NAIH (Hungary) - NAIH-5377-12/2023

From GDPRhub
Revision as of 13:55, 6 November 2023 by Aa (talk | contribs)
NAIH - NAIH-5377-12/2023
LogoHU.jpg
Authority: NAIH (Hungary)
Jurisdiction: Hungary
Relevant Law: Article 5(1)(c) GDPR
Article 6(1)(b) GDPR
Article 6(1)(c) GDPR
Article 77(1) GDPR
Type: Complaint
Outcome: Rejected
Started: 16.05.2023
Decided: 06.09.2023
Published: 16.10.2023
Fine: n/a
Parties: n/a
National Case Number/Name: NAIH-5377-12/2023
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Hungarian
Original Source: Decisions of NAIH (in HU)
Initial Contributor: Laszlo Szabo

The processing of a minor's personal data by a bank, for the purpose of a of a 'baby loan', was lawful under Article 6(1)(c) GDPR as the bank was legally obligated to collect the minor's personal data under domestic law.

English Summary

Facts

On 16 May 2023, the the Hungarian DPA (NAIH) received a complaint from a minor's legal guardian, which alleged that a bank (the controller) had processed the minor's (data subject) personal data unlawfully. The minor's legal guardian had applied for a 'baby loan' ('Babaváró' loan) with the bank. These loans are for the purpose of financing child-related costs. In order to process the loan application, the bank had requested a copy of the minor's identification documents, which included details such as the minor's residential address, gender, birth date and national identification number. To do so, the bank relied on Article 6(1)(b) GDPR (contract) as a legal ground for processing. In the complaint, the applicant argued that the processing was disproportionate and unnecessary for the purposes of their contract with the bank, which the minor was not party to.

In response to the complaint, the NAIH contacted the bank for more information. The bank responded that Article 14(4) and Article 9(2)(c) of Decree 44/2019. (III. 12.), which regulates the conditions of a “Babaváró” loan, requires banks to process minor's identification documents. Moreover, in order to be able to demonstrate compliance under domestic banking regulations, banks are obliged to document the basis on which they have granted loans and store any relevant information in relation to this.

Holding

The NAIH rejected the complaint. The NAIH held that Article 14(4) and Article 9(2)(c) of Decree 44/2019. (III. 12.), required banks to process the data referred to. Therefore the processing was legitimate as it was necessary for compliance with a legal obligation to which the controller was subject (Article 6(1)(c) GDPR).

The NAIH acknowledged that the bank had wrongly indicated Article 6(1)(b) GDPR as a legal basis for processing. However, the NAIH held that the indication of an incorrect legal basis for processing under Article 6 GDPR, did not make the processing illegitimate.

Comment

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.

Case number: NAIH-5377-12/2023. Subject: Decision rejecting the application

Administrator: dr. Kelemen Bíborka

                                           H A T A R O Z A T



The National Data Protection and Freedom of Information Authority (hereinafter: Authority) [...] is legal
minor child represented by a representative (residential address: […]; hereinafter: Representative), of […] concerned
(place and date of birth: [...]; mother's name: [...]; hereinafter: Affected) to the Authority May 16, 2023-
with [...] Bank Zrt. (registered office: [...]; company registration number: […]; hereinafter:
against the Respondent) regarding the illegal processing of the Data Subject's personal data

makes the following decisions in official data protection proceedings:

    I. The Authority's request from the Data Subject for the Authority to establish that the Respondent
        processed your personal data illegally, refuses.


    II. The Authority will respond to the Data Subject's request that the Authority instruct the Applicant to
        to delete illegally processed personal data, refuses.

    III. The Authority's request by the Data Subject that the Authority instruct the Requested Party is
        To make available to the Representative the copies of the affected documents that have been illegally handled,

        rejects.

There is no place for administrative appeal against this decision, but the 30th from the date of notification
within days, it can be challenged in an administrative lawsuit with a letter of claim addressed to the Metropolitan Court. THE
a letter of claim must be submitted electronically to the Authority, which forwards it along with the case documents to the
             1
to the court. The request to hold a hearing must be indicated in the statement of claim. The complete personal
for those who do not receive a tax exemption, the fee for the administrative lawsuit is HUF 30,000, the lawsuit is substantive
legal representation is mandatory in proceedings before the Capital City Court.



