statement of SZTE, the legal basis for the registration and storage of data is provided by the provision of the Nftv., according to which the higher education institution registers in its study system – among others – personal and special data that are indispensable for “establishing, assessing and verifying the entitlement to benefits provided for in the legislation and in the organizational and operational regulations of the higher education institution” (Nftv. Section 18 (1) paragraph f)). Section 21 of the Government Decree authorizes higher education institutions to process the personal data of the applicant’s relatives or natural persons living in the same household, as specified in the decree, within the framework of the dormitory admission procedure, in order to assess social need. According to Section 21 (1) a) of the Government Decree, when assessing the student's social situation, "the number of people living together in the property at the student's address, registered there or having a place of residence, and their income situation" must be taken into account. If the student does not live in a common household as defined in the Tbj.
during his studies, i.e. is self-sufficient, his expenses must be taken into account when assessing the social situation. (Section 21 (1) c)
of the Government Decree). Section 21 (2) of the Government Decree also regulates the method of calculating income.
Based on this, "when calculating income, the average of the last three months shall be taken into account for income that can be measured regularly on a monthly basis, and the twelfth of the last one year shall be taken into account for other income. At the student's request, proven future income changes shall also be taken into account."
(94) Section 21 (3) of the Government Decree authorizes that “the detailed rules for determining the social situation of the student shall be determined by the institution’s compensation and benefit regulations.” According to the statement of SZTE, this is provided for by two internal regulations: Regulations on the electronic application system for applying for regular social scholarships, and in the case of dormitories, the Points Regulations contain the relevant detailed rules. (95) Based on all of this, according to the statement of SZTE, Article 6 (1) (e) of the General Data Protection Regulation (performance of a task in the public interest) is the legal basis for data processing for the processing of personal data of relatives (such as parents or other relevant third parties). I I I . 3 . D o c t i o n s issued by the University of Szeged
(96) The University of Szeged attached the following documents to its response letters in the official inspection and the official procedure:
- Dormitory Regulations of the University of Szeged (Dorm Regulations; 2007,
2022.06.27.)
- Regulations of the University of Szeged on the Scoring System, Procedural and Organizational Order of Assessment of Dormitory Applications (Dorm Points Regulations; 2011)
- University of Szeged Student Government: Regulations on the electronic application system for applying for regular social scholarships
(November 25, 2013, October 30, 2023)
- Regulations by the students of the University of Szeged on fees and reimbursements to be paid, as well as on certain grants that can be provided for them (Student Benefits Regulations; June 27, 2022)
- Data Protection Regulations of the University of Szeged (ASZ; April 29, 2024)
- General social situation assessment data sheet
- FAQ - General social situation assessment data sheet
- Modulo 2 Dormitory application case description v.1.0. 20220722
- Certificate lists (May 2022, November 2022, May 2023, November 2023)
- List of documents requested for the 2022/2023. I. semester
- List of documents requested for the 2022/2023. II. semester
- List of documents requested for the 2023/2024. List of documents requested for the first semester
- List of documents requested for the second semester of 2023/2024
- Documents for the first semester of the 2022/2023 academic year, the second semester of the 2022/2023 academic year, the first semester of the 2023/2024 academic year and the second semester of the 2023/2024 academic year, with the exception that in certain semesters
other documents were also uploaded, which SZTE also
sent to the Authority:
• Simplified list of certificates
• List of certificates including the declarations to be filled in
• Point system,
• Subjective point system,
• Per capita income,
30
• Date criteria,
• Guide to the Modulo system,
• Frequently asked questions (FAQ), etc.
- Call for applications
- Confidentiality statement (for SZTE employees)
- Data protection and confidentiality statement (for SZTE EHÖK employees)
- University of Szeged Information Security Policy (May 31, 2021)
- Certificate_s_1
- Certificate_s_2
- Certificate_s_3
- Certificate_s_4
- Certificate_s_5
- Certificate_s_6
- Certificate_s_7
- Certificate_s_8
- Certificate_s_9
- Certificate_s_10
- Certificate_h_1
- Certificate_h_2
- Certificate_h_3
- Certificate_h_4
- Certificate_h_5
- Certificate_h_6
- Certificate_h_7
- Certificate_h_8
- Certificate_h_9
- Certificate_h_10
- The University of Szeged Eötvös The following documents of the Loránd College of Specialization:
• Organizational and
Operational Regulations of the Eötvös Loránd College of the University of Szeged
• HÍD Application Form
• Application Form (“A”)
• Application Form (“B”)
• Application Form (“C”)
I I I . 4 . A n d e f i c a l l i t i o n s (97) The University of Szeged is one of the most prestigious higher education institutions in Hungary. According to the information available on the university’s website, “the institution, which has been at the forefront in terms of the number of applications for admission for years, has been guaranteeing quality knowledge and a marketable degree to its approximately 21,000 students, including more than 4,000 foreign students.” 2
(98) According to the organizational and operational regulations3 (hereinafter: SZMSZ) available on its website, SZTE is a state-recognized private higher education institution operating as a public benefit organization, maintained by the University of Szeged Foundation, and performing public tasks. Furthermore, according to Section 7 of Chapter XX of the SZMSZ, SZTE does not qualify as a budgetary body4.
2 https://u-szeged.hu/bemutatkozas
3 https://u-szeged.hu/szabalyzatok/szte-szmsz-szervezeti-260130
4 Chapter XX of the SZMSZ Chapter 7, point 7: “As a result of the transfer of the right of maintenance of the University of Szeged to the Foundation for the University of Szeged on 1 August 2021 – the University’s transformation from a state higher education institution operating as a budgetary body into a private higher education institution
31
(99) Based on the statements presented by SZTE and the documents sent by it, it can be stated that
the purpose of data processing related to dormitory admission is to properly assess applications, to provide dormitory accommodation to the most needy students by assessing and taking into account their social situation.
(100) The first step in the admission procedure, which takes place electronically, on the Modulo interface, is to fill in the general social situation assessment form available on the electronic interface, since the admission scoring is based on the points obtained on the general social situation assessment form based on the student’s social situation. The completion of the social situation assessment form in the absence of it, the dormitory application cannot be submitted.
(101) According to the SZTE statement, the legal basis for data processing related to the dormitory admission procedure is the performance of a task in the public interest, Article 6 (1) e) of the General Data Protection Regulation, taking into account the provisions of the Nftv. and the Government Decree referred to.
(102) The further legality of the processing of special data is ensured by Article 9 (2) b) and g) of the General Data Protection Regulation. All this is to ensure equal opportunities for disabled applicants. It is necessary to name serious, long-term illnesses, as different points are awarded for different illnesses. According to the SZTE, however, the student consents to the data processing by accepting the declaration on the data sheet, without which the data sheet cannot be submitted.
(103) The personal data of the applicants’ relatives and those living in the same household Regarding the processing of personal data, Section 21 (1) of the Government Decree authorizes higher education institutions to process the personal data of the applicant's relatives or natural persons living in the same household as specified in the decree in the framework of the dormitory admission procedure, in order to assess social need. SZTE bases the processing of the personal data of the applicant's relatives and persons living in the same household on this and on Article 6 (1) e) of the General Data Protection Regulation. (104) In contrast, the Dormitory Regulations of 27 June 2022, Part VI. Title 2 – “Conditions and procedure for dormitory admission” – under the “Submission of applications” subheadings 2.4. and 2.5. and the “Declaration 04” at the bottom of the general social situation assessment form available on the Modulo interface, which must be accepted by means of a checkbox and described in paragraph (41) of this decision, the data processing related to the dormitory admission procedure and the social situation assessment is based on consent. (105) In this regard, SZTE stated that, based on the consent of the data subject, SZTE processes the e-mail address and telephone number data for the purpose of maintaining contact with him/her, and in the admission procedure to the Eötvös Loránd College of Professional Studies, data related to the identification of applicants, maintaining contact with them, and their educational qualifications and study results are requested on a voluntary consent basis. In addition, SZTE did not specify any other data processing based on consent in connection with the dormitory admission and social situation assessment procedure.
(106) The social situation assessment forms are reviewed by the student members of the EHÖK Benefits and Reimbursement Committee, who, during the review, shall apply the internal regulations in force at the University at the time of the review to all documents and in connection with any change in legal status in the documents, provided that they do not conflict with other legal regulations, until a different provision is issued or the regulation is amended or repealed.”

32
have access to all personal data – including sensitive data. In connection with the assessment of the income situation, the tasks of the assessors include examining the content and formal requirements of the documents. After the assessment, the social
scores are accessed by the persons participating in the member dormitory committees, also known as the dormitory data processors, who no longer see the social data, only the score that the student receives. The end of the dormitory admission takes place in the dormitories, and the dormitory committees are responsible for making the final decision. The members of this committee are: the director of the given member dormitory, two dormitory teachers and two dormitory committee secretaries, who are SZTE students. They have access to the data provided to them, and their task is to make the final decision.
(107) Before the assessment of the social situation assessment data sheet, all SZTE students participating in the assessment process participates in training that ends with a test, followed by practical training.
After successfully completing this, they will be granted access to the social situation assessment data sheets on the Modulo interface and to perform assessment tasks. The assessing students can view the data on the form and the documents attached by the applicant,
however, after the assessment, they will no longer be able to view this data, as the access rights will be deleted. These data and documents will be stored in the Modulo system for a further five years and will then be deleted.
After the assessment, after the access of the students entrusted with the assessment is also deleted,
only the EHÖK reimbursement referent will have access to the data and certificates stored in Modulo, for the purpose of conducting any appeal or subsequent verification procedure.
(108) The dormitory admission procedure for students entering higher years has already It started in May 2022, while for first-year students it started only in August 2022. Therefore, in May and June 2022, SZTE applied the Dormitory Regulations, which were amended several times and were in force between July 1, 2001 and June 27, 2022, and then the regulations dated June 27, 2022 and in force from this day. SZTE sent the amended version of the regulations on September 24, 2007.
(109) The Dormitory Regulations contain the general rules of the dormitory admission procedure and the rules relating to the submission of applications.
(110) The relevant parts of the Dormitory Regulations dated June 27, 2022 are as follows:
I. Introductory provisions, main heading 2. Purpose of the Regulations, subheading 2.2. According to: “The University shall ensure the maintenance, operation and development of the dormitories.”
According to VI. Conditions and Procedure for Dormitory Admission, Title 1. General Rules, Subheading 1.1
: “The procedural and organizational order of dormitory admission is determined by the regulations of SZTE on the scoring system for dormitory applications, the procedural and organizational order of its assessment. The specialized dormitories may operate their own admission system.”
According to VI. Conditions and Procedure for Dormitory Admission, Title 1. General Rules, Subheading 1.6
: “During the dormitory admission procedure, the Member Dormitory Committee shall decide on admission applications and appeals in the first instance. The Dormitory Board of Directors shall decide on legal remedies.”
According to VI. Conditions and Procedure for Dormitory Admission, Title 2. Submission of applications, 2.4-2.6.
according to points: “2.4. By submitting the application, the applicant acknowledges and consents that the university organizational units and individuals competent for the assessment of the application will process, store and use the personal data included in the application in accordance with the provisions of Act CXII of 2011 on the right to information self-determination and freedom of information to the extent, manner and time necessary for determining the basic support and regular social scholarship grants specified in the Student Benefits Regulations (hereinafter: HJSZ), if the applicant also submits an application for these grants for the period concerned by the dormitory application, or if this period is an academic year, for its first semester. 2.5. By submitting the application, the applicant declares whether he consents to the processing of his personal data included in the application by the university organizational units and individuals competent for the assessment of the application for the purpose of the waiting list procedure for the processing of personal data.
If you do not consent to the processing of your personal data for the purpose of the waiting list procedure, your application cannot be assessed and shall be deemed as if you had not submitted your application.
2.6. In order to verify the authenticity of the data or to more accurately assess the applicant's social situation, additional certificates may be requested from the applicant.”
According to point 1 of subsection 1 of Title IX. Final Provisions, “The form templates related to the operation and procedures of the colleges are contained in the relevant joint instruction of the rector and chancellor.”
(111) Relevant part of the 2007 Dormitory Regulations:
§4. According to paragraphs (16)-(17) under the heading on dormitory accommodation: “(16) The dormitory committee shall conduct the admission based on a points system – which can be found before the application is submitted. The main criteria for the assessment during the admission procedure are:
When assessing the student’s social situation, the following shall be taken into account:
a) the number of people living in a common household with the student as defined in Act LXXX of 1997 on persons entitled to social security benefits and private pensions and on the coverage of these services, and their income situation,
b) the distance between the place of training and the place of residence, the duration and cost of the trip,
c) if the student does not live in a common household as defined in the Tbj. during his studies,
the costs thereof,
d) the amount of money that the disabled student must spend on special purchase and maintenance of equipment, special travel needs, and the use of a personal assistant or sign language interpreter, e) the health expenses regularly incurred due to the health condition of the student or a close relative living in the same household, f) the number of dependents living in the same household with the student, with particular regard to the number of children living with the student, g) the costs associated with caring for a relative in need of care. When calculating income, the average of the last three months for regularly measured monthly income must be taken into account, and for other income, the twelfth of the last one year. At the student's request, proven future income changes must also be taken into account. A dormitory operating as a specialist dormitory may also apply a different assessment criteria system. The scoring system must be made available for students to familiarize themselves with before submitting applications for admission. (17) Dormitory applications In the assessment, preference shall be given to disadvantaged students who cannot start or continue their higher education studies due to lack of dormitory accommodation. A disadvantaged student is a student who: a) was placed under the protection of the registrar during his/her secondary education due to his/her family circumstances or social situation, or b) was regularly paid child protection benefits, was entitled to regular child protection benefits, or was in state care.” (112) In addition, SZTE applied the Scoring Regulations of 2011 throughout the entire examination period (academic years 2022-2024). According to its preamble: “the Senate of the University of Szeged, in accordance with Act CXXXIX of 2005 on Higher Education (Article 52; hereinafter: the Act on Higher Education), Government Decree 51/2007 (III.26) on the benefits of students participating in higher education and certain payments to be paid by them (Articles 12 (1), 21 (4); hereinafter: Government Decree) and the regulations on the fees and payments to be paid by students of the University of Szeged and certain subsidies to be provided to them (Article 20; hereinafter: Student Benefits Regulations), has established the scoring system for dormitory applications and the procedural and organizational criteria for the assessment of applications for students and applicants who have been admitted or accepted to the University of Szeged (hereinafter: SZTE).” shall be determined as follows – following the opinion of the University Student Benefits and Reimbursement Committee and the Dormitory
Council.”
