NAIH (Hungary) - NAIH-5361-1/2022
|NAIH - NAIH-5361-1/2022|
Article 12(3) GDPR
Article 15(1) GDPR
Article 15(3) GDPR
|Parties:||Budapest Bar Association|
|National Case Number/Name:||NAIH-5361-1/2022|
|European Case Law Identifier:||n/a|
|Original Source:||NAIH (in HU)|
The Hungarian DPA held that the Budapest Bar Association violated Article 15 and Article 12 GDPR by failing to timely reply to an access request. The fact that the Association's offices were closed had no relevance on the deadline.
English Summary[edit | edit source]
Facts[edit | edit source]
The data subject had been a member of the Budapest Bar Association (the controller) until 2011 when their membership was terminated after their failure to pay their membership fees in time. On 1 October 2020, the data subject requested information about their account balance and the decision on the termination of their membership. After they did not receive the information asked for, they sent another request to the controller on 12 December 2020, referring to Article 15(1) GDPR, and asking for information relating to their account balance, the amount of their debt, the legal basis of the registered debt and the existence of the suspension and termination decisions. On 4 February 2021, the data subject complained to the DPA that the controller did not provide them with access to this information which constituted their personal data.
In its submission to the DPA, the controller claimed that the data subject’s communication from 1 October 2020 did not qualify as an access request within the meaning of the GDPR. Additionally, the request from 12 December 2020 was only received by the controller on 23 December 2020. Since the offices of the controller were closed between 19 December 2020 and 3 January 2021, the controller claimed that the time limit for complying with the access request only started running on 4 January 2021. The controller claimed that due to the complexity of the request, it was entitled to extending the deadline by additional two months as provided for in Article 12(3) GDPR. Hence, the controller considered itself to have properly provided access to the data subject within the time limit when it replied to the data subject’s request on 2 April 2021.
Holding[edit | edit source]
The DPA considered the communication sent by the data subject on 1 October 2020 to be too general to qualify as an access request. On the other hand, it regarded the communication sent on 12 December 2020 and received on 23 December 2020, which explicitly referred to the data subject‘s rights under the GDPR, as a proper access request from the data subject. The DPA further held that because the time limit set in Article 12 GDPR is calculated in calendar days and not in working days, the time limit for complying with the request started running on 24 December 2020 and not on 4 January 2021. Contrary to the controller’s assertions, the calculation of the time limit is not affected by the leave arrangements of the controller, as it is obliged to organise its work in such a way that it complies with the provisions of the GDPR. Consequently, the deadline for complying with the data subject's access request had already passed when the controller replied on 2 April 2021.
In addition, although the controller claimed that the complexity of the request entitled it to extending the deadline for replying by further two months, the data subject was not informed of any such extension and the reasons for it as required under Article 12(3) GDPR. The controller was also unable to supply evidence of any internal decision made to actually extend the deadline. Lastly, whilst the controller could have possibly refused to comply with the access request for being too excessive under Article 12(5) GDPR, it did not invoke this ground in its letter to the data subject sent on 2 April 2021.
Consequently, the DPA held that the controller violated Article 15(1) and (3) and Article 12(3) GDPR by not replying to the access request within the time limit and for not complying with the requirements relating to the extension of the deadline.
Comment[edit | edit source]
The complaint was only partly upheld because the DPA refused to order the controller to comply with the access request. Instead, it only issued a warning.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.