                                           I N D O C O L A S

I. Subject of the procedure

(1) 2023.

        came to the Authority on May 16, in which he stated that he and his wife on October 13, 2021
        concluded a babysitting loan agreement with the Application, contract number: [...] The Representative a
        in his application, he objected to the processing of data during credit administration, as the Data Subject
        considered the handling of his personal data disproportionate and unnecessary. The reason for this is that
        when he wanted to prove to the Respondent the birth of the Data Subject, the Respondent's colleague

        On March 27, 2023, from both sides of the Data Subject's official ID card verifying the residential address,
        he made a copy of his tax certificate and birth certificate, but they were not presented
        sufficient.




1
 The NAIH_K01 form is used to initiate the administrative lawsuit. The form is the general form filling program
(ÁNYK program) can be filled out. The form is available and can be downloaded from the website of the Authority: https://www.naih.hu/kozig-
decision-bureaucratic review

…………………………………………………………………………………………………………
1055 Budapest Tel.: +36 1 391-1400 ugyfelszolgalat@naih.hu
Falk Miksa utca 9-11 Fax: +36 1 391-1410 www.naih.hu(2) The Representative found the preparation of document copies harmful and therefore
        contact with the data protection officer of the Respondent. On April 4, 2023, to the [...] e-mail address
        in his e-mail sent, he asked for information about what legislation he was referring to
        the Applicant manages "all" of his child's personal data. The Requested data protection
        in his reply letter dated April 12, 2023, his official informed the Representative that the mentioned
        data, such as the Data Subject's birth certificate, identity card, a
        processing a copy of your residential address card and tax certificate about the babysitting allowance
        44/2019. (III. 12.) Government decree (hereinafter: Babaváró r.) based on paragraph 14. (4) of §

        It is done in accordance with point c) of § 9, paragraph (2), since these legal provisions
        based on this, they must be attached to the application for suspension of repayment. Furthermore
        informed the Representative that he has a ministerial resolution which
        states in general that it applies to the use of state aid for banks
        they must be able to prove conditions, i.e. to make the "credit institution decision, that
        for review by the housing support authority, and the Hungarian State Treasury
        for its subsequent verification, it is necessary to evaluate the support, i.e. the person entitled to the support

        preservation of documents establishing the verification of conditions."

(3) The Representative did not consider the above information to be satisfactory. According to his opinion, why did they apply?
        family support benefits directly from the Hungarian Treasury, therefore in relation to
        Babaváró r. The provisions of § 9, paragraph (2) c) do not apply. Therefore
        in his opinion, the Data processing of the Respondent was unnecessary and disproportionate.

(4) In the request for the official data protection procedure, the Representative requested that the Authority establish

        and that the Respondent's data processing was largely disproportionate and unnecessary when
        the Respondent made a photocopy of the Data Subject's "authority card confirming personal identification",
        since personal identification is not necessary at all for credit administration.

(5) The Representative also requested that the Authority oblige the Applicant to
        to delete personal data and oblige the Requester to be prepared from the Data Subject's documents
        for returning copies to


II. Fact

(6) In the case of the Respondent, in general, with the obligation of banks to copy documents
        explained that the supervisory bodies that control banks, such as Magyar
        National Bank (hereinafter: MNB) or the Hungarian State Treasury (hereinafter: Treasury)

        they set expectations for the banks, based on which it is inevitable that
        so that banks are able to provide documents and deeds in all cases
        to substantiate that their financial service activities, such as lending
        or aid related to state subsidies in the course of their assessment activities, the relevant
        legal provisions are complied with.


(7) The Respondent also submitted that the relevant legislation and the MNB apply
        in accordance with his recommendations, bank branch staff performing sales cannot be
        in a position to make a decision related to credit or a credit assessment. The banks
        prudent and transparent operation, protection of depositors' money, and the banking sector
        in order to preserve its stability, banks may not develop internal processes that
        as a result of which bank branch clerks with a commission interest bring the
        bank branch clerks who receive credit assessment decisions, i.e. certificates, are not entitled to a
        related to the suspension of repayment and the awarding of child support

        to make decisions. In order to ensure prudent and proper banking operations, it is also necessary
        to avoid situations where the bank branch employee may data

                                                  2 in connection with the misinterpretation or concealment of the credit assessment, or the loan or state
        can influence the placement of support or provide it illegally. Based on all this, the
        in the banking sector, the high level of documentation required by the supervisory bodies
        are expected from banks, it also stems from the basic principle that the prudent operation of banks and the
        the possibility of internal abuses must be avoided in order to ensure the stability of the banking sector
        may survive.