(113) The Points-Based Regulations also contain the detailed rules of the dormitory admission procedure, covering the fact that in the points-based system, a certain part of the points are awarded to the applicant for his/her social
situation. The regulations also contain, among other things, the rules for calculating the points that can be awarded for the applicant’s social
situation.
(114) Section 20 of the Regulations on Fees and Reimbursements to be Paid by SZTE Students, as well as Certain Grants Available to Them, dated 27 June 2022, provides for dormitory accommodation as follows: “dormitory accommodation can be obtained through an application. The detailed rules of the dormitory admission procedure and accommodation are contained in Chapter VI of the SZTE Dormitory Regulations.”
(115) According to this regulation, Section 29 also provides for the dormitory fee, however, it does not contain any information related to data protection.
(116) Regarding the electronic application system for applying for the regular social scholarship, SZTE applied two regulations during the period under review. The previous one was in force between 25 November 2013 and 30 October 2023, while the new one came into force on 30 October 2023. The two regulations – as well as the Points Regulation – contain how many points a student can receive for his/her social situation. According to the regulation dated 30 October 2023, SZTE “does not take into account in its point calculation family members who contribute to the family income (e.g. grandparents, earning siblings, etc.) among those living in the same household”. Additionally, the rules regarding the points that can be awarded have not changed in the two regulations.
(117) The lists of certificates contain a list of certificates acceptable for the general social situation assessment. Since the lists of certificates do not differ in any other way than those specified in paragraph (77), the Authority therefore understands by lists of certificates all lists of certificates of the examined period. The certificates are included in paragraph (45) of this resolution.
(118) In order to guarantee the security of personal data processed during the dormitory admission procedure, SZTE stores all personal data of the data subjects in the closed, internal system, Modulo. Access to the system is determined by strict authorization rules, which SZTE presented to the Authority. SZTE employees participating in data management perform their work under a strict obligation of confidentiality.
(119) Regarding the information of applicants on data processing related to the dormitory admission procedure, applicants can consult the Dormitory Regulations, the Points Regulations, the call for applications for the current semester published by the University Student Government on the online platform, and the following documents related to it:
- Simplified list of certificates,
- List of certificates including the declarations to be filled in,
- Points system,
35
- Subjective points system,
- Per capita income,
- Date criteria,
- Guide to the Modulo system,
- Frequently asked questions (FAQ).
(120) The main groups of cases that must be taken into account and proven when assessing the applicant's social situation during the dormitory admission procedure, based on the Points-Based Regulations, the regulations on the electronic application system for applying for regular social scholarships of SZTE, the certification lists and the statements of SZTE, are the following:
- proof of address and place of residence
- benefits not counted as income
- preferential circumstances
- data of breadwinners living in a common household
- data of dependents living in a common household.
(121) During the period under review, a total of 13,754 admissions were made to SZTE dormitories, each of which included a social situation assessment. This number does not correspond to the total number of affected persons, given that a person affected person could be admitted in each semester, so in such cases their data could have been recorded more than once. Taking this circumstance into account, the number of people affected by data processing can be considered high, not including how many students filled out the general social situation assessment form in the examined period to apply for other benefits outside the dormitory admission procedure, such as the regular social scholarship, since SZTE does not have separate data on the number of people who filled out the social situation assessment form.
I V . APPLIED L A G E R E S U R E S (122) According to Section 2 (2) of the Infotv., the General Data Protection Regulation shall apply to data processing falling within the scope of the General Data Protection Regulation with the additions specified in the provisions specified therein.
(123) The Infotv. Pursuant to Section 60(3), the Authority shall initiate a data protection authority procedure ex officio if, based on its investigation, it establishes that a legal infringement has occurred or there is an imminent threat of such an infringement in connection with the processing of personal data and that a fine may be imposed in accordance with the provisions of the General Data Protection Regulation.
(124) Pursuant to Section 7 of Act CL of 2016 on General Administrative Procedure (hereinafter referred to as the General Data Protection Regulation), the provisions of the General Data Protection Regulation shall apply to the data protection authority procedure.
Pursuant to Section 103(1) of the General Data Protection Regulation, in the official procedure initiated ex officio, the provisions of the General Data Protection Regulation relating to procedures initiated upon request shall apply with the deviations set out in Sections 103 and 104 of the General Data Protection Regulation.
(125) According to Article 4(1) of the General Data Protection Regulation: “personal data” means any information relating to an identified or identifiable natural person (the “data subject”); an identifiable natural person can be identified, directly or indirectly, in particular by reference to an identifier such as a name, a number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
(126) According to Article 4(2) of the GDPR: “processing” means any operation or set of operations which is performed upon personal data or upon sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.” (127) According to Article 4(7) of the GDPR: “controller” means the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union or Member State law, the controller or the specific aspects relating to the designation of the controller may also be determined by Union or Member State law.”
(128) Pursuant to Article 5(1)(a), (b) and (c) of the General Data Protection Regulation:
Personal data:
a) shall be processed lawfully and fairly and in a manner transparent to the data subject (‘lawfulness, fairness and transparency’);
b) personal data shall be collected:
only for specified, explicit and legitimate purposes and shall not be processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes (‘purpose limitation’) shall not be considered incompatible with the initial purpose in accordance with Article 89(1)

(c) be adequate and relevant in relation to the purposes of the processing and limited to what is necessary (‘data economy’).

(129) According to Article 6(1) of the GDPR: “The processing of personal data shall be lawful only if and to the extent that at least one of the following is met:
a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
b) the processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
c) the processing is necessary for compliance with a legal obligation to which the controller is subject;
d) the processing is necessary to protect the vital interests of the data subject or of another natural person;
e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
f) the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the processing of personal data. necessary for the protection of the rights of a person, in particular where the person concerned is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the exercise of their tasks. (130) According to Article 9(1) of the GDPR: “The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health and personal data concerning a natural person’s sex life or sexual orientation shall be prohibited.” (131) According to Article 9(2)(b) and (g) of the GDPR: “Paragraph 1 shall not apply where:
[…]
37
b) processing is necessary for the performance of obligations or the exercise of specific rights of the controller or of the data subject arising from legal provisions governing employment, social security and social protection, where Union or Member State law also provides for appropriate safeguards for the protection of the data subject’s fundamental rights and interests, or collective agreements under Member State law;
[…]
g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law, which is proportionate to the aim pursued, respects the essence of the right to the protection of personal data and provides for suitable and specific measures to safeguard the fundamental rights and interests of the data subject;
[…]”
(132) According to Article 13 of the GDPR: “(1) Where the data subject is personal data concerning the data subject are collected from the data subject, the controller shall provide the data subject with all of the following information at the time of obtaining the personal data:
a) the identity and contact details of the controller and, where applicable, of the controller's representative;
b) the contact details of the data protection officer, where applicable;
c) the purposes of the intended processing of the personal data and the legal basis for the processing;
d) in the case of processing based on point (f) of Article 6(1), the legitimate interests of the controller or a third party;
e) where applicable, the recipients or categories of recipients of the personal data, if any;
f) where applicable, the fact that the controller intends to transfer the personal data to a third country or to an international organisation, and whether or not the controller has obtained an adequacy decision or has taken a decision as referred to in Article 46, Article 47 or the second subparagraph of Article 49(1) in the case of data transfers, an indication of the appropriate and suitable safeguards and a reference to the means of obtaining a copy of the data or their accessibility.
(2) In addition to the information referred to in paragraph 1, the controller shall, at the time of obtaining the personal data, provide the data subject with the following additional information in order to ensure fair and transparent processing:
a) the period for which the personal data will be stored or, where that is not possible, the criteria for determining that period;
b) the right of the data subject to request from the controller access to, rectification, erasure or restriction of processing of personal data concerning him or her and to object to the processing of such personal data, as well as the right of the data subject to data portability;
c) in the case of processing based on point (a) of Article 6(1) or point (a) of Article 9(2), the right to withdraw consent at any time, without prejudice to the right to the lawfulness of the processing based on consent before its withdrawal;
d) the right to lodge a complaint with a supervisory authority;
e) whether the provision of personal data is based on a legal or contractual obligation or is a prerequisite for entering into a contract, and whether the data subject is obliged to provide the personal data, and the possible consequences of not providing the data;
f) the fact of automated decision-making referred to in Article 22(1) and (4), including profiling, and at least in such cases, intelligible information on the logic involved and the significance and foreseeable consequences of such processing for the data subject.
(3) Where the controller intends to process personal data for purposes other than those for which they were collected, he shall, prior to the further processing, inform the data subject of that purpose and of any relevant additional information referred to in paragraph (2).
38
(4) Paragraphs (1), (2) and (3) shall not apply if and to the extent that the data subject already has the information.”
(133) According to Article 58(2) of the General Data Protection Regulation, the supervisory authority may, in the exercise of its corrective powers, for example:
b) order the controller or processor to comply with the data subject's request to exercise his or her rights under this Regulation;
c) order the controller or processor to comply with the data subject's request to exercise his or her rights under this Regulation;
d) order the controller or processor to bring its processing operations into compliance with this Regulation in a manner and within a specified period of time, as the case may be.
(134) Pursuant to Section 61(2) of the Infotv.: "The Authority may order the publication of its decision - by publishing the identification data of the controller or processor - if the decision affects a wide range of persons, by means of the activities of a body performing a public task brought in connection with, or the gravity of the infringement of the right that has occurred justifies the disclosure.
(135) Pursuant to Section 61(4)(b) of the Infotv., the amount of the fine may range from one hundred thousand to twenty million forints if the budgetary body obliged to pay the fine imposed in a decision taken in a data protection authority procedure
is a fine imposed in accordance with Article 83 of the General Data Protection Regulation.
(136) Pursuant to Section 71(2) of the Infotv.: “The Authority may use documents, data or other means of evidence lawfully obtained in the course of its procedures in other procedures.”
(137) Pursuant to the Nftv. According to Section 8(7): “In order to ensure the housing conditions of students, a dormitory may be operated as part of a higher education institution, or a student dormitory may be established as an institution not organizationally affiliated with the higher education institution. The student dormitory is a legal entity, operating as a budgetary or non-budgetary body, depending on the founder.”
(138) The Nftv. According to Section 41 (1): “The Government shall ensure equal opportunities for a) disadvantaged group of applicants and students, b) those on unpaid leave to care for their child, those receiving infant care allowance, adoption allowance, childcare allowance, child-rearing allowance, child-care allowance for home care of children, care allowance for home care of their child or childcare allowance, c) those belonging to the group of applicants and students with disabilities, d) those belonging to the group of applicants and students belonging to a nationality when determining the number of students supported by Hungarian state (partial) scholarships in higher education studies, and in the group specified in point d). (139) According to Section 2 (1) b) of the Government Decree, an orphan is a student under the age of 25,
whose both parents, or the unmarried, divorced or separated parent who lived in the same household, have died and have not been adopted.
(140) According to Section 2 (1) e) of the Government Decree, a family breadwinner: a student,
ea) who has at least one child,
eb) who is entitled to a care allowance pursuant to Act III of 1993 on Social Administration and Social Benefits.
39
(141) According to Section 2(1)(f) of the Government Decree, a large family is a student who
fa) has at least two dependent siblings or three children, or
fb) has at least two persons living in the same household with him/her, in addition to his/her breadwinner(s), whose monthly income does not reach the minimum wage, or
fc) is the guardian of at least two minor children.
(142) According to Section 4(4) of the Government Decree: “A student who is disadvantaged, an orphan, a breadwinner, or whose guardianship has ceased due to his/her coming of age may be exempted from the obligation to pay the dormitory fee due to his/her social situation. The institution may provide a discount or exemption from the dormitory fee for students who work in the dormitory, as specified in its compensation and benefits regulations.”
(143) According to Section 12 of the Government Decree: “Section 12 (1) Dormitory accommodation can be obtained through an application. Applications shall be decided on the basis of the points system specified in the compensation and allowance regulations. (2) The points system shall be made available for the students to familiarize themselves with before submitting applications. (3) The points system shall take into account the student’s social situation, academic performance, work done for the student community, work schedule of their training, exemption according to Section 4 (4), and if the student is to be given priority in the assessment of the dormitory application based on Section 41 (1) of the National Student Welfare Act, the existence of the conditions for giving priority specified in the National Student Welfare Act. (4) Dormitories and student residences operating as specialist dormitories shall also use a points system different from that specified in Section (3) may apply.
(5) Support for housing conditions shall be provided within the framework of social assistance.”
(144) According to Section 21 (1)-(2) of the Government Decree: “(1) When assessing the social situation of a student, the following shall be taken into account: a) the number and income of those living together in the property at the student’s address, registered there or having a place of residence, b) the distance between the place of training and the place of residence, the duration and cost of the trip, c) if the student does not live in a common household as defined in the Act on the Protection of Personal Data during his/her studies, the costs thereof, d) the amount of money that a disabled student must spend on the purchase and maintenance of special equipment, special travel needs, and the use of a personal assistant or a sign language interpreter, e) the health expenses regularly incurred due to the health condition of the student or a close relative living in the same household, f) the number of dependents living in the same household with the student, with particular regard to children who are dependent on the student for him,
g) the costs of caring for a relative in need of care.