Case number: NAIH-5361-1 / 2022. Subject: Partial decision granting the application History: NAIH-2160/2021. H A T A R O Z A T The National Authority for Data Protection and Freedom of Information (hereinafter referred to as the Authority) […] (domiciled in […].) Infringement of the right of access of the applicant (hereinafter: the Applicant) on 4 February 2020 with the Budapest Bar Association (registered office: Szalay utca 7. 1055 Budapest) hereinafter referred to as the "Requested"), shall take the following decisions in the data protection authority proceedings against: I. In the part of the Authority's application gives place and I.1. Finds that the Applicant has infringed Article 15 (1) and (3) of the General Data Protection Regulation and Article 12 (3) of the General Data Protection Regulation by The applicant did not reply to his request dated 23 December 2021 within the deadline. I.2. The Authority shall request the part of the application in which the Authority instructs the Requested access request is rejected. I.3. The Authority shall due to another breach of data protection increased the present infringement as a precedent in determining the legal consequences weight will be taken into account - warns. There is no administrative remedy against the decision, but it must be lodged 30 days after notification An action brought before the Metropolitan Court may be challenged in an administrative action within one day. THE shall lodge the application electronically with the Authority, which shall forward it together with the case file to the court. The request to hold a hearing must be indicated in the application. The whole personal For those who do not receive an exemption, the fee for the administrative lawsuit is HUF 30,000, the lawsuit is material subject to the right to record duties. Legal representation is mandatory in proceedings before the Metropolitan Court. Act CXII of 2011 on the right to information self-determination and freedom of information. Act (a hereinafter: Infotv.) Section 61 (2) (b), the Authority shall publish this decision in the Authority website. I N D O K O L Á S I. Procedure and clarification of the facts The Applicant submitted a request to the Authority on 4 February 2021 for a data protection official procedure. according to which, as a former member of the Applicant, he has been trying for several years to achieve that the Applicant provide adequate information on your account balance and the reasons for the items in it; and legal basis. For this reason, on 1 October 2020, the To the applicant requesting that the suspension and exclusion decision be sent to him or the registered account balance, and also applied for access by mail on 12 December 2020 with reference to the Applicant and Article 15 (1) of the General Data Protection Regulation, requested that inform you of the processing of your personal data and of any other circumstances referred to in paragraph 2 Article 15 (1) of the General Data Protection Regulation. The Applicant also requested a Applicant to inform the registrant of the account balance, debt, the registrant and the suspension and exclusion of the 2011 membership fee for non-payment decision, their existence. The Applicant did not receive a response to its inquiries from the Applicant until its request to the Authority. During the examination of the application, the Authority established that the application was submitted to Infotv. Section 60 (5) did not comply because it did not contain a decision on the decision to remedy the alleged infringement application, therefore the Authority dated 19.02.2021, NAIH-2160-3 / 2021. order no called on the Applicant, which was issued by the Applicant on 05.03.2021 and addressed to the Authority on 03.03.2021. In its reply received on the 10th day, the Authority complied with and requested an explicit decision from the Authority on the rights of the data subject. and asked him to warn the controller of the breach, and instruct the data controller to comply with the data subject's request, as well as sanctions, administrative fines requested the Authority to impose. By filling in the deficiencies of the Applicant on March 10, 2021 has become complete. NAIH-2160-5 / 2021, dated 18 March 2021, received by the Applicant on 24 March 2021. number In his order, the Applicant requested clarification of the facts and informed the Authority that the facts set out in the clarification order are in part disputed, as the Applicant For some of the questions asked in your application to the applicant before received information. In his statement, the Applicant stated that the Applicant was obliged to pay the membership fee on time did not comply, therefore, following three notices, the Applicant issued a decision on 04.07.2011 by administrative decision of 4 July 2011, the Presidency of the from the membership register. This decision became final on 24.08.2011. Then the Applicant's balance It showed a debt of HUF […]. The Applicant contacted the Applicant on 18.10.2017 and inquired that “in 2011 administrative cancellation due to non-payment of membership fees or suspension due to criminal proceedings " is an obstacle to the recruitment of legal counsel. The Applicant will answer this question on the same day received. Thereafter, correspondence continued between the Applicant and the Applicant, during which the balance of the Applicant registered with the Applicant was mentioned. The membership fee debt due to which the The Applicant has been deleted by administrative means, in the meantime it has expired, so the Applicant has informed the Applicant that that the REFUND OF MEMBERSHIP FEE AND LATE FEES [...] cost. In addition to the above, the Applicant's Disciplinary Board for committing a disciplinary offense He was fined HUF 150,000 and, in addition, as a total procedural expense He should have paid HUF 65,300. The disciplinary decision became final on 7 June 2013. THE Regarding the disciplinary fine, the Applicant received a letter of formal notice from the Applicant on 22.07.2015. Since the the Applicant sent a demand for payment in a verifiable manner, therefore the limitation period started again. The competent chamber clerk therefore also informed the Applicant that that it is necessary to pay the fine and the costs of the