(8) The Respondent also considered it necessary to record that the banks are state-owned
        they are not entitled to the legal provisions with regard to loans related to support
        overwrite or supplement. Banks can decide whether to provide state support
        whether they provide it or not, but if they decide to provide the given state aid, then so be it
        nor may they deviate from the legislation of the legislator, if it applies to the given place of legislation
        provision is incomprehensible, inapplicable or inappropriate. Based on all of this, the
        Bank, even if it is difficult or impossible to interpret each one from a data protection point of view

        legal provision, it is still maintained by the relevant legislation, such as, for example, Babaváró
        the application of concepts or solutions defined in r.

(9) Regarding the specific case, the Respondent stated in the preface that it is not true a
        Representative's claim that the Respondent handles the Personal Identification Number of the Data Subject, since the
        The page containing the personal identification number of the residential address card was not copied, as

        as well as for a copy of the Person's identity card. Declaration of this
        was prepared from the documents of the Data Subject provided to the Authority for its support
        copies. (NAIH-5377-6/2023.)

(10) The Respondent manages the following personal data about the Data Subject: name; birth name; mother
        his name; place and time of birth; his nationality; residential address; tax identification number; pregnancy 12.
        the date of your week and the date of your expected birth.


(11) The Requested Data subject's personal data based on Article 6 (1) point b) of the GDPR,
        it is managed on a contractual legal basis, and the purpose of data management is by the Representative and his spouse
        indicated the fulfillment of a signed baby loan agreement, since with the birth of the child
        the further fate of the contract depends on the submission of a related certificate, for the interest subsidy
        additional entitlement or its repayment obligation, suspension of repayment, etc.

(12) In his statement, the Respondent maintained what he had written to the Representative, i.e. that the Data Subject

        the processing of your personal data by Babaváró r. It is prescribed by § 14 (4) and § 9 (2) points c).
        for, and additionally referred to Babaváró r. Section 5 (2) and Section 22 (2).
        too.

(13) Babaváró r. Section 5(2), Section 14(4), Section 22(2), Section 19(5),
        furthermore, Section 9, Paragraphs (2)-(3) require the Respondent, within the framework of the performance of the contract, that the
        suspension of repayments, the use of child support, and the 12th of the fetus.

        completion of its first week, as well as in connection with the birth or death of a child
        which data it must handle, and which certificates the supported person must use as clients
        assess your eligibility for support.

(14) The Respondent's task is to enforce repayment with respect to the loan agreement
        pausing, child support and pregnancy or childbirth
        related to the failure to report a child, in a loan agreement and Babaváró r.-
        legal consequences recorded in By pausing the repayment or the child

        in connection with his birth, the Applicant will not receive data from the Treasury, so a
        The applicant's right to suspend repayment of the subsidized persons, and a

                                                   In connection with the birth of 3 children, the loan agreement is contractual or not
        its contractual performance and its contractual or non-contractual performance
        applicable legal consequences (contractual consequences) must also be met
        to be able to determine if the supported persons do not claim or family support
        they claim family support at the payment point, or even if it is family support
        provision is requested at the Treasury.

(15) Ensuring prudent operation of the Respondent and compliance with its supervisory bodies

        you must be able to prove with documents that the state aid
        use was made in a regular manner, so the Applicant has the fulfillment of the contract and the
        within the scope of awarding the regularity of support, you must handle the copies of the documents
        with which he can prove to the supervisory body that the state aid is legal
        use. Copying only applies to documents containing that data
        who, for the processing of data, the Requested a Babaváró r. is obliged based on For this reason, the Affected
        the page of your residential address card that does not contain a personal identification number, your tax certificate and

        handles a copy of your birth certificate. The Applicant also informed the
        Authority that the attached "Notification" form II. in point the Data Subject
        his legal representative consented "in accordance with the wording" contained in Babaváró r
        for data management, and the form IX.1. point, it was recorded that the birth
        birth certificate, tax certificate and address card have been submitted.