(2) When calculating income, the average of the last three months shall be taken into account for income that can be measured regularly on a monthly basis, and the average of the last one twelfth of the last year shall be taken into account for other income. At the student's request, proven future changes in income shall also be taken into account.”
(145) Act XXXI of 1997 on the Protection of Children and the Administration of Guardianship According to Section 67/A (1)-(2) of the Act on the Protection of Children and Families (hereinafter referred to as the Act on the Protection of Children and Families): “(1) A child who is entitled to regular child protection benefits and a child who has reached the age of majority is considered to be in a disadvantaged position if one of the following circumstances applies: a) the low level of education of the parent or the foster parent, if it can be established from both parents raising the child together, the parent raising the child alone or the foster parent – based on their voluntary declaration – that they have at most a primary education when applying for regular child protection benefits, b) the low level of employment of the parent or the foster parent, if it can be established from any of the parents raising the child or the foster parent that they are entitled to the care of active-age people pursuant to Section 33 of the Act on the Protection of Children and Families or that they are not eligible to apply for regular child protection benefits. a person who has been registered as a jobseeker for at least 12 months within the 16 months preceding the date of the application,
c) the child’s inadequate living environment or housing conditions, if it can be established that the
child lives in a living environment declared as segregated in the integrated settlement development strategy for the settlement, or in semi-comfortable, uncomfortable or emergency housing,
or in housing conditions where the conditions necessary for his or her healthy
development are limited.
(2) A person with multiple disadvantages
a) is a child entitled to regular child protection benefits and a child who has reached the age of majority, in whose case at least two of the circumstances specified in points a)–c) of paragraph (1) exist,
b) a child taken into foster care,
c) a young
adult receiving aftercare and having a student or pupil status.”
(146) The Infotv. Pursuant to Section 61(2)(b), the Authority may order the publication of its decision – by publishing the identification data of the controller or the processor – if it was made in connection with the activities of a body performing public tasks.
V . Decision
V . 1 . The controller
(147) According to the definitions of the General Data Protection Regulation, a controller is a natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
(148) Regarding the person of the data controller, the Authority has established the following:
(149) Based on the quotations from the Dormitory and Scoring Regulations in paragraphs (109)-(113) of this resolution, SZTE determines the scoring system for dormitory applications
– including the social situation assessment – and the procedural and organizational
order for its assessment. SZTE also decides on the use of the form templates related to the operation and procedures of dormitories.
(150) Based on all of this, it can be stated that SZTE makes a decision on the data management related to the dormitory admission procedure, on what personal data can be processed to gain admission to the given dormitory, taking into account the provisions of the Nftv. and the Government Decree, and what forms and certificates containing personal data can be accepted during the procedure, taking into account that, based on paragraph 8 (7) of the Nftv., SZTE, as a higher education institution, is entitled to operate dormitories, while the Government
Based on Section 12(1) of the Regulation, applications shall be decided on the basis of the scoring system specified in the Reimbursement and Benefit Regulations.
(151) According to the statement presented in Section (94) of this Resolution, in the case of SZTE, the Reimbursement and Benefit Regulations are subject to two internal regulations, which fulfill the function of the Reimbursement and Benefit Regulations. These are the Regulations on the Electronic Application System for Regular Social Scholarship Applications, and, in relation to dormitories, the 
41 Scoring Regulations.
(152) Consequently, the Authority concludes that SZTE qualifies as a data controller within the meaning of Article 4(7) of the General Data Protection Regulation for the processing of data related to the dormitory admission procedure and the related social situation assessment.
V . 2 . P r o u s t o f d a t e r s t o f d a t i o n (153) Before starting its data management activity, the data controller must take into account what it intends to achieve, whether the processing of personal data is necessary to achieve its purpose, and if so, how the processing of the data serves the achievement of the purpose. The data controller must focus on defining a data scope that is aligned with and compatible with the purpose. The purpose must be described clearly, obviously, and in understandable language so that data subjects are aware of all the essential circumstances of the data management, the specific purposes, and the scope of data aligned with them. (154) It can be stated that SZTE, as the data controller, decided on the data management related to the dormitory admission procedure, as well as the social situation assessment that is closely related to it and forms part of it. The Nftv. and the Government Decree legitimizes the purpose of data processing, the dormitory admission procedure, since the Government Decree states that dormitory accommodation can be obtained through an application. Applications must be decided on the basis of the scoring system specified in the Reimbursement and Benefits Regulations. Section 12 (2) of the Government Decree stipulates that the social situation of the student must be taken into account as a criterion in the scoring system. The purpose and objectives of data processing are therefore legitimate, and data processing related to the dormitory admission procedure, which also includes a social situation assessment, complies with the principle of purpose-bound data processing regulated by Article 5 (1) (b) of the General Data Protection Regulation. (155) Since the two data processing, the dormitory admission procedure and the social situation assessment, are closely related, the social situation assessment is part of the dormitory admission procedure, one of its criteria, and although it is not mandatory, without it the student receives zero points in the dormitory admission procedure, the Authority examined both procedures in the present procedure.
V . 3 . L a g e t f o r d a t e r i a l g e n t o f d a t e r i a n d a t e r i a l (156) A further requirement for the lawfulness of data processing is that data processing can be carried out with reference to a legal basis pursuant to Article 6(1) of the General Data Protection Regulation.
(157) According to the statement of SZTE, the legal basis for data processing is the performance of a task in the public interest, i.e. Article 6(1) e) of the General Data Protection Regulation, taking into account the provisions of the Nftv. and the Government Decree referred to. However, SZTE also stated that during the dormitory admission procedure, its data processing activities also include the processing of personal data categories whose processing is based on the voluntary consent of the natural person concerned. In this regard, SZTE stated that, based on the consent of the data subject, SZTE processes e-mail address and telephone number data for the purpose of maintaining contact with him/her, and in the admission procedure to the Eötvös Loránd College of Professional Studies, data related to the identification of applicants, maintaining contact with them, and their school graduation and study results are requested on the legal basis of voluntary consent. In addition, SZTE did not name any other consent-based data processing in connection with the dormitory admission and social situation assessment procedure. 42
(158) According to the statement of SZTE, the further legality of the processing of the sensitive data of students and their household members is ensured by Article 9(2)(b) and (g) of the General Data Protection Regulation, as well as Section 21(1)(d) and (e) of the Government Decree, according to which, when assessing the social situation of the student, the health expenses regularly incurred due to the health condition of the student or his/her close relative living in the same household must be taken into account.
(159) Specifically regarding the request for medical certificates and the personal health data recorded therein, SZTE referred to Section 21 (1) e) of the Government Decree, according to which “When assessing the social situation of the student, the health expenses regularly incurred due to the health condition of the student or his/her close relative living in the same household shall be taken into account”, and it also referred to the fact that the suppression of various abuses also justifies the request for medical certificates. (160) However, in the Dormitory Regulations sent by SZTE on 27 June 2022, under Title 2, Conditions and Procedure for Dormitory Admission, Sections 2.4 and 2.5. points – paragraph (56) of this resolution – and the “Declaration 04” at the bottom of the general social situation assessment form available on the Modulo platform, which must be accepted via a checkbox – paragraph (41) of this resolution – the data processing related to the dormitory admission procedure and the social situation assessment is based on consent. In connection with the consent, SZTE stated that it processes certain data based on the consent of the data subject during the dormitory admission procedure, and that the consents – acceptance of checkboxes – on the Modulo platform serve to accept the declarations. (161) The 2007 dormitory regulations also listed the certificates that must be attached to the dormitory admission application without specifying the legal basis. (162) In relation to the processing of data necessary for the performance of a task in the public interest and the exercise of public authority as a legal basis for data processing, it can be stated that according to the domestic legal environment and the practice of the Constitutional Court, the fundamental rights of the data subject – including the right to informational self-determination – may be restricted by the state only to the extent necessary and proportionate, in order to enforce a fundamental right or protect a constitutional value, i.e. in the public interest. Therefore, the application of this legal basis requires that the data controller’s data processing activities necessary for the exercise of its public authority tasks and powers, or for the performance of other tasks carried out in the public interest, are based on a legal provision or an EU norm for a purpose based on public interest. However, this legal provision often only defines the public task, procedural scope and obligation of the data controller, and not the detailed rules of the related data processing operations. (163) The legal basis for data processing based on legal provisions defining the public tasks of a controller exercising public authority or performing public tasks is therefore Article 6(1)(e) of the General Data Protection Regulation. It is also important to highlight that a body exercising public authority or performing other public tasks can only be the subject of all public and private law legal relationships and of the data processing relationships related to it in connection with the performance of its public tasks, and any other status other than this is conceptually excluded, and the other legal bases otherwise applicable under the General Data Protection Regulation are somehow merged into this legal basis. Consequently, the legal basis of a legal obligation under Article 6(1)(c) of the General Data Protection Regulation is also merged into the legal basis under Article 6(1)(e) of the General Data Protection Regulation. (164) If the legislator has not laid down detailed rules for these data processing activities, disregarding the provisions of Section 5(3) of the Infotv., the data controller is obliged to carry out its data processing activities in accordance with the
43
general data protection rules – in particular the criteria of necessity of the basic principles and the legal basis – and to prove its lawfulness in accordance with the principle of accountability.
(165) Based on all of this, the Authority’s position regarding the legal basis for data processing is as follows:
(166) During the dormitory admission and social situation assessment procedure, SZTE processes the personal and special data of the student and those living in the same household based on the already cited provisions of the Nftv. and the Government Decree.
(167) SZTE must determine the personal data to be processed – and the range of certificates and documents required to be submitted – in such a way that it can judge whether the circumstances exist on the basis of which the student – taking into account his or her social situation – is entitled to dormitory accommodation, but it must not extend beyond the necessary aspects and data scope prescribed by the Nftv. and Government Decree and thus comply with Article 5 (1) (c) and Article 6 (1) (e) of the General Data Protection Regulation. (168) As already written above, SZTE is a state-recognized private higher education institution operating as a public benefit organization, performing public tasks, and the sectoral rules applicable to this institution are fundamentally laid down in the Nftv. and Government Decree. These regulations state that SZTE is obliged to use a certain part of the support provided to it for the payment of social scholarships to students. These regulations also specify which aspects SZTE – and all higher education institutions – must take into account when assessing eligibility, which limits the scope of data to be processed. These regulations bind SZTE, i.e. SZTE cannot decide to take other aspects into account during the procedure in addition to the aspects specified by the regulations, as this would generate additional data processing.
(169) Since the provision of dormitory accommodation is a task of SZTE, the framework of which – namely, the circumstances under which a student is entitled to it – is set out in legislation, SZTE cannot decide to go beyond these legislation and prescribe additional aspects and related data scopes and thus further data processing in its internal regulations. “Mandatory data processing” is manifested in the fact that the data controller has a task defined by law, which necessarily entails data processing, or there is a data scope defined by the legislator (in this case, a strictly defined set of aspects), and SZTE must act within the framework of these legislation.
(170) Based on the above, the legal basis for the processing of all personal data included in submitted applications can only be Article 6(1)(e) of the General Data Protection Regulation.
If SZTE takes into account a new set of criteria during the dormitory admission and social situation assessment that is not specified by the Nftv. and the Government Decree, and requests data for this purpose, or requests data not specified by the legislation for the criteria specified by the legislation, then its data processing is without legal basis, i.e. it violates Article 6 of the General Data Protection Regulation. (171) Since SZTE referred to the fact that it carries out data processing based on the provisions of the Nftv. and the Government Decree, thus – although the Regulations on the electronic application system for applying for regular social scholarships, which serve as the reimbursement and benefit regulations, and the Points Regulations themselves may determine the detailed rules for the dormitory admission procedure and the determination of social situation – the scope of data, documents, and certificates to be submitted may not exceed the scope of Annex 3 I/B of the Nftv. in subsection 1. point be) of the Government Decree, and in Section 12. (3) of the Government Decree –
furthermore, in Section 4. (4) of the Government Decree and Section 41. (1) of the Government Decree –
and Section 21. (1) of the Government Decree, i.e., in the course of developing the points system, it may not determine any circumstances to be verified or data to be processed that are not required to be taken into account in the dormitory admission procedure and when determining the social situation by Section 12. (3) and Section 21. of the Government Decree. If SZTE nevertheless determines in its internal regulations aspects that go beyond these legal provisions and additional data to be processed, then the processing of such data is not carried out on the basis of the authorization of the Government Decree and the Government Decree – i.e. not on the basis of Article 6. (1) of the General Data Protection Regulation
, therefore, the data processing has no legal basis.
(172) Section 12(3) and Section 21(3) of the Government Decree therefore authorize higher education institutions – including SZTE – to determine which aspects to take into account when determining the eligibility for dormitory accommodation and the social situation and which personal data to process in connection with them, while the detailed rules to be determined in the two procedures, in particular taking into account the basic principles and the legal basis’s necessity standard, shall be laid down in institutional regulations. (173) The Authority notes that the Privacy Act Section 5(3) of the GDPR stipulates that in the case of data processing as defined in Article 6(1)(e) of the GDPR (hereinafter: mandatory data processing), the types of data to be processed, the purpose and conditions of data processing, the accessibility of the data, the identity of the data controller, and the duration of data processing or the periodic review of its necessity shall be specified in the law or local government regulation ordering the data processing. If the legislation prescribing such mandatory data processing does not fully comply with Section 5(3) of the Infotv. and does not include the circumstances of the data processing, then, following the primacy of EU law, i.e. the GDPR, the data controller must enforce the principles and guarantees of the general rules governing the processing of personal data, which the legislator has failed to provide for. Since the data processing conditions are not included in either the Nftv. or the Government Decree, they do not comply with the requirements of the Infotv.