proceedings in Case F […] 2012; the amount of which is HUF 215,300. According to the Applicant, the Presidency of the Applicant took a decision on 07/09/2020, under which bad debts can be written off. As the Applicant is liable to disciplinary action and its debt arising from procedural costs expired on 22/07/2020, therefore the debt was canceled. Accordingly, on the basis of the Applicant's statement, the Applicant he had no registered debt on. According to the Applicant's statement, the Applicant's request for access dated 12 December 2020 a It was received by the applicant on 23.12.2020. According to the Applicant, the service provider 's office and Its headquarters were closed from 19 December 2020 to 1 January 2021, as every year. no administrative work was carried out, so the deadline for administration started on 04.01.2021. As the request for personal data in addition to personal records therefore the complexity of the request under Article 12 (3) of the General Data Protection Regulation Within one month of receipt of the request, the applicant shall reply to the request within 3 months it was not possible to extend the deadline by another month. THE Applicant does not dispute that the extension of the deadline and the reasons for it are not the Applicant informed in accordance with that paragraph, but in its view, the replied to the Applicant's letter on 02.04.2021 within the extended deadline. The Applicant has attached the application of the Applicant dated 12 December 2020, the ELN. […], a 2016. ELN. […] And its data management prospectus, and on 02.04.2021 a He sent a reply letter to the applicant. The Applicant further informed the Authority that its data processing is in principle in accordance with Section 6 (1) (c) of the GDPR. and (e). According to the Applicant's statement, the relevant legislation - the lawyers 1998 XI. Act LXXVIII of 2017 on the activity of a lawyer. Act (a hereinafter: Üttv.) - specify the scope of data to be registered, which data to store also subject to statutory regulation. The Applicant also referred to the Üttv. § 11, according to which it is not possible to attach a It made individual decisions in relation to the applicant with regard to the obligation of confidentiality. The Authority has issued NAIH-2160-7 / 2021. by order no., called on the Applicant to prove that The deadline for replying to the applicant 's request was extended by two months certify that the Authority has already collected the information needed to respond to the request started before learning of the start of the procedure. In addition, the Authority requested that: state exactly what you consider to be legal professional privilege in the present case and justify why the lawyer's duty of confidentiality. By letter received on 25 May 2021, the Applicant informed the Authority that the April 2021 It maintains the contents of its letter of 8 June with unchanged content, so that, in their interpretation, it is general Article 12 (3) of the Data Protection Regulation allows for an additional 60 days after 30 days extension of the deadline, so he calculated the two-month extended deadline, which he said It began on January 4, 2021 and expired on April 4, not exceeded. In this statement, the Applicant further stated that the Articles of Association set out in detail the Duties falling within the competence of the requested officers. Given that the first round of the request concerned financial data, so on 4 January 2021, the beginning of the administrative period, for the first time it became necessary to clarify the financial issues, so within 2021. On 29 January, the Data Protection Officer also received the material. It was received from each department The next task was to coordinate and compare the responses, to evaluate the data received and following its decision, for the evaluation of which an external colleague was also involved on 5 February 2021. The deadline no internal record of the extension was made. And he obviously slowed down the process 104/2021 on the temporary tightening of protection measures, which will enter into force on 8 March 2021. (III.5.), According to which the personal appearance pursuant to Section 6 (1) the room or location for the purpose of the service was required to be kept closed. Regarding the collection of data concerning the financial records, the June 2013 The debt arising from the disciplinary decision that became final on the 7th day of the Applicant was closed in 2013 year. The records related to this financial year have already been filed, so its paper had to be retrieved from the archives. Data collection at the beginning of the administrative break at the beginning of the year began in the week beginning January 4, 2021. Gathering Information Required to Respond to an Applicant's Request for Access a According to the applicant, even before the Authority became aware of the proceedings started with the document entitled “Memorandum” dated 7 January 2021 certify. From this, it can be stated that debts related to the person of the Applicant have already been they are also mentioned in this note, the financial justification for their deletion, and and confirmation was needed. The Applicant did not dispute that he had not informed the Applicant about the fact of the extension of the deadline. THE According to the Applicant's statement, the response was that the Applicant's uncertainty had developed the situation should be clarified, notwithstanding the fact that it considers the Information to be provided to the Applicant in part already done., 4 The Applicant attached his full correspondence with the Applicant and on January 7, 2021 […] Document entitled "Note". In his statement, the Applicant explained that the scope of data to be treated as legal professional secrecy due to the diversity of its activities. This is also the reason for this Üttv, which establishes the obligation of confidentiality for a lawyer. nor does it contain guidelines. THE Act on the obligation of confidentiality only provides that the lawyer is bound by confidentiality shall be liable for all information and facts which come to his knowledge in the exercise of his profession learned. An exhaustive list of the elements of legal professional privilege is impossible in practice, as it is it can