(16) According to the Respondent's point of view, its data processing is legal, since with the performance of the contract
        in this context, you have the right to Babaváró r. manage the scope of data included in paragraph (2) of § 5,

        including that with proof of the child's birth, i.e. the contract
        the certificates related to its performance and the data circles contained therein

(17) The Respondent further submitted that the Treasury expects it to

        he supports his legitimacy with deeds and documents. Regarding the practice of the Treasury
        from this point of view, there is no difference in whether you are on a family support payment site
        whether the supported persons claim family support from the Treasury.

III. Applicable legislation

(18) On the basis of Article 2 (1) of the GDPR, the GDPR shall apply to the data processing in this case
        apply.


(19) Article 5 (1) point c) GDPR: Personal data from the point of view of the purposes of data management
        they must be appropriate and relevant and limited to what is necessary
        ("data saving").

(20) Article 6(1)(b) and (c) of the GDPR: Processing of personal data only when and
        legal insofar as at least one of the following is fulfilled:

        b) data management is necessary for the performance of a contract in which the data subject is one of the parties,
        or steps taken at the request of the data subject prior to the conclusion of the contract
        necessary to do;
        c) data management is necessary to fulfill the legal obligation of the data controller;

(21) GDPR Article 77 (1): Infringement of other administrative or judicial remedies
        without, all data subjects have the right to complain to a supervisory authority -
        in particular your usual place of residence, place of work or the place of the alleged offence

        in the Member State of origin - if, according to the judgment of the data subject, the personal data relating to him/her
        handling violates this regulation.

                                                  4(22) Infotv. Section 2 (2): Personal data according to (EU) 2016/679 of the European Parliament and
        falling within the scope of the Council Decree (hereinafter: General Data Protection Decree).
        III-V of the General Data Protection Regulation. and VI/A. In Chapter, as well as § 3, § 3,
        4., 6., 11., 12., 13., 16., 17., 21., 23-24. point, paragraph (5) of § 4, § 5 (3)-(5), (7)
        and (8), § 13, § 2, § 23, § 25, § 25/G. § (3), (4) and
        in paragraph (6), 25/H. § (2), 25/M. in paragraph (2) of § 25/N. in §, it is
        51/A. in paragraph (1) of § 52-54. §, § 55 (1)-(2), § 56-60. in §, a

        60/A. (1)-(3) and (6) of § 61, points a) and c) of § 61 (1), § 61 (2) and (3)
        paragraph, paragraph (4) point b) and paragraphs (6)-(10), paragraphs 62-71. in §, § 72-
        in, paragraphs (1)-(5) of § 75, § 75/A. § and defined in Annex 1
        must be applied with supplements.

(23) Infotv. Validation of the right to the protection of personal data based on § 60, paragraph (1).
        in order to do so, the Authority may initiate an official data protection procedure ex officio. The data protection authority
        for procedure CL. 2016 on the general administrative procedure. law (hereinafter:

        Ákr.) rules must be applied with the additions specified in Infotv. and the general
        with deviations according to the data protection regulation.

(24) CL of 2016 on the general administrative procedure for the official data protection procedure.
        Act (hereinafter referred to as the Act) shall be applied as specified in the Infotv
        with additions and deviations according to the general data protection regulation.

(25) Babaváró r. Section 5, paragraph (2) point a): When the loan application is submitted, the applicants are complete
        in a statement contained in a private document with evidentiary force, they agree to the fact that
        a) data relating to the loan and the maternity allowance, as well as the personal and a
            their children born or adopted after submitting a loan application

                 aa) name
                 ab) birth name,
                 ac) their mother's name,
                 ad) their place and time of birth,
                 ae) their citizenship or stateless status,
                 af) their address,
                 ag) their notification address,

                 ah) their identity cards, travel documents or card-format drivers
                      their license number,
                 i)
                 aj) their tax identification number
            evaluating the loan application, concluding the loan agreement, disbursing the loan and
            to be managed by the credit institution and forwarded to the treasury for the purpose of checking legal use,
            for the state tax authority, the government office.