. However, the Authority did not assess the legislator's shortcomings to the detriment of SZTE, and proceeded from the fact that if SZTE does not go beyond the examination of the aspects prescribed in the Nftv. and the Government Decree and processes the data necessary for them,
then its data processing complies with the requirement set out in Article 6(1)(e) of the General Data Protection Regulation and the principle of data economy.
(174) Furthermore, according to Article 9 of the General Data Protection Regulation, health data are among the special categories of personal data, the processing of which is prohibited in principle and may only be lawful in special cases pursuant to Article 9(2) of the General Data Protection Regulation.
(175) The relevant legislation, the Nftv. and the Government Decree, SZTE may take the following
aspects into account during the dormitory admission and social situation assessment procedure, and may process the data related to them:
(176) Based on Section 12 (3) of the Government Decree, the following points shall be taken into account in the point system applied during the procedure related to the use of dormitory services:
- the student's:
- social situation,
- academic performance,
- work done for the student community,
- work schedule of his/her training,
- whether there is a circumstance on the basis of which he/she may be exempted from the obligation to pay the dormitory fee due to his/her social situation,
- whether there is a circumstance on the basis of which he/she should be given preference in accordance with the condition set out in Section 41 (1) of the National Funding Act.
(177) In relation to the social situation to be taken into account during the procedure for the use of dormitory accommodation pursuant to Section 12(3) of the Government Decree, Section 21(1)-(2) of the Government Decree stipulates that the following aspects shall be taken into account when assessing the student's social situation: - the number and income status of those living together in the property at the student's address, registered there or having a place of residence, - the distance between the place of training and the place of residence, the duration and cost of the journey, - if the student has not been granted a residence permit during his/her studies, lives in a common household according to the 

section, the costs thereof,

- the amount of money the disabled student must spend on the purchase and maintenance of special equipment, special travel needs, and the use of a personal assistant or sign language interpreter,

- the health expenses regularly incurred due to the health condition of the student or a close relative living in the same household,

- the number of dependents living in the same household with the student, with particular regard to the number of children living with him,

- the costs associated with the care of a relative in need of care.

(178) When calculating income, the average of the last three months shall be taken into account for income that can be measured regularly on a monthly basis, and one twelfth of the last year for other income.

(179) The cases of exemption from the obligation to pay the dormitory fee, which are also to be taken into account during the procedure related to the use of dormitory care, according to Section 12 (3) of the Government Decree, are included in Section 4 (4) of the Government Decree, which are the following:
- disadvantaged student,
- orphan student,
- family breadwinner, or
- a student whose guardianship has ended due to his/her coming of age.
(180) Furthermore, the Nftv. Cases of sharing in the advantage according to Section 41 (1):
- disadvantaged applicants and students,
- those on unpaid leave for the purpose of taking care of their child,
- those receiving childcare allowance, adoption allowance, childcare allowance, child-rearing allowance, home care allowance for children,
- those belonging to the group of applicants and students with disabilities,
- those belonging to the group of applicants and students belonging to a nationality.
(181) The concept of disadvantaged situation is defined in Section 67/A. (1) of the Gyvt., while the concept of orphan is defined in Section 2. (1) b) of the Government Decree, and the concept of family breadwinner is defined in Section 2. (1) e) of the Government Decree.
(182) Based on the above legal provisions, the processing of special data during the application procedure arises, on the one hand, when assessing the social situation, when Section 21(1)(d) and (e) of the Government Decree stipulates that when assessing the social situation of the student, the amount of money the disabled student has to spend on the purchase and maintenance of special equipment, special travel needs, as well as the use of a personal assistant or a sign language interpreter, as well as the health expenses regularly incurred by the student or a close relative living in the same household due to his or her health condition. (183) On the other hand, when, in the case of the student, the preferential condition pursuant to Section 41(1)(c) of the National Health Service Act, in view of Section 12(3) of the Government Decree, applies, i.e. the student has a disability. (184) SZTE may not take into account any further circumstances to be examined beyond the criteria specified in the above legislation, and may not process any other personal data than the data required for those purposes in connection with the dormitory application and the social situation assessment procedure that forms part of it. (185) Based on all of this, the Authority assumed that if SZTE – in accordance with what was stated in its statements – acted in accordance with the provisions of the National Agency for the Protection of Human Rights and Fundamental Freedoms and the Government Decree, and decided to take into account criteria to be examined and to process personal data related to criteria that comply with the provisions of the legislation, then the Authority deemed that the data processing complied with the principle of data economy and had a legal basis. In other cases, when SZTE prescribed the criteria to be examined and the data processed beyond the statutory authorisation, it assessed the data processing as violating the principle of data economy and without legal basis. The Authority assesses in Section V.6 that SZTE
incorrectly referred to the legal basis of consent in the Dormitory Regulations of 2022.06.27
and in the “Declaration 04”.
V . 4 . P r i c l e t o f d a t i o n s i n g (186) The Authority refers back to the fact described above in the legal basis for data processing that in the case of the dormitory admission procedure and social situation assessment as mandatory data processing, the legislator did not set out the detailed rules for data processing, disregarding the provisions of Section 5 (3) of the Infotv., but only defined the aspects and circumstances to be taken into account during the procedures. Therefore, SZTE, as a data controller, is obliged to carry out its data processing activities in accordance with the general data protection rules – in particular the basic principles and the legal basis’s necessity standard – and to prove its legality in accordance with the principle of accountability.
(187) Accordingly, data processing must also comply with the principle of data minimisation as set out in Article 5(1)(c) of the General Data Protection Regulation. Personal data may be processed only to the extent and for the period necessary for the purpose. They must also be adequate and relevant. The so-called necessity criterion, also known as the principle of data minimisation, means that it must be examined before the start of data processing whether it is necessary to process personal data at all for the purpose. (188) Accordingly, only as much and such personal data as are necessary and sufficient to achieve the purpose of the data processing may be processed. The requirement for the “relevance” of data is in line with the requirement arising from the principle of purpose limitation that the scope of personal data to be processed must be designated and defined in accordance with the purpose and objectives of data processing. In this context, it should be noted that the data management information
must precisely list the personal data to which the data management applies.
It is not sufficient for data controllers to define the scope of the personal data managed with a collective term.
47
(189) Based on this, if SZTE processed personal and special personal data during the dormitory admission and social situation assessment procedures that are not necessary for establishing the criteria specified by the Nftv. and the Government Decree,
or in addition, it also specified additional criteria to be examined related to the processing of personal data, the Authority also examined the application of the principle of data economy.
(190) The Nftv. and the Government Decree therefore specify criteria to be examined in connection with the two procedures, and to support these, it requests the submission of documents and records specified by SZTE, according to the lists of evidence. In this regard, a distinction should be made between the data principle and the document principle. The fact that certain documents contain the data that are necessary to establish the aspects to be examined does not mean that SZTE is entitled to process all the personal data recorded in the given document, i.e. the entire document. Based on the data principle, unnecessary data must be removed from the given document. Establishing the authenticity of the document is an interest that can be taken into account on the part of SZTE, however, sensitive data concerning the student or his/her relative that is unnecessary from the perspective of the two procedures may not form part of the procedures and may not be included in SZTE's electronic records.
V . 5 . P r o s s e c t i o n d a t i o n (191) The Authority reviewed the documents sent by SZTE, based on which it established the following in relation to the data processed and the requested certificates.
(192) For the criteria specified by the Nftv. and the Government Decree, SZTE processes the data according to its declarations and the documents described in paragraphs (45) sent to the Authority, and requests the submission of documents.
(193) Special health data is taken into account for the assessment of the student's social situation on the basis of Section 21 (1) d) and e) of the Government Decree. The processing of special data is of paramount importance, therefore the Authority begins the analysis by processing these data.
V.5.1. How much money should a disabled student spend on the purchase and maintenance of special equipment, special travel needs, and the use of a personal assistant or a sign language interpreter? (194) According to the Authority, the knowledge of the applicant student's disability as a fact is an aspect that is in accordance with Section 21 (1) (d) of the Government Decree and Section 41 (1) (c) of the National Funding Act. However, Section 21 (1) (d) of the Government Decree, in addition to the knowledge of this fact, only covers the costs arising in connection with the disability and the handling of their certification, and not the precise designation of the disabled condition or the handling of certificates containing a detailed description of it. (195) The certification lists and the subjective point system accordingly – according to their wording – take costs into account, according to the subjective point system, 1 point for every 1000 forints.
(196) The provision on students with disabilities or in need due to their health conditions in the certification lists 3.1. point provides as a necessary proof that “if the applicant’s disability already existed during his/her public education studies and, in view of this, he/she received a benefit during his/her studies and the matriculation examination, the expert and rehabilitation committee specified in Act LXXIX of 1993 on public education,48 if the disability was established later, an expert opinion issued by the National Rehabilitation and Social Expert Institute; or (in the case of a student in need due to his/her health condition) an expert opinion issued by a specialist doctor, stating in text and numbers that the applicant has lost at least 67% of his/her working capacity or has suffered at least 50% health impairment, and that this condition has lasted for one year or is expected to last for at least another year.”
(197) However, this formulation is incorrect, given that Act LXXIX of 1993 on Public Education is invalid as of 1 July 2016, and the effective legislation on public education is Act CXC of 2011 on National Public Education. The National Institute of Rehabilitation and Social Experts has ceased to exist.
(198) The list of certificates, under item 8. other remarks, to be disclosed, expenses, costs, also states how the costs must be proven: “a statement containing the stated facts, data, etc., signed by two witnesses and with their addresses; other documents, depending on the content (for example: a certificate signed by a specialist or family doctor on the fact of a long-term illness, a certificate signed by a specialist or family doctor or pharmacist on the necessary regularly taken medicines, which are listed item by item with their prices).”
(199) In one sentence, SZTE stated to the Authority that the exact name of the disease or disability is not required, and in another sentence, that the certification document only needs to contain the name of the disease or the part certifying the fact of the serious or long-term disease, and the applicant may erase the other parts. It also stated that, despite this, applicants who upload the document do not usually erase the data and upload the entire certificate to the interface. Therefore, SZTE can only ensure the protection of these special personal data by limiting the number of persons who have access to these data for the purpose of assessing the application to the narrowest possible circle. (200) However, the simplified certification lists also contain the information in I.1. in point that
“Please note that the original copies of the documents must be scanned in black and white and/or
color (not grayscale, etc.) and then uploaded in JPEG (image)
format or PDF (portable document) format and (without quotation marks)
with the extension “JPG” or “PDF” (for example: munkaltatoi.jpg).”
(201) Despite the statement of SZTE that it is not necessary to specify the disease or disability, in practice – based on the medical certificates also sent by SZTE – SZTE also stores complete medical certificates and expert opinions, which contain health data that cannot be precisely determined in advance, describing and detailing the disability, the processing of which is unnecessary. The simplified lists of certificates also explicitly draw the attention of applicants to the fact that the original copies of the documents must be scanned, which implies that SZTE requests the attachment of complete medical certificates and health documents, which are not necessary according to what it has presented. In this way, the persons participating in the assessment process become aware of such details of medical treatments, healing processes and health conditions that are specifically part of the private sphere, that may also be sensitive and delicate information, the confidentiality and protection of which is in the fundamental interest of the patient concerned. The public task does not justify the large-scale processing of these data pursuant to paragraph (121), thus putting the applicants in a vulnerable position. The data processing therefore violates the principle of data economy pursuant to Article 5(1)(c) of the General Data Protection Regulation. (202) Furthermore, Article 6(1)(e) of the General Data Protection Regulation does not apply to the processing of the above-mentioned data detailing the health and disability status, which do not support the fact of the disability and the costs incurred in connection with it, but relate to the disabled status of the applicant student, the exact type of disability the student is living with, and how severe it is, as these aspects are not mentioned in Sections 12(2) and (3) of the Government Decree, Section 21(1)(d) and Section 41(1)(c) of the National Education Act. (203) Since these aspects are not required to be verified by the legislation, when SZTE collects and stores data for the assessment of the aspects affecting the disability status and its costs, it goes beyond those specified in the Government Decree and the Nftv., thereby displaying additional aspects in the point system. According to the Authority's position, when determining the additional requirements prescribed within its own competence, SZTE decided to process the student's health data, for which SZTE has no legal basis - since they go beyond the aspects prescribed by the Government Decree and the Nftv. - and violates Article 6(1) of the General Data Protection Regulation.
(204) As stated in point V.3, health data are also special categories of personal data under Article 9 of the GDPR, the processing of which is prohibited in principle and may only be lawful in specific cases pursuant to Article 9(2) of the GDPR.
