Editing NAIH - NAIH/2020/1154/9

From GDPRhub

Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.

Latest revision Your text
Line 50: Line 50:
 
}}
 
}}
  
The Hungarian DPA (NAIH) issued a fine against Forbes Hungary which published the list of the 50 wealthiest Hungarians and the list of the biggest family-owned businesses, for not performing a balance of interests prior to the publication and lack of information on the rights of the complainant.  
+
he Hungarian DPA (NAIH) issued a fine against Forbes Hungary which published the list of the 50 wealthiest Hungarians and the list of the biggest family-owned businesses, for not performing a balance of interests prior to the publication and lack of information on the rights of the complainant.  
  
 
== English Summary ==
 
== English Summary ==
Line 73: Line 73:
  
 
<pre>
 
<pre>
 +
 
Page 1
 
Page 1
Case number: NAIH / 2020/1154/9Subject: Application in partHistory: NAIH / 2019/8402decision grantingBefore the National Data Protection and Freedom of Information Authority (hereinafter: the Authority ) […]applicants (hereinafter collectively referred to as the Applicants ), through their representative [],Mediarey Hungary Services Private Limited Company (address: 1061 Budapest,Andrássy út 12., company registration number: 01-10-140295; hereinafter referred to as "the applicant" ),Forbes Magazine ('Forbes'), published in the applicant' s edition, is published andillegal data processing related to its electronic publications, as well as those of the Applicantsfollowing a request for inadequate enforcementIn the data protection authority procedure, the Authority shall take the following decisions:I. The AuthorityIN ITS DECISION1. The applicants' application is granted in part1.1. and finds that the Applicant is with Forbes in September 2019published and published in the publication of the largest family businessesonline version (Data Management 1) and Forbes 50 released in January 2020for the printed and online version of the richest Hungarian publication(Data Management 2) in connection with related data managementown interests and the legitimate interests of themselves and third parties (the public) and theseHe did not inform the applicants in advance of the result of his comparison with the interestsApplicants, in breach of Article 6 (1) (f) of the General Data Protection Regulationpoint.1.2. The Authority further notes that by requesting that Data Management 1 andThe Applicants did not provide adequate information regarding data management 2 eitherall relevant circumstances of the data processing and the Applicants are personalthe right to object to the processing of personal data and the Applicantsdid not provide information in its replies to the requests forApplicants' access to justice, violated the general data protectionArticle 5 (1) (a), Article 5 (2), Article 12 (1) and (4) ofArticle 14, Article 15 and Article 21 (4).1.3. The Authority condemns the Applicant for unlawful data processing , at the same timeinstructs that1.3.1 within 15 days of the decision becoming finalcomply with the information management information available to Applicantsobligations, including those taken into account in the balance of interests,Applicant's and Applicants' Interests and Balance of Interestinformation on the outcome of the proceedings, information on the right to protest andinformation on enforcement options.1.3.2 if the Applicant is entitled to it during future planned data processinginterest as a legal basis, it shall, in accordance with the law andcarry out a balance of interests in the light of the provisions of this Decision,including a second, individual consideration of interests following the protest.
+
Case number: NAIH / 2020/1154/9Subject: Application in partHistory: NAIH / 2019/8402decision grantingBefore the National Data Protection and Freedom of Information Authority (hereinafter: the Authority ) […]applicants (hereinafter collectively referred to as the Applicants ), through their representative [[]),Mediarey Hungary Services Private Limited Company (address: 1061 Budapest,Andrássy út 12., company registration number: 01-10-140295; hereinafter referred to as "the applicant" ),Forbes Magazine ('Forbes'), published in the applicant' s edition, is published andillegal data processing related to its electronic publications, as well as those of the Applicantsfollowing a request for inadequate enforcementIn the data protection authority procedure, the Authority shall take the following decisions:I. The AuthorityIN ITS DECISION1. The applicants' application is granted in part1.1. and finds that the Applicant is with Forbes in September 2019published and published in the publication of the largest family businessesonline version (Data Management 1) and Forbes 50 released in January 2020for the printed and online version of the richest Hungarian publication(Data Management 2) in connection with related data managementown interests and the legitimate interests of themselves and third parties (the public) and theseHe did not inform the applicants in advance of the result of his comparison with the interestsApplicants, in breach of Article 6 (1) (f) of the General Data Protection Regulationpoint.1.2. The Authority further notes that by requesting that Data Management 1 andThe Applicants did not provide adequate information regarding data management 2 eitherall relevant circumstances of the data processing and the Applicants are personalthe right to object to the processing of personal data and the Applicantsdid not provide information in its replies to the requests forApplicants' access to justice, violated the general data protectionArticle 5 (1) (a), Article 5 (2), Article 12 (1) and (4) ofArticle 14, Article 15 and Article 21 (4).1.3. The Authority condemns the Applicant for unlawful data processing , at the same timeinstructs that1.3.1 within 15 days of the decision becoming finalcomply with the information management information available to Applicantsobligations, including those taken into account in the balance of interests,Applicant's and Applicants' Interests and Balance of Interestinformation on the outcome of the proceedings, information on the right to protest andinformation on enforcement options.1.3.2 if the Applicant is entitled to it during future planned data processinginterest as a legal basis, it shall, in accordance with the law andcarry out a balance of interests in the light of the provisions of this Decision,including a second, individual consideration of interests following the protest.
 