(26) Babaváró r. Section 9 (2) points b) and c): The loan agreement includes the subsidized
        persons

        b) a statement in which they agree that the 12th week of pregnancy and the birth is expected
        the date is specified in the ministerial decree on pregnancy care
        with antenatal care book or issued by the attending physician, defined in Annex 2
        with a document containing the content, and consent to the processing of this data,

        c) a statement in which they undertake that if the child is born or adopted
        after that, they do not require family support benefits, or if they do, family support benefits

        required at the payment point, the birth certificate of the biological child, proof of address
        his official identity card and tax certificate, or in the case of an adopted child
                                                    5 final decision authorizing adoption, as well as the adopted child
        they will present their official identity card and tax certificate confirming their address, as well as their criminal record
        they declare jointly in a private document with full evidentiary force, made with the assumption of responsibility
        about living in a household, or in the case of the death of the fetus, instead of the above documents, the 3.
        a document with the content specified in the annex, on the postmortem examination in case of stillbirth
        and a document according to the government decree on the procedure related to the dead, or the living
        in the event of the death of a born child, the death certificate confirming this has occurred
        extract is presented to the credit institution within a maximum of 180 days, and they agree to this

        to manage data,

(27) Babaváró r. Section 14 (1) point a) Subsidized persons to suspend repayment
        are eligible
        a) after their fetus has completed at least the 12th week of pregnancy, if the pregnancy
            exists at the time of submitting the loan application or after, and the fetus

            she becomes pregnant within a period of 5 years from the disbursement of the loan at the latest
            week 12,

(28) Babaváró r. § 14, paragraph (4): The request for suspension of repayment must be submitted to the credit institution
        submit. It must be attached to the application in points b) and c) of paragraph (2) of § 9

        specific documents. The fulfillment of the eligibility conditions for pausing a
        determined by the credit institution on the basis of submitted certificates.

(29) Babaváró r. § 22, paragraph (2): If childbearing support is used after a fetus,
        and in the event of a suspension of repayment, the supported persons will receive the birth of the child or the
        the death of a fetus, stillbirth or the death of a child born alive is defined in Section 9 (2)
        in accordance with paragraph c) within 180 days after the expected date of delivery
        are verified, the credit institution - within 15 days after the end of the deadline - notifies the treasury of this.
        If the child is uniform according to the Family Support Act

        no data can be found in the social register, the treasury will immediately notify the state
        tax authority.

(30) Babaváró r. § 23, paragraph (1): Babysitting subsidies are calculated by the credit institution a
        with treasure.

(31) Babaváró r. Section 23 (8): The treasury is on-site at the credit institution during its inspection
        can carry out an inspection and is entitled to request the necessary information and documents, or
        to inspect them on the spot.

(32) Babaváró r. Section 24, paragraph (1): The credit institution is liable to the state for any damage
        which was created by violating the obligation imposed on him under this regulation. Exempted from

        credit institution from liability if it proves that it acted as it should in the given situation
        is generally expected.

ARC. Decision

ARC. The legality of the data processing of the Respondent

(33) Babaváró r. names several forms of support. Subsidized married couples are entitled on the one hand
        for an interest subsidy in relation to the loan taken out - which interest subsidy is different

        can be lost in the event of certain conditions, or already disbursed by the Treasury
        in relation to interest subsidies, a reimbursement obligation arises -, on the other hand, they are entitled to a
        to pause repayment after the 12th week of pregnancy, including childbirth
        period as well, or if they jointly adopt a child. Second, the beneficiaries

                                                   6 or in the event of a third child, they are entitled to non-refundable child support
        for support, the amount of which is still outstanding from the baby loan in the case of the second child
        30% of the debt, and in the case of a third child, of the entire remaining debt
        appropriate amount. Child support, similar to the suspension of repayment a
        after the 12th week of pregnancy, including the period after childbirth, or
        can be requested in case of adoption.

(34) In the specific case, the Representative and his wife asked the Applicant to suspend the repayment
        On [...] 2022, given that the 12th week of pregnancy has been completed, then on [...] 2023

        certified to the Respondent that their child, the Subject, was born, which is their obligation
        Babaváró r. prescribed by § 22, paragraph (2). In connection with the suspension of repayment, Babaváró r.
        Paragraph (4) of § 14 stipulates that the request for the suspension of repayment must be submitted to the
        must be submitted to a credit institution. Section 9 (2) b) and c) must be attached to the application
        documents specified in point Eligibility conditions for pausing
        compliance is determined by the credit institution based on the submitted certificates.