(205) The SZTE referred to Article 9(2)(b) and (g) of the GDPR as additional legal requirements for the processing of health data. The obligations arising from legal provisions governing employment and social security are concentrated in the legislation on labour law and social measures. If these establish obligations or rights for either the employer or the employee that necessitate the processing of special data, they constitute an authorisation for the processing. Substantial public interest is the legal basis for the processing of sensitive data related to a legal obligation or the performance of a public task or the exercise of public authority. Accordingly, the public interest that necessitates the processing of sensitive data must be defined in the legislation and the basic guarantee conditions must also be provided for. The Authority could accept these conditions as additional legality requirements, however, the specific nature of the processing of sensitive data is that the data controller must also have a legal basis pursuant to Article 6(1) of the General Data Protection Regulation, which, as stated above, the University of Szeged did not have. Consequently, the data processing also violates Article 9(2) of the General Data Protection Regulation. (206) The fact that, according to the statements submitted to the Authority, it is not necessary to mention the illness or disability in the certificates does not change the above fact, nor does the fact that – even if there were such a call to the applicants – the students, despite the request – according to the statement of the SZTE – do not erase unnecessary data because the processing of health data is also a matter of fact in this case, and according to the above, these data are processed by the SZTE, for which neither the National Data Protection Act nor the Government Decree gives authorization. For this reason, the data processing violates the principle of data economy according to Article 5(1)(c) of the General Data Protection Regulation, and since the data processing is also without legal basis, Article 6(1) of the General Data Protection Regulation, and, as stated in the above paragraph, Article 9(2) of the General Data Protection Regulation. (207) The Authority considers it appropriate if SZTE accepts a certificate that only states that the student is disabled and in need due to his/her health condition, but not the details, such as the name and detailed description of the student's specific illness. Furthermore, in accordance with Section 21 (1) d) of the Government Decree, the certificate must include the amount the student must spend – if applicable – on the purchase and maintenance of special equipment, on special travel needs, and on the use of a personal assistant or sign language interpreter. (208) If students do not remove unnecessary data despite SZTE's request, SZTE, as the data controller, must develop a procedure that meets the requirements of data economy and legal basis, and in its information, regulations, lists of certificates and data management information describing the dormitory admission and social situation assessment procedures, it must explicitly draw the attention of students to the submission of appropriate certificates. V.5.2. Regularly incurred health expenses due to the health condition of the student or a close relative living in the same household
(209) According to the Authority, knowledge of the fact of the health condition of the student or a close relative living in the same household is also an aspect that is in accordance with Section 21(1)(e) of the Government Decree, however, Article 6(1)(e) of the General Data Protection Regulation – in addition to the fact of inadequate health condition
– only covers the case of handling the health expenses arising in this regard and their verification.
(210) During the scoring process, according to the subjective point system, additional points may be awarded to the applicant or a close relative living in the same household in the event of, among other things, a serious illness, lactose intolerance, celiac disease, other allergies and similar illnesses.
(211) The SZTE requests that these circumstances be substantiated in various ways – for example, a specialist opinion, a certificate signed by a specialist or a family doctor – as the score is awarded if the SZTE is convinced of the existence of these circumstances. Furthermore, in order to prevent various abuses, the SZTE considers it justified to request medical certificates regarding various long-term illnesses. In order to prevent various abuses, the SZTE also requests that serious illnesses of breadwinners and dependents living in the same household be certified as above. According to the SZTE statement, it is not necessary to provide the exact name of the illness at the same time; it is sufficient to prove the fact that the illness is serious and long-term. Despite this, according to the statement of SZTE – as in the case of the certificate of disability – applicants do not usually perform the redactions when uploading the documents, so SZTE ensures the protection of sensitive data by limiting the circle of persons with access to this data to the narrowest possible circle of persons. (212) In this regard, the Authority refers back to what was written in the previous point, according to which Article 6(1)(e) of the General Data Protection Regulation does not apply to the processing of data that do not support the fact of the health status and the costs arising in connection with it, but relate to the details of the health status of the applicant student or his/her close relative living in the same household. These aspects, specifically named diseases, are not mentioned in Section 12(2) and (3) of the Government Decree, as well as Section 21(1)(e) and Section 41(1)(c) of the National Health and Welfare Act. As stated in the previous point, SZTE is obliged to take into account the fact that health expenses regularly arise due to the health condition of the applicant or a close relative living in the same household, as these expenses may arise from the disability or long-term illness of the applicant or a close relative living in the same household.
51
(213) The applicant will receive different points based on Annex 1 of the Scoring Regulations (2011) and Annex 1 of the SZTE Regulations on the Electronic Application System for Regular Social Scholarship Applications (November 25, 2013 and October 30, 2023) in the event of certain circumstances described in paragraphs (29)-(31) of this resolution, i.e. additional points will be awarded in connection with the processing of certain additional, detailed personal, special personal data.
(214) In this regard, the Authority refers back to what was written in the previous point, according to which, despite the SZTE's statement that it is not necessary to mention the illness or disability in the certificates, in practice - based on the medical certificates also sent by SZTE - SZTE also stores complete medical certificates and expert opinions, including detailed health data of the students concerned or their close relatives living in the same household. SZTE therefore processes detailed health data in this area as well, which is also supported by the medical certificates sent to the Authority. (215) The data processing, therefore, in accordance with what was explained in the previous point, violates the principle of data economy as set out in Article 5(1)(c) of the General Data Protection Regulation and, since the data processing is also without legal basis, Article 6(1) of the General Data Protection Regulation and Article 9(2) of the General Data Protection Regulation in the absence of a requirement of lawfulness for the processing of sensitive data. (216) The Authority considers it appropriate for SZTE to accept a certificate that only states the fact that the student or a close relative living in the same household is in need due to his or her health condition and the related costs, but not the details of the illness, the name of the student's specific illness, and a detailed presentation of it. Furthermore, in accordance with Section 21(1)(e) of the Government Decree, the certificate must include the amount of money that the student or a close relative living in the same household will have to spend – in a given case – on the purchase and maintenance of special equipment, special travel needs, and the use of a personal assistant or sign language interpreter. According to the Authority, the gluten sensitivity cited as an example and its costs can also be justified in a way, for example, with a medical certificate that only contains the necessary data. (217) If students do not remove unnecessary data despite the request of SZTE, SZTE, as the data controller, must develop a procedure that meets the requirement of data saving, and in its information, regulations, lists of certificates and data management information describing the dormitory admission and social situation assessment procedures, it must also explicitly draw the attention of students to the submission of appropriate certificates. V.5.3. Number and income status of persons living together in the property at the student's address, registered there or having a place of residence
(218) In order to be able to establish - in accordance with Section 21 (1) a) of the Government Decree - the per capita income of the persons living in the student's household, SZTE must know how many persons live in the property and what their income was during the period under review.
(219) Based on the certificate lists, SZTE requests a certificate issued by the local government or regionally competent district office or regionally competent government office as a necessary certificate for establishing these, in such a way that the certificate must include the names of the people living at the same address, the numerical designation is not sufficient.
(220) In addition to these certificates, a copy of both sides of the address card must be attached in all cases.
(221) One side of the address card contains the person's family name and first name, place and date of birth, mother's name, place of residence, place of residence, time of registration of the place of residence, validity period, date of issue, name of the issuing authority and document identifier. The other side of the address card contains the person's family name and first name, personal identifier and document identifier.
(222) According to the Authority, based on the principle of data economy, it is sufficient to send a certificate issued by the local government or district office to verify the persons living in the same household. According to Section 323 of Act CXXX of 2016 on the Code of Civil Procedure, a certificate issued by the local government or district office is a public document that proves with full evidentiary force that the issuer has taken the measure or made a decision with the content contained therein, the reality of the data and facts certified by the public document, the making of the declaration contained in the public document, the time and manner thereof, and shall be deemed genuine until proven otherwise. According to the Authority, this certificate can be used to adequately verify who lives in the given property. (223) In addition to this certificate, it is not necessary to record a copy of the address card, and neither the Nftv. nor the Government Decree prescribes the processing of data relating to the student's personal identifier and document identifier, as well as the issuance of the document. The Authority would accept a request for a copy of the address card if the applicant does not have a certificate issued by the local government or district office. However, in this case, the copy of the address card must be prepared with unnecessary personal data. That is, the copy may contain the personal identification data of the person concerned - family and first name, place and date of birth, mother's name - and the data of the place of residence, given that these data can be used to identify the person concerned and establish his or her place of residence. The processing of data other than these – document identifiers, personal identifiers, data relating to the issuance of documents – for this purpose violates the principle of data economy as set out in Article 5(1)(c) of the General Data Protection Regulation, and the processing of these data for this purpose is without legal basis and violates Article 6(1) of the General Data Protection Regulation.
(224) Another aspect to be examined in this context is the income situation of those living together in the property at the student’s address, registered there or having a place of residence.
(225) An official and original certificate signed by the employer regarding all income of those living in the same household, or a NAV income certificate, must be attached, as stated in paragraph (45).
(226) In this context, SZTE processes employment data: the legal title under which the student lives together in the property at the student's address, is registered there or has a place of residence, what type of income he has (for example, employee, sole proprietor) and what is his monthly income (what amount of income the breadwinner has). (227) In connection with the income situation, in accordance with Section 21 (1) a) of the Government Decree, Section 4 (16) a) of the Dormitory Regulations (2007), Section 9 of the Regulations on the Fees and Reimbursements to be Paid by Students of SZTE and the Grants Available to Them (June 27, 2022), referring to Section 21 (2) of the Government Decree, it is stated that, in accordance with the Government Decree, the average income of the last three months per person of those living in a common household with the applicant should be taken into account for the income that can be measured regularly on a monthly basis, and for other income, the twelfth of the last one year. (228) For this purpose, the Authority considers it appropriate for SZTE to request income certificates issued by the employers of those persons living in the property, in terms of the average of the last three months, while in the case of those with other income – entrepreneurs (partners, members with an ownership share in a business association), primary producers, old-age pensioners, disability pensioners, registered unemployed, unregistered unemployed – income certificates issued by the National Tax and Customs Administration (NAV) in terms of the last twelfth of a year. Based on these certificates and data, it can be established how much income a given person has earned in the given period and what his or her income situation is. (229) The individual entrepreneur certificate or the certificate issued by the body keeping the register, as per Act CXV of 2009 However, requesting a certificate pursuant to Section 9 of the Act or a company extract on the business association, or a primary producer certificate, is no longer necessary to establish the income situation, as it can be established from the income certificate. The sole proprietorship certificate, as well as Section 38/D of Act CXV of 2009 on sole proprietorships and sole proprietorships, became invalid on 1 January 2020. The sole proprietor was obliged to submit the invalid certificate to the authority designated by the Government in a decree in matters relating to sole proprietorship by 1 March 2020. The submitted certificate was withdrawn by the authority. If the sole proprietor did not submit or send the certificate, the authority revoked it. The processing of these certificates and personal data contained therein is therefore unnecessary and without legal basis, and infringes Article 5(1)(c) and Article 6(1) of the General Data Protection Regulation. (230) The Authority also considers it appropriate to request certificates issued by the pension provider in the case of pension recipients and to process the personal data recorded therein, with the proviso that in the case of disability pensions the certificate may contain the fact of health impairment, altered working capacity, reduced working capacity, but not other data relating to health status. (231) The Authority also considers it appropriate to process the certificates requested in the case of registered unemployed and unregistered unemployed and the personal data recorded therein. (232) In addition, it is not necessary to prove the case complained about in the public interest notification (NAIH-12627-1/2024.) when the student declares that his parents' salary is higher than the prescribed one, so that he does not claim any extra points from this when assessing the dormitory situation. The statement of SZTE in this regard, according to which the basic idea of the system is that the applicant must substantiate the statements made by him with proof, and this also includes the case when the student's parents' salary is higher than the prescribed one, implements unnecessary data processing, given that the student's statement is aimed at stating that his parents do not have the prescribed income, and if the student gives a negative statement to this effect, the proof is no longer necessary, and it is also completely unreasonable to expect proof of non-existent circumstances. Consequently, the Authority concludes that the data processing in this respect infringes the principle of data minimisation pursuant to Article 5(1)(c) of the General Data Protection Regulation and, since it has no legal basis, Article 6(1) of the General Data Protection Regulation.
54
V.5.4. Distance between the place of training and the applicant's place of residence, duration and cost of travel
(233) In this context, it is necessary to process the student's place of residence, as well as the distance between his place of residence and the SZTE as a place of training and the duration of travel.
(234) Based on Annex 1 of the SZTE Points Regulations and Annex 1 of the Regulations on the electronic application system for regular social scholarship applications, in this round, the student – in accordance with Section 21 (1) b) of the Government Decree – receives points for how far his/her place of residence is from the training place, in which case he/she receives 1 point for every 15 km. On the other hand, the student receives points for his/her travel expenses, 1 point for every 1,000 forints. (235) In this round, it is necessary to process the student’s address data, which, as already mentioned above, can be verified with a certificate issued by the local government or the regionally competent district office or the regionally competent government office or with the student’s address card, and in addition, whether he/she is staying in an “apartment” or other accommodation. A monthly rent slip from the previous three months and a copy of the student's student ID are also required. (236) SZTE requires a copy of the contract establishing the "sublet" legal relationship - a complete and unextracted copy, including the monthly rent and the expected monthly utility costs - or, if the utility costs are not included in the contract, or, in the absence of a contract, a statement issued by the landlord and made in front of two witnesses, including the monthly rent and the expected monthly utility costs. (237) In the case of students living in other accommodation, a contract for the use of a free apartment or premises, signed and dated by two witnesses, must be attached, or a statement confirming the fact of living in the property, signed by the head of the institution or the representative of the legal entity, or a certificate issued by the higher education institution concerned or the organiser of the student exchange programme. (238) In the Authority's opinion, it is not necessary to process the full content of contracts establishing a "sublet" legal relationship, in particular the personal data of the other contracting party. Therefore, Article 5(1)(c) of the General Data Protection Regulation is infringed by the processing of full contracts, i.e. those parts of the contract that do not certify the existence of the legal relationship but rather deal with its details and conditions. Furthermore, since the processing of contract data is not required by the Nftv. and the conditions stipulated by the Government Decree, the processing of these data is not prescribed by law, and therefore the processing of data without legal basis also violates Article 6 (1) of the General Data Protection Regulation. According to the Authority's position, in order to establish the circumstances to be proven, it would be sufficient to request an excerpt of the contract, which shows that the student concluded the contract, what the contract is for and how much the monthly rent and utility costs are. If these are not included in the contract, a statement requested by SZTE and issued by the landlord, confirming the student's place of residence, is sufficient.
V.5.5. If the student does not live in a joint household as defined in the Social Security Act during his/her studies,
the costs of this
(239) Similarly to the above case, the student's place of residence is also relevant in this regard, provided that he/she does not live in a joint household as defined in the Social Security Act.