include the client's personal data and business secrets, and often the bank's or tax secrets family, medical and personal matters, where applicable facts concerning the family relations and state of health of the opposing party. In his statement, the Applicant stated that the agreement between the Applicant, the Applicant and the Authority the obligation of confidentiality is a special obligation of confidentiality, since according to the law a The applicant shall be bound by the obligation of professional secrecy, in order to comply with the fulfills its obligation to cooperate and provide information. Thus, Üttv. Section 11 (2) the individual decision of the Applicant in the disciplinary case, which, without the Applicant's excuse as a secret holder, the Applicant does not know to the Authority to bring. The Authority dated 16 August 2021, NAIH-2160-9 / 2021. case number in a clarification order invited the Applicant to declare that in the letter sent by the Applicant on 2 April 2021 whether you have answered the questions in your request for access dated 12 December 2020 or if so answer it, please indicate exactly why it is not suitable for you and which of your access requests affects point. The Applicant did not receive the order at his / her place of residence, the order was returned with the indication “did not seek” to the Authority. In view of this, the Authority, dated 21 September 2021, NAIH-2160-10 / 2021. case number repeatedly contacted the Applicant in the order. The Applicant did not take over the order at his place of residence, a order was returned to the Authority as "not sought". On October 25, 2021, the Authority dated, NAIH-2160-11 / 2021. The Court again contacted the Applicant in the order no The applicant did not accept the order, the order was returned to the Authority with the indication “not sought”. Given that NAIH-7362-1 / 2021. official of the case pending before the Authority is aware that the address of the Applicant is at […], therefore the Authority will dated November 24, NAIH-2160-12 / 2021. contacted the Applicant at his address in case no. The Applicant received the order on 2 December 2021, but no reply has been received to date. II. Applicable legal provisions Pursuant to Article 2 (1) of the General Data Protection Regulation, the processing of data in the present case is general data protection regulation applies. The relevant provisions of the General Data Protection Regulation in the present case are the following: Article 4 (1) of the General Data Protection Regulation: "personal data" means identified or identifiable any information relating to a natural person ("data subject"); identifiable by that natural a person who, directly or indirectly, in particular by means of an identifier such as a name, number, location data, online identification or physical, physiological, genetic, mental, on the basis of one or more factors relating to their economic, cultural or social identity identifiable. Under Article 12 (3) of the General Data Protection Regulation, the controller is unduly delayed but in any case within one month of receipt of the request concerned in accordance with Articles 15 to 22. on the action taken in response to a request under Article. If necessary, take into account given the complexity of the application and the number of applications, this deadline is an additional two months extendable. The extension of the deadline by the data controller shall be the reasons for the delay within one month of receipt of the request. If so, 5 the application has been submitted by electronic means, the information shall be provided, if possible by electronic means unless otherwise requested by the data subject. Pursuant to Article 12 (4) of the General Data Protection Regulation, if the controller does not do so measures at the request of the data subject, without delay but at the latest upon receipt of the request inform the person concerned of the reasons for not taking action within one month of that the person concerned may lodge a complaint with a supervisory authority and have recourse to the courts with the right. Information pursuant to Articles 13 and 14 pursuant to Article 12 (5) of the General Data Protection Regulation and 15-22. The information and action provided for in Articles 1 and 34 shall be provided free of charge. If concerned request is manifestly unfounded or, in particular due to its repetitive nature, excessive, the controller, the provision of the requested information or information or the taking of the requested action administrative costs: (a) charge a reasonable fee, or (b) refuse to act on the application. The burden of proving that the request is manifestly unfounded or excessive is on the controller. Pursuant to Article 15 (1) of the General Data Protection Regulation, the data subject is entitled to: receive feedback from the data controller that your personal data is being processed whether and if such data processing is in progress, you have the right to access your personal data and access to the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipients to whom the personal data have been disclosed or will be communicated, including in particular to third country recipients or international organizations; (d) where applicable, the intended period for which the personal data will be stored or, if that is not possible, this criteria for determining duration; (e) the data subject's right to request personal data concerning him or her from the controller rectification, erasure or restriction on the processing of such personal data and may object to the processing of such personal data against; (f) the right to lodge a complaint with a supervisory authority; (g) if the data were not collected from the data subject, all available information on their source; (h) the fact of automated decision-making referred to in Article 22 (1) and (4), including profiling and, at least in these cases, the logic used information on the significance of such data processing and what is expected of the data subject consequences. Pursuant to Article 15 (3) of the General Data Protection Regulation, the controller is the subject of the processing provide the data subject with a copy of the personal data Additional requested by the data subject for copies, the