(35) Babaváró r. Paragraph (4) of § 14 thus refers back to points b) and (c) of § 9 (2)
        to specific documents, which is a general legal drafting technique,
        which aims to avoid unnecessary repetitions. That is, for the suspension of repayment
        from the point of view of the application, only the part of § 9, paragraph (2) b) and c) applies
        significance in which the documents to be submitted are named, not that § 9 (2)
        points b) and c) of paragraph otherwise aim to trigger what legal effect.

(36) As a result, the fact that the Representative and his wife applied for

        whether, and if so, where, family support benefits, it is not affected by the suspension of repayment
        the range of documents to be submitted in order to support the application for
        paragraph 9. (2) points b) and c) defines which are blood
        in the case of a child according to the following: pregnancy care book or by the attending physician
        exhibited, Babaváró r. document with the content specified in Annex 2; by blood
        child's birth certificate, official ID card confirming his address and
        tax certificate.


(37) In addition, Babaváró r. Paragraph (2) of Section 5 expressly authorizes credit institutions to
        the name of the children born after submitting a loan application for subsidized married couples,
        their birth name, their mother's name, their place and time of birth, their nationality
        or for the treatment of their stateless status, address and tax identification number a
        assessment of the loan application, conclusion of the loan agreement, disbursement of the loan and the legal
        for the purpose of checking usage. The documents copied by the Applicant are exclusively on this
        contain data, copies of the authenticity and correctness of this data

        are used for verifiability. In his submission, the Representative only claimed that the Data Subject
        also the page containing your personal identification number of your official ID card confirming your address
        was copied by the Respondent, he could not support it with anything, so the Authority a
        Based on the copies of documents provided to him by the respondent, he states that
        The Personal ID of the Data Subject was not processed by the Respondent, about which a
        You did not make the requested copy.

(38) Babaváró r. Paragraph (4) of § 14 specifically emphasizes that for the suspension of repayment

        the fulfillment of relevant eligibility conditions on the basis of the submitted certificates by the credit institution
        establishes, i.e. in the absence of these documents, the credit institutions to suspend repayment
        applications must be rejected.

(39) It should also be noted here that the Applicant and all other baby loans
        disbursing credit institution has a settlement relationship with Kincstár, as well as Babaváró r. Section 23 (8)

                                                  According to paragraph 7, the Treasury is responsible for activities related to baby loans
        can check and is entitled to request the necessary information and documents, or to access them
        to inspect on site. Babaváró r. According to § 24, paragraph (1), the credit institution is also responsible
        against the state for any damage that is an obligation imposed on him based on this decree
        caused by its violation. That is, the Respondent's compliance with the law, as well as
        in order to verify compliance, it must be handled as specified in Babaváró r
        documents. Thus, on the basis of the above, to prove eligibility for support
        Babaváró r. is not enough. Defined in points b) and c) of paragraph (2) of § 9

        the mere presentation of documents at the credit institution.

(40) Based on all of this, the Authority concludes that the Applicant in Babaváró r. Section 14 (4)
        paragraph and Section 9 (2) points b) and c) legally prepared
        a copy to the Affected Babaváró r. on the documents containing your data according to paragraph (2) of § 5,
        i.e. from the part of the Data Subject's official ID document confirming the residential address containing the residential address,
        of your tax certificate and birth certificate, and the personal information on it
        handles data legally. The personal data on the copies of documents Applicant

        is necessary to be handled by and is proportionate to the goal to be achieved, as it concerns the suspension
        eligibility conditions are met by the Applicant based on the submitted certificates,
        in the absence of these, the grant applications would not be considered. Consequently, the Authority
        states that the Respondent is in accordance with Article 5 (1) point c) of the GDPR
        in accordance with the principle of data saving, legally manage the Data Subject's personal data, and
        as a result, the Representative rejects the requests submitted on behalf of the Data Subject.

(41) The Authority further notes that the Respondent is responsible for handling the Data Subject's personal data

        as its legal basis, it indicated point b) of Article 6 (1) of the GDPR, according to which the personal
        data processing is legal if and to the extent that the data processing is a contract
        necessary for the fulfillment of which the person concerned is one of the parties, or the conclusion of the contract
        it is necessary to take steps at the request of the data subject beforehand

(42) However, the Data Subject has no rights or rights in the contract
        obligations do not arise, the contracting parties do in relation to the baby loan
        Affected parents and the Applicant, therefore only the beneficiaries of Article 6 (1) point b) of the GDPR

        can be considered as a suitable legal basis for contracting parties.