55
(240) Given that the effective Social Security Act, Act CXXII of 2019 on those entitled to social security benefits,
and the coverage of these benefits, does not define the concept of
a joint household, but Act LXXXIII of 1997 on compulsory health insurance benefits,
section 5/B. i) thereof, the Authority took this concept into account.
On this basis, a joint household is a community of natural persons living together in a residential property as a way of life. According to the Authority, this category includes cases where the student does not live with his/her parents or close relatives, but, for example, in a “rented apartment” or other accommodation as described in the previous section. In this case, the data and certificates described in Section V.5.4 may be necessary. In relation to the data and certificates unlawfully processed in this category, the Authority also refers to the findings made in the above section. V.5.6. Number of dependents living in the same household as the student, with particular regard to the number of children living with the student (241) For this aspect, SZTE primarily needs to know who lives in the same household as the student, and whether the student is in a dependent or dependent relationship with him/her. In the case of dependent relationships, a further issue to be clarified on the basis of the certification lists is the relationship between the dependent and the student, and the family status of the dependent: for example, a divorced mother, an unmarried father. Furthermore, it is also a consideration whether the student is the breadwinner or not. These cases are included in paragraph (45). (242) In this regard, the Authority first refers to the Government Decree, according to which the number of dependents living in the same household with the student, with particular regard to children who are dependent on him, must be taken into account, but not if, for example, the student's parents have dissolved their marriage. These considerations do not include the registration of further family status data. In the Authority's opinion, therefore, it is not necessary to process the data on the family relationships listed in the certification lists, they can only serve as examples. In this context, the relationship between the parent and the dependent must be proven for those living in the household.
(243) In this context, the Authority is of the opinion that birth certificates and marriage dissolution judgments also contain personal data, the processing of which is not necessary to prove the existing or terminated family relationship affecting the student.
(244) The birth certificate contains the child's family name and first name, gender, place and date of birth, place of origin, the family name and first name of the father and mother, the fact, place and time of death of the registered person, the child's and parents' certified non-Hungarian citizenship, statelessness or unknown citizenship, the cessation of Hungarian citizenship, in the case of a declaration pursuant to the Act on the Protection of Children and Guardianship Administration, the fact of this and the biological parent or parents' 69/B. the data specified in Section (1) b) sub-point ba) or – if the fact of adoption was registered in the paper-based registry – the fact of adoption, as well as the data specified in Section 69/B. (1) b) sub-point ba) and bi) of the adoptive parent or parents, the Hungarian citizenship of the adopted child, if the child was adopted by parents who are not Hungarian citizens, the fact of Hungarian citizenship of the child born in Hungary to stateless parents. (245) According to the Authority’s position, it is sufficient to know the name and date of birth of the child and the names of the parents to prove this circumstance, since if the SZTE compares these data with the certificate of persons living in the household, it can ascertain the number of dependents. 56 (246) However, the full birth certificate contains a significantly wider range of data than these. The submission of a full copy of the birth certificate is therefore unnecessary and violates the principle of data economy, since knowledge of all the personal data contained in this document is not necessary to establish the dependent-supporter relationship. The data processing of SZTE therefore violates Article 5(1)(c) of the General Data Protection Regulation in this respect, and since neither the National Education Act nor the Government Decree authorizes the processing of data contained in the birth certificate, the data processing has no legal basis and violates Article 6(1)(c) of the General Data Protection Regulation. (247) Another aspect to be taken into account, according to the lists of evidence, is that the student's parents are divorced or the student is raised by his/her parent alone, is not married, or the parent raising him/her has remarried, or one of his/her parents has died. These are also aspects to be taken into account according to the lists of justifications, despite the fact that these aspects do not appear explicitly in any form in Section 21 (1) of the Government Decree. In this case, the justification of those living in the same household as the student is the aspect, for which the above circumstances are not necessary for the processing of data, and SZTE is not entitled to process these data based on the Government Decree. Thus, the processing of these data violates the principle of data economy as set out in Article 5 (1) (c) of the General Data Protection Regulation, and the processing of these data has no legal basis, thus violating Article 6 (1) of the General Data Protection Regulation. (248) The Authority's position is also that they may contain circumstances affecting the private sphere of the parents of the student concerned and, where applicable, his or her family, the processing of which is unnecessary and without legal basis on the part of SZTE. Unnecessary and unfounded in a given case is the knowledge of the circumstances and data that led to the student's parents' decision to divorce and which provide for the period following the divorce, such as contact with the child and its details. The processing of all complete judgments, minutes, and personal data recorded in them, presenting the student's parents' living situation and containing a detailed examination of the circumstances leading to the divorce, is unfounded and unneeded in order to establish that the student's parents have dissolved their marriage. The part of the judgment ordering the dissolution of the marriage that, in a given case, includes the amount of child support may be relevant. (249) Based on all this, the processing of divorce judgments, records and all personal data contained in them violates the principle of data protection as set out in Article 5(1)(c) of the General Data Protection Regulation, and since there is no legal basis for the processing of these data, it also violates Article 6(1) of the General Data Protection Regulation. (250) SZTE requests various certificates depending on why the parent is raising the student alone: in the case of divorce, the court ruling on this, in the case of the death of one of the parents, the death certificate, or, failing that, a “pension certificate” containing the fact of orphan care. If the parents are simply living separately, it can be proven by a declaration signed by the student or parent containing the fact of separation, signed by two witnesses and with their residential address, or by a document issued or received by any third body or authority containing the fact of separation. In the case of single, unmarried, a certificate issued by the district office is required, which contains the indication of single, unmarried marital status. (251) As stated above, SZTE has no legal basis to process information regarding whether the student's parent is raising him/her alone, or what his/her marital status is. The information that the student is being raised by one of his/her parents alone may be relevant only from the perspective of whether the other parent lives in the household: this information is also relevant for whether his/her income should be included in the household income or not, or for the relationship between the breadwinner and the dependent. In addition, as stated above, with regard to the relationship as a close relative, whether his/her regularly arising medical expenses due to his/her health condition should be taken into account or not, or what costs arise from caring for a relative in need of care. Marital status, however, has no bearing on these circumstances and is not necessary to establish them.
(252) According to the Authority, it may be necessary to declare the fact of separation only in rare cases, if for some reason the separated parent – although no longer living in the household – is still listed on the certificate issued for those living in the same household.
(253) The certification lists also stipulate that if the parent raising the applicant alone has remarried or lives with a partner, and the new spouse or partner has moved into the same household as the student, it is also necessary to certify his or her employment and income data. According to the Authority, this is an appropriate requirement in this case, since his or her income is included in the household income in the same way as the income of other persons.
However, this case does not take into account, for example, if the parent raising the applicant alone lives with his or her partner in such a way that both manage their finances separately, and the partner's income does not constitute part of the entire household in this sense, given that, for example, the former spouse contributes to the household expenses by supporting the child. (254) According to the lists of certificates, SZTE also takes into account the family relationship if the dependent sibling, half-sibling, or step-sibling living in the same household with the student is not yet of school age, is in public education, or is in higher education. According to the Authority's position, knowledge of this information may be necessary to assess the circumstance specified in Section 21(1)(f) of the Government Decree, as to how many dependents live in the same household with the student.
(255) The SZTE requests that the fact that the child living in the household is not yet of school age be proven by a copy of the child's birth certificate.
(256) Based on the above, the Authority is of the opinion that it is sufficient to know the child's name and date of birth to prove this circumstance, since if the SZTE compares these data with the certificate of persons living in the household, it can verify whether the person in question lives in the household and is of school age or not. The Authority explained above that the birth certificate contains personal data that are not relevant for determining age, so the applicant also submits a full copy of any document, the copy of the document and the processing of the data contained therein violates Article 5(1)(c) of the General Data Protection Regulation. Since the processing of the entire document and the data contained therein is not necessary and their processing is not prescribed by the Nftv. and the Government Decree – beyond the processing of the name and date of birth – the data processing is also without legal basis, and it also violates Article 6 (1) of the General Data Protection Regulation. (257) Regarding the practice that, in the case of students participating in public education at SZTE, the school attendance certificate for the given academic year is required, and from students with active status participating in full-time higher education, training, the student status certificate for the given semester is required, the Authority’s position is as follows. The Authority accepts the request for a school attendance certificate if the child has reached the age of 16. Act CXC. of 2011 on National Public Education 46/A. According to § 1, compulsory education is compulsory in Hungary until the age of 16, and Act I of 2012 on the Labour Code also allows employment at the age of 16. Therefore, the mere fact that a minor is a dependent and has no income, in relation to the proof of legal status, is unnecessary and without legal basis, and the processing of school attendance certificates and the processing of the data contained therein in the case of a child under the age of 16 violates Article 5(1)(c) and Article 6(1) of the GDPR. (258) The Authority refers to the fact that, in relation to the proof of close family relationship and common household, Section V.5.3. considers the data and documents processed by SZTE to be appropriate, while complying with the provisions of Article 5(1)(c) and Article 6(1) of the General Data Protection Regulation.
V.5.7. Costs associated with the care of a relative in need of care
(259) In this regard, the Authority refers back to the statements made in Sections V.5.1-V.5.3. and V.5.6. regarding the certification of the relationship and health status.
(260) The student's relative in need of care must be taken into account in such a way that the relationship, the fact of the condition in need of care and the costs associated with it can be established from the certification, without specifying specific, detailed health data or diseases.
V.5.8. Cases of exemption from the obligation to pay the dormitory fee
(261) The Government Decree stipulates that the points system must also take into account whether there is a circumstance under which the student is exempted from the obligation to pay the dormitory fee. These cases are as follows:
V.5.8.1. Disadvantaged situation
(262) Disadvantaged situation is an aspect that SZTE is obliged to take into account pursuant to Section 4 (4) of the Government Decree
and Section 41 (1) (a) of the Nftv., thus the data processed in order to establish this aspect
qualifies as data processed pursuant to Article 6 (1) (e) of the General Data Protection Regulation.
(263) The concept of disadvantaged situation is defined in Section 67/A. (1) of the Gyvt.
(264) SZTE requests proof of the disadvantageous, cumulatively disadvantageous situation as stated in paragraph (45).
(265) The Authority considers the handling of data and proofs relating to the disadvantageous situation to be appropriate, with the exception of the full environmental study. In the Authority's opinion, the environmental study may also include circumstances affecting the private sphere of the student concerned and his or her family, the handling of which is unnecessary and without legal basis on the part of SZTE.
67/A. According to § (1)-(2), the environmental study may include data on the parents’ – where applicable – low educational attainment, low employment, long-term job-seeking status, as well as data on the student’s inadequate living environment that does not ensure healthy development, or on the student’s housing conditions, or whether the student is in foster care or receiving aftercare. The processing of complete environmental studies containing a detailed examination of these circumstances and the personal data recorded in them is without legal basis and unnecessary in order to establish whether the student is in a disadvantaged or cumulatively disadvantaged situation and may be entitled to accommodation in a dormitory. (266) For this reason, the processing of the full environmental study by SZTE, which establishes a disadvantageous or cumulatively disadvantaged situation, violates the principle of data saving as set out in Article 5(1)(c) of the General Data Protection Regulation and, since the processing of the data is also without legal basis, it also violates Article 6(1)(c) of the General Data Protection Regulation. The Authority considers it appropriate for SZTE to accept a certificate that only states the fact that the student is in a disadvantageous or cumulatively disadvantaged situation, but does not provide a detailed explanation of the reasons for the disadvantageous or cumulatively disadvantaged situation. V.5.8.2. Orphanage
(267) Orphanage is an aspect that must be taken into account pursuant to Section 4 (4) of the SZTE Government Decree, and therefore the data processed in order to determine this aspect are classified as data processed pursuant to Article 6 (1) (e) of the General Data Protection Regulation.
(268) For this circumstance, SZTE also gives an additional point according to Annex 1 of the Scoring Rules and Annex 1 of the Regulations on the Electronic Application System for Social Scholarship Applications of the SZTE System.
(269) As stated in paragraph (45), SZTE requests proof of the fact of orphanhood by means of a death certificate, a divorce decree
or a declaration, or, if the birth certificates are lost, a certificate issued by the pension provider.
(270) In the Authority's opinion, it is appropriate practice for the SZTE to consider it necessary to prove cases of orphanhood with a death certificate, as this document can substantiate the fact of death.
(271) Orphanhood also entails a certain financial implication, in view of which the SZTE also requests the submission of a certificate issued by the pension provider, i.e. a document indicating the type of payment containing the fact of orphan benefits, which the Authority also considers appropriate.
Regarding the processing of a divorce decree or declaration, the Authority refers back to V.5.6. in point
, according to which the processing of divorce judgments, protocols and all personal data contained therein violates the principle of data saving pursuant to Article 5(1)(c) of the General Data Protection Regulation, and since there is no legal basis
for the processing of these data, it also violates Article 6(1)(c) of the General Data Protection Regulation.
V.5.8.3. Family breadwinner
(272) The status of family breadwinner is also an aspect that SZTE is obliged to take into account pursuant to Section 4(4)
of the Government Decree, thus the data processed in order to establish this aspect
qualifies as data processed pursuant to Article 6(1)(e) of the General Data Protection Regulation.
(273) The lists of certificates and the circumstances to be certified differ depending on whether the student is a breadwinner (including self-supporting or family breadwinner) or a dependent (including a dependent living with parents or a breadwinner other than parents, or whether he/she has reached the age of 25 or 60 or not).
(274) Section 2, point e) of the Government Decree defines the concept of breadwinner, and point f) defines the concept of extended family.
(275) To verify the status of breadwinner, SZTE requests the birth certificate of the student's child or a local government certificate of the existence of the child or a local government certificate of the care fee.