controller may charge a reasonable fee based on administrative costs. If the data subject submitted the application electronically, the information was widely used shall be provided in electronic format, unless otherwise requested by the data subject. Pursuant to Article 15 (4) of the General Data Protection Regulation, the copy referred to in paragraph 3 the right to claim must not adversely affect the rights and freedoms of others. Pursuant to Article 58 (2) (b), (c), (g) and (i) of the General Data Protection Regulation, the supervisory authority acting in its corrective capacity: (b) reprimand the controller or the processor if his or her data processing activities have infringed this provisions of this Regulation; (c) instruct the controller or processor to comply with the conditions laid down in this Regulation request for the exercise of his rights; (g) order the rectification of personal data in accordance with Articles 16, 17 and 18 respectively; or deletion of data processing and Article 17 (2) and Article 19 order the notification of the recipients with whom or with whom the personal data are held data were provided; (i) impose an administrative fine in accordance with Article 83, depending on the circumstances of the case; in addition to or instead of the measures referred to in paragraph 6 Article 83 (1) to (2) and (5) (a) to (b) of the General Data Protection Regulation: 1. Each supervisory authority shall ensure that the measures referred to in paragraphs 4, 5 and 6 administrative fines imposed pursuant to this Article for infringements of this Article shall be effective in each case, be proportionate and dissuasive. 2. Administrative fines shall be imposed in accordance with Article 58 (2) (a) to (h), depending on the circumstances of the case. and (j) shall be imposed in addition to or instead of the measures referred to in When deciding that whether it is necessary to impose an administrative fine or the amount of the administrative fine In each case, due account shall be taken of the following: (a) the nature, gravity and duration of the breach, taking into account the nature of the processing in question; the scope or purpose of the infringement and the number of persons affected by the infringement and the extent of damage; (b) the intentional or negligent nature of the infringement; (c) to mitigate any damage suffered by the controller or the data subject any action taken; (d) the extent of the responsibility of the controller or processor, taking into account the the technical and organizational measures taken pursuant to Article. (e) relevant infringements previously committed by the controller or processor; (f) with the supervisory authority to remedy the breach and mitigate any adverse effects of the breach the degree of cooperation in order to (g) the categories of personal data concerned by the breach; (h) the manner in which the supervisory authority became aware of the infringement, in particular whether the controller or processor has reported the breach and, if so, in what detail; (i) if, prior to the controller or processor concerned, one of the measures referred to in Article 58 (2) has been imposed compliance with measures; (j) whether the controller or processor has kept itself approved in accordance with Article 40 codes of conduct or approved certification mechanisms in accordance with Article 42; and (k) other aggravating or mitigating factors relevant to the circumstances of the case, such as: financial gain or avoidance as a direct or indirect consequence of the infringement loss. 5. Infringements of the following provisions in accordance with paragraph 2 shall not exceed EUR 20 000 000 or, in the case of undertakings, the full financial year of the previous financial year up to 4% of its worldwide turnover, provided that a higher amount should be charged: (a) the principles of data processing, including the conditions for consent, in accordance with Articles 5, 6, 7 and 9; (b) the rights of data subjects under Articles 12 to 22. in accordance with Article Infotv. Pursuant to Section 2 (2), the general data protection decree is indicated therein shall apply with the additions provided for in Infotv. Enforcement of the right to the protection of personal data pursuant to Section 60 (1) In order to do so, the Authority may initiate ex officio data protection proceedings. For the data protection authority procedure CL of 2016 on General Administrative Procedure. (hereinafter: Ákr.) apply with the additions specified in the Information Act and in accordance with the general data protection regulation with differences. Infotv. 75 / A. §, the Authority shall comply with Article 83 (2) to (6) of the General Data Protection Regulation shall exercise its powers in accordance with the principle of proportionality, in particular by: legislation on the processing of personal data or a binding act of the European Union for the first time in the event of a breach of the rules laid down in in accordance with Article 58 of the General Data Protection Regulation, in particular the controller or by alerting the data controller. Section 5 of Act CL of 2016 on General Administrative Procedure (hereinafter: the Act) [Az customer principles] The client may make a statement or comment at any time during the procedure The Ákr. § 62 [Clarification of the facts] 1. Where the available data are insufficient to reach a decision, the Authority shall conduct an evidentiary procedure he continues. 2. Any evidence which may clarify the facts may be used in official proceedings suitable. It may not be used as evidence obtained by the authority in breach of the law evidence. (3) Facts officially known to the authority and in the public domain need not be proved. 