(43) The children – whether they are biological or adopted children of the beneficiaries –
        personal data is processed so that parents and beneficiaries can verify
        that the conditions of the support received from the state have been fulfilled in parallel with the baby loan,
        and that this performance can later be certified by the credit institution to the Treasury. THE
        proof of compliance with the eligibility conditions for support by the parents to the credit institution

        an obligation that is created by concluding a babysitting contract. For those supported
        although they have to prove compliance to the credit institution, it is the support provided by the state
        is significant from the point of view of the fulfillment or non-fulfillment of the conditions of the support a
        does not affect the existence of a loan agreement. On the other hand, the conditions of support
        verification of its existence is the legal obligation of credit institutions prescribed by law, which
        in connection with its execution, they are liable for compensation to the Treasury. All of these
        based on which it can be stated that the processing of children's personal data by credit institutions is legal
        based on their obligation, the data management is carried out in relation to their personal data

        its corresponding legal basis is Article 6 (1) point c) of the GDPR.

(44) Nevertheless, in the specific case, the Respondent does not comply with Article 6 (1) of the GDPR
        referred to its appropriate legal basis when handling the Data Subject's data, data management
        it has no significance in terms of its legality and necessity. On the one hand, it is the Representative
        He did not dispute the legal basis for processing the personal data concerned, but only the necessity of it,

                                                  8, on the other hand, the Respondent has, regardless of this, appropriate means to manage personal data
        with the legal basis that it marked an inappropriate point in Article 6 (1) of the GDPR
        as the legal basis for data processing in the statement addressed to the Authority, since Article 6 (1) of the GDPR
        on the basis of paragraph 1, the processing of personal data is lawful if and to the extent that it is
        one of the conditions in points a)-f) exists.

A. Other questions

(45) The competence of the Authority is defined by Infotv. Paragraphs (2) and (2a) of § 38 define it, and its competence is

        covers the entire territory of the country.

(46) The decision in Art. 80-81 § and Infotv. It is based on paragraph (1) of § 61. The decision is in Art.
        Based on § 82, paragraph (1), it becomes final upon its publication.

(47) The Art. Section 112, Section 116(1), Section 116(4)(d), and Section 114(1)
        based on paragraph 1, the decision may be appealed through an administrative lawsuit.


(48) The rules of the administrative procedure are laid down in Act I of 2017 on the Administrative Procedure
        hereinafter: Kp.) is defined. The Kp. Based on § 12, paragraph (1), by decision of the Authority
        the administrative lawsuit against falls within the jurisdiction of the court, the lawsuit is referred to in the Kp. Section 13, paragraph (3).
        Based on point a) subpoint aa), the Metropolitan Court is exclusively competent. The Kp. Section 27 (1)
        legal representation in a lawsuit within the jurisdiction of the court based on paragraph b).
        obligatory. The Kp. According to paragraph (6) of § 39, the submission of the claim is administrative
        does not have the effect of postponing the entry into force of the act.


(49) The Kp. Paragraph (1) of § 29 and, in view of this, Pp. According to § 604, the electronic one is applicable
        CCXXII of 2015 on the general rules of administration and trust services. law (a
        hereinafter: E-administration act) according to § 9, paragraph (1), point b) of the customer's legal representative
        obliged to maintain electronic contact.

(50) The time and place of filing the statement of claim is determined by Kp. It is defined by § 39, paragraph (1). THE
        information on the possibility of a request to hold a hearing in Kp. Paragraphs (1)-(2) of § 77

        is based on. The amount of the fee for the administrative lawsuit is determined by Act XCIII of 1990 on fees. law
        (hereinafter: Itv.) 45/A. Section (1) defines. From the advance payment of the fee
        the Itv. Paragraph (1) of § 59 and point h) of § 62 (1) exempt the person initiating the procedure
        half.

Budapest, September 6, 2023.


                                                                  Dr. Habil. Attila Péterfalvi
                                                                             president
                                                                       c. professor













                                                    9