(276) In the case of a student with a large family:
a) birth certificate (in the case of a sibling under the age of 7),
b) school attendance certificate or, in the absence thereof, a copy of the student ID card (in the case of a sibling under the age of 18)
c) student status certificate or, in the absence thereof, a copy of the student ID card
(in the case of a sibling studying in higher education)
d) in the case of a sibling over the age of 18 with an income, a certificate of employment
or
e) guardianship certificate (even if the parents are not biological parents).
(277) The above aspects and the fact that the applicant student has his/her own child are aspects that SZTE is obliged to take into account pursuant to Section 4(4) of the Government Decree, given that pursuant to Section 2(1)(ea) of the Government Decree, a family breadwinner is someone who has at least one child, therefore it is necessary to know that the applicant has his/her own child. The data processed in order to establish this aspect are considered data processed pursuant to Article 6(1)(e) of the General Data Protection Regulation. (278) SZTE requests copies of the child(ren)’s birth certificates and student ID cards to prove the status of a family breadwinner and large family. (279) According to the Authority’s position already stated above, to prove this circumstance, it is sufficient to know the child’s name and date of birth, and the names of his or her parents, since if SZTE compares these data with the certificate of persons living in the same household, it can ascertain whether the person in question lives in the household and is of school age or not. (280) However, as stated above, the full birth certificate contains a significantly wider range of data than these. Submitting a full copy of the birth certificate therefore contravenes the principle of data economy, since it is not necessary to know all the personal data contained in this document to determine whether the student has a child of his or her own. In addition, SZTE has no legal basis for processing personal data beyond this. The data processing of SZTE thus violates the principle of data economy and is in breach of Article 5(1)(c) of the General Data Protection Regulation, and is also without legal basis and violates Article 6(1)(a) of the General Data Protection Regulation.
(281) Furthermore, the Authority is of the opinion that the case where SZTE requests a certificate of guardianship if one of the student's parents is not a biological parent (e.g. foster parent) is also not necessary and has no legal basis, given that SZTE requests other documents to prove the fact of cohabitation. For example, a certificate from a local government/government office stating the number of people living together in the property at the student's address, registered there or having a place of residence, or a statement signed by witnesses revealing the family structure. From the perspective of the status of the family breadwinner or the family structure, it is not relevant whether the parents are biological parents or not; the main thing is the breadwinner-dependent relationship. Consequently, this data processing by SZTE violates the principle of data economy
61 and Article 5(1)(c) of the General Data Protection Regulation, and is also without legal basis and violates Article 6(1)(c) of the General Data Protection Regulation.
V.5.8.4. Whose guardianship has ended due to their age
(282) Whose guardianship has ended due to their age is also an aspect that SZTE is obliged to take into account pursuant to Section 4(4) of the Government Decree, thus the data processed in order to establish this aspect are considered to be data processed pursuant to Article 6(1)(e) of the General Data Protection Regulation.
(283) SZTE requests a certificate issued by the guardianship authority to prove this based on the certification lists, which the Authority considers appropriate.
V.5.8.5. Other circumstances
(284) Section 41(1) of the Nftv. defines the cases of preferential treatment:
- disadvantaged applicants and students,
- those on unpaid leave to care for their child,
- those receiving childcare allowance, adoption allowance, childcare allowance, child-rearing allowance, home care allowance for children,
- those receiving childcare allowance or childcare allowance for their child,
- those belonging to the group of applicants and students with disabilities,
- those belonging to the group of applicants and students belonging to a nationality.
(285) The Authority has analysed these cases above, in connection with other aspects, and therefore refers back to the statements written in
above and does not repeat them.
(286) In the case of those on unpaid leave to care for their child, those receiving infant care allowance, adoption allowance, childcare allowance, child rearing allowance, child care allowance for home care of their child, or childcare allowance as other income recipients, according to the certification lists, “other income (e.g. GYES, GYED, family allowance, care allowance, alimony, etc.) is only included in the (maintenance, etc.) income calculated in the calculation of per capita income if the breadwinner does not have any other income (salary, etc.) in addition to this. If the breadwinner does not have any other income (salary, etc.) in addition to this, then GYES, GYED, family allowance, care allowance, alimony, and similar for benefits of this nature, the required
certificate: a certificate issued by the authorized body (e.g. local government, NYUFIG).
If the breadwinner also has other income (salary, etc.),
then GYES, GYED, family allowance, care allowance, alimony and similar benefits
are only for information purposes; in this case, it is not necessary to
confirm these data.”
(287) The Authority considers these to be appropriate.
(288) Furthermore, based on the documents and statements sent to the Authority, SZTE does not
treat nationality as a preferential circumstance.
(289) SZTE also stated that in the case of various declarations and certificates, in order to ensure the official
format, legal certainty and to avoid abuse, it considered
62
necessary to indicate the identity card numbers of the witnesses during the period under review.
(290) In this regard, the Authority draws attention to the fact that, according to Section 18(5) of Act LXVI of 1992 on the registration of personal data and addresses of citizens (hereinafter: the Act), the body maintaining the personal data and address register shall provide data to the applicant indicating the document identifier on the issue, validity, loss, theft, destruction, finding, or circumvention of documents without proof of the purpose and legal basis for the use. Since by providing the document identifier, the applicant cannot obtain any other additional data from the register, recording the document identifier is justified only if there is doubt about the validity or authenticity of the identity card, otherwise - in view of the principle of data economy - the handling of the document identifier is unlawful. In the absence of this, as in the present case, when SZTE requests certain statements and certificates (Annexes 3, 4, 5, 6, 7 of the list of certificates) by recording the identity card numbers of the witnesses, in order to ensure legal certainty and to avoid abuse, it also carries out data processing without legal basis, thereby violating Article 5(1)(c) and Article 6(1)(e) of the General Data Protection Regulation. V . 6 . C o m p l i c a t i o n o f d a t i o n (291) Article 5(1)(a) of the General Data Protection Regulation requires that personal data be processed lawfully and fairly and in a manner transparent to the data subject. Recital 39 of the General Data Protection Regulation specifies that individuals should have transparency about how their personal data are collected, used, accessed or otherwise processed. The principle of transparency is implemented through prior information to the data subject. The principle of transparency requires that information and communication relating to the processing of personal data be easily accessible and intelligible and that it be expressed in clear and plain language. This principle applies in particular to the information to be provided to data subjects about the identity of the controller and the purposes of the processing, as well as to further information to ensure that the personal data of the data subject are processed fairly and transparently, and to the information that data subjects have the right to obtain confirmation and information about the data processed about them. The natural person must be informed of the risks, rules, guarantees and rights relating to the processing of personal data and of how to exercise the rights conferred on him/her in relation to the processing.
(292) According to recital (60) of the General Data Protection Regulation, the data subject must be provided with all information necessary to ensure fair and transparent processing.
(293) One of the requirements for lawful processing is therefore that the controller, while ensuring the principle of transparency, provides the data subject with prior information on the way and circumstances in which his/her personal data will be processed. This right is intended, on the one hand, to make the data subject aware that the controller intends to process personal data concerning him/her.
On the other hand, this information enables the data subject to assess the impact of the intended processing on his/her privacy and the other risks and dangers it entails. Finally, the information provided enables data subjects to exercise their right to informational self-determination.
(294) The requirement for prior information to be provided to the data subject is detailed in Article 13.
63 of the GDPR. Accordingly, data subjects must be provided with detailed information containing the information referred to in Article 13(1) to (2) of the GDPR.
(295) In the present case, regarding the information provided to applicants regarding the data processing related to the dormitory admission procedure, SZTE stated that applicants can obtain information from the Dormitory Regulations, the Scoring Regulations, the call for applications for the current semester published by the EHÖK on the online platform, and the following documents related to it:
- Simplified list of certificates,
- List of certificates including the declarations to be filled in,
- Points system,
- Subjective points system,
- Per capita income,
- Date criteria,
- Guide to the Modulo system,
- Frequently asked questions (FAQ), etc.
(296) The Authority examined the documents to what extent they comply with Article 13(1)-(2) of the General Data Protection Regulation, the extent to which the SZTE has complied with its obligation to provide information, and the extent to which the data processing under review complies with the requirement of transparency. (297) After reviewing the documents, the Authority makes the following findings: (298) Article 12(1) of the General Data Protection Regulation includes among the requirements for transparent information, communication and measures for the exercise of the rights of the data subject that the data controller shall take appropriate measures to provide the data subject with all information referred to in Article 13 relating to the processing of personal data, in a concise, transparent, intelligible and easily accessible form, in clear and plain language. (299) The “readily accessible” requirement means that the data subject does not have to search for the information, but it must be immediately clear to him where and how he can access the information.5 All the information intended for the data subjects must be made available to them in one place or in a complete document, which they can easily access if they are interested in the information as a whole.6
(300) Transparency is therefore facilitated and complies with the principle of transparency if a uniform regulation or document contains information on data processing.
(301) Based on the combined knowledge of the documents referred to by SZTE, although the applicant is aware that the social situation assessment is part and a condition of the dormitory admission procedure, he/she is informed about what data and certificates are required to submit the application, i.e. on this basis about the scope of the processed data. However, the additional information specified in Article 13 (1)-(2) of the General Data Protection Regulation is not included in the above documents referred to by SZTE. This is different from the Dormitory Regulations and the “Declaration 04” on the “General Social Situation Assessment
Datasheet” on the Modulo interface, as described below, which contain additional information on data processing
5 Paragraph 11 of the Article 29 Working Party Guidelines on Transparency under Regulation (EU) 2016/679
The guidelines are available at the following link: https://www.naih.hu/files/wp260rev01_hu.pd
6 Paragraph 33 of the Article 29 Working Party Guidelines on Transparency under Regulation (EU) 2016/679
64
(302) In addition, the Guide to the Modulo system and the Modulo2 case description clearly state that admission to the dormitories of SZTE is possible after completing the “General Social Situation Assessment Form” in the form attached to the form. The case description also states that the basis for admission to the dormitories is the points obtained on the “General Social Situation Assessment Form” based on the student’s social situation. These documents therefore make it clear that the social situation assessment is part of the dormitory admission procedure. (303) For all these reasons, the Authority states in connection with the information that the fact that data subjects have to select the relevant information from several different documents in order to map out the data processing process they are subject to is contrary to the principle of transparency pursuant to Article 5(1)(a) of the General Data Protection Regulation.
(304) The 2007 Dormitory Regulations, as cited in paragraph (111) of the resolution, repeat the provisions of Section 21 of the Government Decree on the social situation of the student, and do not contain any further information relating to data processing, thus violating Article 13(1)-(2) of the General Data Protection Regulation.
(305) The Dormitory Regulations of 27.06.2022 contain the provisions cited in paragraph (110), basing the data processing on consent pursuant to the Infotv. Therefore, contrary to the statements made by SZTE, this Dormitory Regulation does not base the data processing related to the dormitory admissions procedure on the legal basis of Article 6(1)(e) of the General Data Protection Regulation, but on consent pursuant to the Infotv. (306) With this incorrect information, SZTE creates the impression that students can decide for themselves whether to consent to the processing of their personal data or not. This misleading information is particularly inappropriate because if the data processing were based on consent, the data subject could withdraw it at any time or request the deletion of his or her personal data, although he or she does not have the possibility to do so, since the data processing is actually so-called mandatory data processing, which is based on Article 6(1)(e) of the General Data Protection Regulation. Despite the declaration submitted to the Authority by SZTE on the appropriate legal basis and that the deletion of personal data processed pursuant to the law cannot be requested, the data subjects are not aware of SZTE’s declaration, only of the information recorded in the information and regulations published by SZTE for them. The Authority therefore finds that SZTE violated the principle of transparency under Article 5(1)(a) of the General Data Protection Regulation and Article 13(1)(c) of the General Data Protection Regulation by providing incorrect information on the legal basis. (307) The Dormitory Regulations of 27.06.2022 also do not comply with Article 13(1)-(2) of the General Data Protection Regulation, because they do not contain the information listed there. Furthermore, these parts of the Dormitory Regulations are erroneously based on the provisions of the Infotv. The rules of the Data Protection Act were cited as the legal regulation that SZTE must comply with. However, data processing related to dormitory admissions falls under the scope of the General Data Protection Regulation, so data processing must be carried out based on the rules of the General Data Protection Regulation, not the Infotv. In addition, the regulations provide incorrect information about the legal basis based on the above, data processing purposes can be read as application assessment and waiting list procedure, but do not contain information about other circumstances of data processing. This violates Article 13 (1) (b)-f) and (2) of the General Data Protection Regulation. (308) The Points Regulations (2011) contain the detailed rules of the dormitory admissions procedure, including the fact that in the points system, a certain part of the points are awarded to the applicant for his or her social 65 situation. The regulations also include, among other things, the rules for calculating the points that can be awarded to the applicant's social situation, the roles and tasks of the staff participating in the various committees. They also state that the documents proving the authenticity of the facts and data indicated in the application initiating the dormitory admission procedure must be submitted in copies and uploaded to the electronic (internet) application system supervised by the SZTE EHÖK. Annex 1 to the regulations specifies the factors and aspects related to the applicant's social situation that SZTE takes into account when scoring. The regulations refer to the Government Decree and the no longer effective Act CXXXIX of 2005 on Higher Education as the laws that allow SZTE to provide dormitory accommodation for its students, and to this end, they specify the rules of the admission procedure. Apart from these, it does not contain information in accordance with Article 13(1)-(2) of the General Data Protection Regulation.
(309) Annex 1 to the regulations of the SZTE on the electronic application system for regular social scholarship applications (25 November 2013 and 30 October 2023)
also contains the rules for calculating the points that can be awarded to the applicant's social situation
as relevant information regarding the data processing examined in this case, but does not contain further information covering the information specified in Article 13(1)-(2) of the General Data Protection Regulation.