4. The authority shall be free to choose the means of proof and the evidence available freely believes. Ákr. Pursuant to Section 35 (3), until the decision made on the matter at the request of the client becomes final may have. The Ákr. Pursuant to Section 50 (5) (b), the client does not count towards the administrative deadline duration of the omission or delay. The Üttv. Pursuant to Section 9 (1), all facts, information and data of which the practitioner of the profession of lawyer has become aware in the exercise of that activity. THE 2) Unless otherwise provided by this Act, a practitioner of the profession of lawyer shall: to maintain legal professional secrecy. This obligation of confidentiality extends to a document containing legal professional privilege or otherwise media. The Üttv. Pursuant to Section 13 (3), a document prepared for the purpose of defense is official, judicial and other may not be used as evidence in public proceedings and - the cases specified in this Chapter may not be inspected, seized or copied by public authorities, except its presentation, transfer and granting of access to it may be refused. The data subject is concerned may waive it unless the document relates to protection in criminal matters. Infotv. Pursuant to Section 71 (1), during the proceedings of the Authority - it is necessary for the conduct of the proceedings to the extent and for the duration - to handle all personal data and secrets protected by law and information covered by the obligation of professional secrecy which is relevant to the proceedings; and which need to be addressed in order to carry out the procedure effectively. 2a. In the case of a defense document, the provisions of paragraphs 1 and 2 shall be shall apply with the exceptions specified in the Act on the Activity of III. Decision: In his application, the Applicant requested an explicit decision of the Authority regarding the violation of the rights of the data subject, and asked him to warn the data controller of the breach, condemn him and dismiss him data controller to comply with the data subject's request, as well as to impose a sanction or administrative fine asked the Authority. III.1. Application of the Applicant concerned In its letter of 1 October 2020, the Applicant did not clearly indicate the subject of his application, thus nor does it intend to exercise the data subject's right. The Applicant on 1 October 2020 during the proceedings indicated the subject of his letter as a general request for information concerning his debt. However, the subject of his letter of 12 December 2020 has already been "the exercise of the right of access, exercise of the right to data portability - GDPR ”. The Applicant's application was attached to the domestic a return receipt, on the basis of which it can be established that the application of the data subject is to be delivered on 23 December 2020 received by the Applicant. The Applicant clearly stated in his application that his application was primary that it wished to exercise its right of access under the GDPR. During the proceedings, this concerned the handling of the application by the Applicant was examined by the Authority. Regarding the examined data management, it is related to the account balance, debt and chamber membership The information on the Applicant contained in the chamber registers and documents shall be in accordance with Article 4 (1) of the GDPR. of the personal data of the Applicant, the data controller of the Requested, the registration of the data and, 8 under Article 4 (2) of the GDPR apply. III.2. Violation of the rights of the Applicant concerned Under Article 15 (1) of the General Data Protection Regulation, the data subject has the right to be personal access to your data. Pursuant to Article 12 (3) to (4) of the General Data Protection Regulation, at the request of the data subject, the shall reply on the merits within one month. This deadline is limited to special circumstances it may be extended for a further two months, but before the expiry of the original one month send the data controller information on what he has done so far and for what reason the deadline is necessary extension. Before the expiration of the original one month, the Applicant has not fulfilled the right of access of the Applicant nor did it indicate to the Applicant the need for an extension of the deadline. This is the procedure during which the Applicant also acknowledged. According to the Applicant's statement, since the Office and headquarters of the Applicant Service Provider are 19 December 2020 and 2021.01. It was kept closed between 03. During this period, my administration work was open, open for administration The standing deadline started on 04.01.2021. The time limit specified in Section 12 of the General Data Protection Decree is a calendar day and not a working day therefore the deadline for the submission of the application is 24 December 2020. and not January 4, 2021. In this context, the Authority notes that the chamber regulations cited below are also calendar days the time limit for replying to the requests of the persons concerned shall be calculated: - According to Article 131 of the Articles of Association published on the Applicant's website, “The Chamber is managed by it data are covered by the applicable data protection legislation in force at any time according to. In this context, the necessary records, reports and data services perform. " - The Hungarian Bar Association has adopted the “XVI. Information, right of protest, deletion of data, restrictions on data processing ”states in point 3 that the Bar Association shall be required as soon as possible after the application has been lodged, but not more than fifteen (15) provide the information in writing, in a comprehensible form, free of charge within one day. Privacy regulations do not provide for the interruption or suspension of the deadline. The calculation of the time limit has no effect on the Applicant's leave scheme because of the performance of duties continuity must also be ensured by the Applicant. Nor is it possible to derogate from that obligation Neither the Hungarian Bar Association nor the Applicant's internal rules contain any reference. THE Nor do the austerity measures referred to by the applicant, which entered into force on 8 March 2021, qualify because the exercise of the rights of the data subject is not a service requiring a personal appearance. The Applicant is also obliged to organize the work in accordance with the provisions of the GDPR comply with access requests on time. The application may be refused access on the grounds set out in Article GDPR12 (5). fulfillment. The Authority found that the Applicant had subsequently provided the Applicant with The applicant did not refer to the excessive nature of the request in its letter sent to the GDPR The