(310) The “Declaration 04” in the “General Social Situation Assessment Data Sheet” available on the Modulo interface, cited in paragraph (41) of the decision, also provides information on consent during the period under review, when it states that the data subject expressly consents to the use by the persons entitled under the relevant regulations and laws of the data subject’s data provided by the data subject during the application and otherwise recorded in the “ETR” electronic system, to the extent necessary for the assessment of the individual student benefits. (311) A separate data processing purpose, in connection with which “Declaration 04” states that the data subject further consents to the persons entitled to data processing establishing e-mail or telephone contact with him/her via the contact details provided (in particular: e-mail address, telephone number) to the extent necessary. (312) Furthermore, the “Statement 04” contains the information that the data subject acknowledges the information that, in connection with the processing of his/her personal data, the provisions of Act LXXIII of 1992 on the Protection of Personal Data and the Public Disclosure of Data of Public Interest, Act CCIV of 2011 on Higher Education, and the relevant regulations of the University of Szeged shall apply; in the event of any alleged violation of his/her rights related to data processing, he/she may report it to the head of the organizational unit concerned by the service. (313) In addition to incorrectly providing information on the legal basis for consent, the “Statement 04” also refers to a long-invalid law, Act LXXIII of 1992 on the Protection of Personal Data and the Public Disclosure of Data of Public Interest (hereinafter: the Act on the Protection of Personal Data and the Public Disclosure of Data of Public Interest). However, during the period under review, the General Data Protection Regulation shall apply to data processing, as has already been stated above. (314) With this false information, SZTE creates the impression that applicants can decide for themselves whether to consent to the processing of their personal data or not. Despite the declaration submitted to the Authority by SZTE, the data subjects are not aware of this, only of the information recorded in the information and regulations published by SZTE for them. The information placed on this interface plays a special role because, even if the applicant does not search for the other declarations, “Declaration 04” – since the application can be submitted on the Modulo interface – is encountered by all applicants when filling out the electronic data form and submitting the application, so the misleading information provided here is a particularly serious violation of the law. The Authority therefore also states in relation to “Statement 04” that SZTE violated the principle of transparency under Article 5(1)(a) of the General Data Protection Regulation and Article 13(1)(c) of the General Data Protection Regulation by providing incorrect information about the legal basis.
In addition, “Statement 04” does not contain the additional information under Article 13(1)-(2) of the General Data Protection Regulation.
(315) The other documents referred to by SZTE, the Simplified list of certificates, the list of certificates including the declarations to be filled in, the Points system, the Subjective points system, the Per capita income, the Dating criteria, the Guide to the Modulo system, the Frequently Asked Questions (FAQs) also do not contain the information pursuant to Article 13(1)-(2) of the General Data Protection Regulation, but rather show what certificates need to be attached in what way in the procedure, and how and according to what criteria the points are awarded.
(316) Based on the above, it can be concluded that there is no uniform, clear data management information in connection with the dormitory admission procedure. The documents considered by SZTE to be information not only contain individual, isolated errors, but also do not contain any information required by Article 13 (1)-(2) of the General Data Protection Regulation. On the other hand, the Dormitory Regulations and the “Declaration 04” contain so many professional errors and content deficiencies that, both individually and collectively, they are unsuitable for providing accurate and transparent information in accordance with the legal requirements. The accumulation of errors indicates a systemic problem: the structure of the documents is disorganized, the definition of the legal basis is imprecise, the Dormitory Regulations and “Declaration 04” refer to the Information Act and the ineffective Avtv, while the Scoring Regulations refer to the already ineffective Nftv of 2005. All of this causes such a degree of difficulty in understanding and transparency that the data processing processes and the circumstances of the data processing are not known to the data subject and are not clear, or are not transparent in their entirety and comprehensively. (317) It can also be stated that none of the documents analyzed above, as well as “Declaration 04”, contain information that SZTE also processes the personal data of third parties – for example, relatives living in the same household as the student concerned – in the dormitory and social situation assessment procedure, so the information is also incomplete in this respect. (318) Summarizing all of this, it can be stated that due to the inadequate information, SZTE has in general violated the principle of transparency pursuant to Article 5(1)(a) of the General Data Protection Regulation and Article 13(1)-(2) of the General Data Protection Regulation. (319) SZTE must provide information on data processing related to the dormitory and social situation assessment procedure that is transparent and contains all the conditions of data processing specified in Article 13 (1)-(2) of the General Data Protection Regulation, including the fact that SZTE also processes the personal data of the relatives of the student concerned in connection with the procedures. The uniform, transparent data processing information must be published on SZTE's interfaces where all data subjects, including the relatives of the applicant students, can access it in advance, before the data processing begins, and not only through the Modulo interface that requires registration and access rights.
67
V . 7 . C h a n g e s t i n g d a t i o n s d u r e d i n g d a t i o n s t i n g d i n g s t i o n to eliminate the data protection practices and the lack of legal basis for the processing of personal data and the inadequate information and the lack of transparency described in Section V.6. and to delete the personal data stored in accordance with these and to provide the appropriate information.
(322) The Authority examined whether it was justified to impose a data protection fine on SZTE, and in this regard, the Authority considered all the circumstances of the case on the basis of Article 83(2) of the General Data Protection Regulation, on the basis of which it concluded that a fine was necessary, due to the following aspects.
(323) When determining the amount of the fine, the Authority first of all took into account that
the infringements committed by SZTE qualify as infringements falling under the higher fine category according to Article 83(5) of the General Data Protection Regulation.
(324) When determining the amount of the fine, the Authority took into account the provisions of the European Data Protection Board's Guideline No. 4/20227 (hereinafter: the Guideline), which contains the calculation criteria for imposing administrative fines under the General Data Protection Regulation.
(325) In view of this, the amount of the fine was determined based on the following criteria:
(326) SZTE committed the infringements with one conduct [infringement of Article 5(1)(a) and (c), Article 6(1), Article 9(2) and Article 13(1)-(2) of the General Data Protection Regulation].
(327) The infringements committed by SZTE – the infringement of the provisions on the principles, legal basis of data processing, processing of sensitive data, rights of data subjects – are considered to be more serious infringements falling under the higher fine category pursuant to Article 83(5)(a) and (b) of the General Data Protection Regulation, for which the upper limit of the fine is EUR 20 million or, in the case of an undertaking, 4% of its annual turnover, whichever is higher. According to the latest publicly available annual report for 20248, SZTE’s annual net sales revenue was HUF 94,788 million.
4% of this amount is 3,792 million HUF, which corresponds to 9.96 million EUR, i.e. it does not reach the general
7 https://naih.hu/europai-adatvedelmi-testulet-iranymutatasai-uj-beta?download=812:04-2022-szamu-
iranymutatas-a-gdpr-szerinti-kozigazgatasi-birsagok-kiszamitasarol
8 https://u-szeged.hu/egyetemrol/szamviteli-beszamolok/szte-2024-evi-eves
68
the static maximum fine set out in Article 83(4) of the General Data Protection Regulation,
the amount corresponding to 20,000,000 EUR, so SZTE can be fined a maximum of 20,000,000 EUR in the present case.
(328) When determining the amount of the data protection fine, the Authority took into account as aggravating circumstances that:
- the infringements occurred continuously over a longer period of time during the 2022-2024 academic year under review [Article 83(2)(a) of the General Data Protection Regulation];
- the infringements affected a relatively high number of data subjects. During the review period, a total of 13,754 admissions were made to the dormitories of SZTE, each of which included a social situation assessment. This number does not correspond to the total number of data subjects, given that a data subject could be admitted in each semester, so in such a case their data could be recorded more than once, and this number does not include the number of relatives of the data subjects, whose personal data are also processed by SZTE. Taking this circumstance into account, the number of people affected by data processing can be considered high, which does not include how many students filled out the general social situation assessment form in the examined period to apply for other benefits outside the dormitory admission procedure, such as the regular social scholarship, since SZTE does not have separate data on the number of people who filled out the social situation assessment form [General Data Protection Regulation, Article 83 (2) a)]; - the unlawful data processing also involves the processing of special (health) data [General Data Protection Regulation, Article 83 (2) g)]; - after the General Data Protection Regulation became applicable on 15 May 2018, approximately 7 years later, the “Declaration 04” on the general social situation assessment form available on the Modulo platform still referred to the Avtv as the applicable law for the processing of personal data, basing the data processing on the legal basis of the data subject’s consent, while the Dormitory Regulations of 27 June 2022 specify the Infotv as the applicable law, thus seriously misleading the data subjects [Article 83 (2) point k) of the General Data Protection Regulation]. (329) When determining the amount of the data protection fine, the Authority took into account as mitigating circumstances that: - SZTE committed the infringements negligently, given that, based on the available data, the infringements resulted from an inadequate legal environment and a misinterpretation of the existing legal requirements, and not from the fact that SZTE had intentionally intended to continue its data processing [Article 83(2)(b) of the General Data Protection Regulation]; - SZTE has not yet been convicted of a breach of the General Data Protection Regulation [Article 83(2)(e) of the General Data Protection Regulation]; - SZTE – after the period under review, during the Authority’s proceedings – initiated measures to eliminate the infringement [Article 83(2)(f) of the General Data Protection Regulation]; - SZTE is a private higher education institution operating as a public benefit organisation performing a public task [Article 83(2)(k) of the GDPR];
- the Authority exceeded the administrative deadline, which resulted in the delay of the procedure [Article 83(2)(k) of the GDPR].
(330) In imposing the data protection fine imposed on SZTE, the Authority established that the circumstances referred to in Article 83(2)(c), (d), (h), (i), (j) of the GDPR did not exist.
69
(331) Taking into account the above aspects, the Authority concluded that the violations committed by SZTE are considered to be of medium seriousness, given that they also affect sensitive data, in several cases unnecessary and unfounded data is processed, and incorrect information was provided, as a result of which the data subjects received incorrect information that the data processing is based on their consent and on legal regulations, one of which has already been completely repealed (Avtv.), while the other (Infotv.) is not applicable to the data processing examined in the present case.
(332) According to the Authority, the fine imposed can be considered proportionate to the gravity of the violations, the above aspects, and the aggravating and mitigating
circumstances.
(333) Furthermore, the decision will be published on the Authority’s website pursuant to Section 61(2)(b) of the Information Act, as the Authority has made it in connection with the activities of SZTE as a body performing a public task, and wishes to draw the attention of other higher education institutions to the requirements of lawful data processing, and to ensure that the large number of affected individuals also become aware of the data and certificates that SZTE and other higher education institutions are entitled to process.
(334) Based on the above, the Authority has decided as set out in the operative part.
V I I . O ther is s u p s s
(335) The Authority’s competence is limited by the Information Act. Section 38 (2) and (2a) of the Act, its competence extends to the entire territory of the country.
(336) The present decision of the Authority is based on Sections 80-81 of the Act and Section 61 (1) of the Information Act. The decision shall become final upon its publication pursuant to Section 82 (1) of the Act. Pursuant to Section 112, and Section 116 (1) and (4) d) of the Act, and Section 114 (1) of the Act, the decision may be appealed against through administrative proceedings.
* * *
(337) Pursuant to Section 135 of the Act, the debtor shall pay a late payment surcharge in the amount corresponding to the statutory interest if he fails to fulfil his payment obligation within the deadline.
(338) Pursuant to Section 6:48. (1) of Act V of 2013 on the Civil Code, in the event of a financial debt, the debtor shall pay default interest at a rate equal to the central bank base rate valid on the first day of the calendar half-year affected by the delay, starting from the date of default.
(339) The rules of administrative litigation are determined by Act I of 2017 on the Code of Administrative Litigation (hereinafter: the Code).
(340) Pursuant to Section 12. (1) of the Code, administrative litigation against the decision of the Authority falls within the jurisdiction of the courts, and the Metropolitan Court has exclusive jurisdiction over the litigation pursuant to Section 13. (3) a) aa) of the Code.
(341) Pursuant to Section 27(1)(b), legal representation is mandatory in administrative proceedings falling within the competence of the court. Pursuant to Section 39(6) of the Civil Procedure Code, the submission of a statement of claim shall not have a suspensive effect on the entry into force of the administrative act.
(342) Pursuant to Section 29(1) of the Civil Procedure Code and, in this regard, to Section 604 of Act CXXX.
70 of 2016 on the Code of Civil Procedure, and pursuant to Section 19(1)(b) of Act CIII. of 2023 on the Digital State and Certain Rules for the Provision of Digital Services, the client’s legal representative is obliged to maintain electronic contact.
(343) The time and place of submission of a statement of claim shall be determined by Section 39(1) of the Civil Procedure Code. Information on the possibility of requesting a hearing shall be provided in the Civil Procedure Code. It is based on Section 77 (1)-(2).
(344) The amount of the administrative litigation fee is determined by Section 45/A. (1) of Act XCIII of 1990 on Fees
(hereinafter: Itv.). The party initiating the procedure is exempted from paying the fee in advance by Section 59 (1) and Section 62 (1) h) of the Itv.
(345) If the SZTE fails to adequately prove the fulfillment of the prescribed obligations, the Authority
shall consider that it has not fulfilled its obligation within the deadline. According to Section 132 of the Ákr., if the
client has not fulfilled the obligation set out in the final decision of the Authority, it
may be
enforced. The decision of the Authority shall become final upon notification according to Section 82 (1) of the Ákr. Pursuant to Section 133 of the Tax Code, enforcement shall be ordered by the authority that made the decision, unless otherwise provided by law or government decree. Pursuant to Section 134 of the Tax Code, enforcement shall be carried out by the state tax authority, unless otherwise provided by law, government decree or, in the case of a local government, a local government decree. Pursuant to Section 61 (7) of the Information Act, the Authority shall implement the decision in respect of the obligation to perform a specific act, to engage in specific conduct, to tolerate or to cease performing a specific act.
Budapest, 20 February 2026.
Dr. habil. Attila Péterfalvi
President
c. university professor