application for access, which was lodged for the first time since that he has previously provided information on the requested data and a copy of the decisions. In view of the above, the Applicant violated Article 15 (1) and (3) of the GDPR and Article 12 Within one month of receipt of the request and did not provide an extension at the request of the Applicant for access, so within the time limit set by the GDPR a did not grant the right of access., 9 The Applicant did not grant the Applicant the right of access beyond the deadline as long as the The Authority was not aware of the present proceedings, ie it acted as a result of the Authority proceedings because a The Applicant sent a reply to the Applicant after receiving the order of the Authority on 24 March 2021. THE However, this reply to the request is the period to be examined (from the submission of the request for access to Pending the initiation of proceedings before the Authority) and is not relevant to the finding of an infringement, but should be assessed in terms of sanctions. III.3. Obliging the applicant to comply with the request for access The part of the Authority's request for an obligation to comply with a request for access because on 2 April 2021 the Applicant sent a final disciplinary decision and the cancellation decision to the Applicant or during the proceedings before the Authority takes a decision has already taken steps to provide the information to the Applicant. The Applicant informed the Applicant's debt registered with the Applicant, the storage of the Applicant's personal data and if the Applicant considers that the Applicant has violated it in the processing of the Applicant's personal data, the general data protection regulation, then at the Authority or the contact details of the Data Protection Officer of the Applicant. The Applicant did not object to the reply sent by the Applicant on 2 April 2021, and has since contacted the Authority. does not co-operate, therefore, in the absence of evidence to the contrary, the Authority will assessed that the obligation to comply with his request for access had become obsolete. III.4. Clarification of facts and legal professional privilege The Authority shall provide the applicant with declarations regarding its procedural and access rights makes the following remarks in this context: The Authority has issued NAIH-2160-5 / 2021. In its order No Applicant as to whether he had responded to the Applicant's request from the data subject and, if so, asked the A copy of the reply sent to the applicant. The Applicant sent a copy of the Authority's reply of 2 April 2021, without annexes, to the Authority. and Üttv. Refused to the Applicant on the grounds of his obligation of confidentiality provided for in § 11 as annexes to the response to the data subject's request to the Authority sending However, in the Authority's view, the individual decisions concerning the Applicant do not qualify a lawyer's secret. Because during the disciplinary proceedings against the Applicant, the Applicant did not performed the activity of a lawyer, but also performed the duties of a public body, therefore the obligation of confidentiality is regulated by the Üttv. It cannot be based on the provisions of § 9. Furthermore, in the Authority's view, the Applicant's claim that it was not possible to attach the It made individual decisions in relation to the applicant, citing its obligation of confidentiality is unfounded because Infotv. Pursuant to Section 71 (1), the Authority shall, in the course of its proceedings, to the extent and for the time necessary to carry out all personal data, and information which is covered by the obligation of professional secrecy and is covered by the obligation of professional secrecy related to the procedure or the handling of which is necessary for the efficient conduct of the procedure required. Infotv. However, pursuant to Section 71 (2a), the Üttv. Section 13 (3) for the access of certain documents prepared for the purpose of defense, as defined in the Üttv conditions shall apply. This is supported by the Üttv. certain laws and other judicial matters related to the entry into force of Act CXXXVI of 2017 on the amendment of laws to § 80 of the Infotv. To Section 71 (2a) - a legislative justification for the Authority's right of access as set out below defined: “Act CXII of 2011 on the right to information self-determination and freedom of information. Act (a hereinafter: the Information Act) § 71 (1) and (2) of the National Data Protection and Freedom of Information, 10 It shall grant the Authority the powers necessary for the conduct of its proceedings to the extent and for the duration of the processing and use of all personal data and by law data covered by the obligation of professional secrecy and professional secrecy which are necessary for the efficient conduct of the proceedings. This right shall also apply to legal professional privilege the authority primarily responsible for the protection of fundamental rights. In this respect, Infotv. the exception is Üttv. Section 13 (1) for the protection of legal professional privilege requirements. This special regulation is also maintained by this law. The Üttv. Section 13 (3) certain documents drawn up for the purpose of defense in the context of an official procedure in the context of its knowledge and usability However, the application of the conditions laid down in the Act on the Enhanced Protection of these Documents a The procedure of the National Data Protection and Freedom of Information Authority is also justified, the law of this accordingly aims to create a clear legal environment. " In view of the above, the Applicant's request for confidentiality in the proceedings initiated at the request of the Applicant could not have denied the individual decision taken in relation to the Applicant in particular because they do not constitute a document for the purpose of defense. The Authority, as it does not share the arguments of the Requested lawyer regarding the obligation of professional secrecy, and interpretation of the law that the decision of the Applicant in a disciplinary case should be a lawyer's secret nor did it consider it necessary for the applicant to be exempted from the ask to keep it a secret. The Authority shall take the necessary steps to obtain a document which has not been sent and to penalize failure to comply with the request. disregarded because, although it was closely related and justified to the case, the facts ultimately it could have been adequately clarified without its precise knowledge. III.5. The issue of data protection fines If the Authority finds an infringement in the data protection authority proceedings, the general may apply the legal consequences set out in the Data Protection Regulation and the Infotv. These include also includes data protection fines, which are provided for by the Authority in the General Data Protection Regulation decides on its own initiative or ex officio with other legal consequences, no upon request. The imposition of a data protection fine directly affects the applicant's right or legitimate interest does not give rise to any right or obligation on the part of the Authority, and therefore with regard to the application of these consequences in the public interest Applicant does not qualify as a customer under Ákr. § 10 (1), or - as the Act no. Section 35 (1) does not comply with paragraph 1, there is no need to submit an application in this respect, the application part of it cannot be considered as an application. III.6. Legal consequences The Authority grants the Applicant's request in part and pursuant to Article 58 (2) (b) GDPR condemns the Applicant as data controller for violating Article 12 of the GDPR. and Article 15 (1) and (3) of the GDPR. The Authority examined of its own motion whether a data protection fine against the Applicant was justified. imposition. In this context, the Authority complies with Article 83 (2) of the General Data Protection Regulation and Infotv. 75 / A. § considered all the circumstances of the case. In doing so, the Authority will be a significant factor took into account that the Applicant is a public body performing professional and advocacy tasks, whose members and officials are also lawyers, and is therefore increasingly expected to know correctly interpret the provisions of the GDPR and treat the data subject appropriately from a data protection point of view applications. However, the Authority took into account that the Authority significantly exceeded the 150-day administrative deadline and that the procedure has been lengthy. On this basis, the Authority waived the fine. On the basis of the above, the Authority has decided in accordance with the operative part III.7. Calculation of administrative deadline, exceeding the administrative deadline The authority The procedural obligation prescribed in Section 15 (1) and the administrative deadline it shall begin when the application becomes admissible on the merits. The Applicant submitted his application to the Authority on 4 February 2021, but did not include the A strong request for a decision to remedy the infringement identified in called for rectification on 19 February. The Applicant shall issue a notice to the Authority on 5 March 2021 by letter dated 10 March 2021, received by the Authority on has become complete. The Authority then referred NAIH-2160-9 / 2021 to clarify the facts. and NAIH-2160-10 / 2021. sent an order to the Applicant's place of residence on 16 August and 21 September, which were Applicant did not take over and did not seek an indication They returned to the Authority on 9 and 20 September 2021 October 11, 2021. The Authority issued its order NAIH-2160-11 / 2021. and NAIH-2160-12 / 2021. therefore sent it to another address to his official knowledge on October 25, 2021 and then October 20, 2021. on November 24th. Order NAIH-2160-11 / 2021 was returned on 15 November 2021 to the Authority, while the Applicant is the Authority NAIH-2160-12 / 2021. No. 2021. received it on 2 December but did not reply. By failing to do so, the Applicant caused a protracted clarification of the facts, which Section 50 (5) shall be deemed to be a period not included in the administrative period pursuant to paragraph 1 (b). ARC. Other issues: The powers of the Authority shall be exercised in accordance with Infotv. Section 38 (2) and (2a) determine the jurisdiction of the country covers the whole territory. The decision is based on Ákr. 80.-81. § and Infotv. It is based on Section 61 (1). The decision is based on Ákr. Section 82 (1) shall become final upon its communication pursuant to paragraph In the course of the procedure, the Authority exceeded the Infotv. One hundred and fifty days of administration pursuant to Section 60 / A (1) deadline, therefore the Ákr. According to § 51 b), ten thousand forints - according to the choice to be indicated in writing - belongs to the Applicant. The Ákr. § 112 and § 116 (1) and § 114 (1) there is a right of appeal through an administrative lawsuit. The rules of administrative litigation are laid down in Act I of 2017 on the Procedure of Administrative Litigation (a hereinafter: Kp.). A Kp. Pursuant to Section 12 (1), it is against the decision of the Authority administrative lawsuit falls within the jurisdiction of the court, the lawsuit is subject to the Kp. 13. Paragraph 3 (a) (aa) the Metropolitan Court has exclusive jurisdiction. A Kp. Pursuant to Section 27 (1) (b) a legal representation is mandatory in litigation falling within the jurisdiction of the tribunal. A Kp. Pursuant to Section 39 (6) a the filing of an application does not have suspensory effect on the entry into force of the administrative act. A Kp. Section 29 (1) and with this regard Pp. Applicable in accordance with § 604, electronic CCXXII of 2015 on the general rules of public administration and trust services. Act (a hereinafter: E-Administration Act) Section 9 (1) (b) of the Client’s legal representative obliged to keep in touch. The time and place of the submission of the application is Section 39 (1). The trial Information on the possibility of requesting the maintenance of the It is based on § 77 (1) - (2). THE the amount of the fee for an administrative lawsuit in accordance with Act XCIII of 1990 on Fees. Act (hereinafter: Itv.) 45 / A. § (1). From the advance payment of the fee, the Itv. Section 59 (1) and Section 62 (1) (h) exempts the party initiating the proceedings. Dated: in Budapest, according to the electronic signature. Dr. Attila Péterfalvi President c. professor