Page 2
 
Page 2
 
21.3.3 pre-convert in accordance with applicable law and the provisions of this decisioninformation practices.2. The Authority shall reject the application in so far as it:2.1 of the Applicants request the Authority to order the limitation of data management,Deletion of Applicants' Personal Data and Requested Personal Datatreatment;2.2 the Applicants request that the Authority restrict the data processing by an interim measureand prohibit the disclosure of personal information.3. The Authority shall reject the part of the application concerning the imposition of a data protection fine ,however, due to the violations found, the Debtor ex officioHUF 2,000,000, ie HUF 2 milliondata protection fineobliges to pay.No procedural costs were incurred during the official proceedings and therefore no costs were incurredprovided by the Authority.The data protection fine is the starting point for initiating a judicial review15 days after the expiry of the time limit or, in the case of initiation of a review, after the decision of the courtthe Authority’s centralized revenue collection special purpose forint account (10032000-01040425-00000000 Centralized direct debit account IBAN: HU83 1003 2000 0104 0425 00000000). Upon transfer of the amount, NAIH / 2020/1154/9 JUDGMENT. numberto refer to.Failure by the Applicant to meet its obligation to pay the fine within the time limit shall result in delayis required to pay a supplement. The rate of the late payment interest is the statutory interest, which is in arrearsthe central bank base rate in force on the first day of the calendar half-year in question.Section 1.3.1. from the date of notification of the decisionin writing within 30 days of the date of entry into force of this Regulation, together with theto the Authority.The Applicant shall be notified of the decision 1.3.3. in order to comply with the obligation laid down inmeasures shall be taken in writing within 30 days of the date of notification of the decisiontogether with the submission of evidence, to the Authority.The Authority shall impose fines and periodic penalty payments or for failure to comply with the prescribed obligationsinitiate the implementation of the decision.There is no administrative remedy against this decision, but it is from notificationwithin 30 days of the application to the Metropolitan Court in an administrative lawsuitcan be challenged. The application must be submitted to the Authority, electronically, which is the caseforward it to the court together with its documents. Indicate the request for a hearing in the applicationmust. For those who do not receive a full personal exemption from judicial reviewprocedure fee is HUF 30,000, the lawsuit is subject to the right to record material fees. Before the Metropolitan Courtlegal representation is mandatory in proceedings.
 
21.3.3 pre-convert in accordance with applicable law and the provisions of this decisioninformation practices.2. The Authority shall reject the application in so far as it:2.1 of the Applicants request the Authority to order the limitation of data management,Deletion of Applicants' Personal Data and Requested Personal Datatreatment;2.2 the Applicants request that the Authority restrict the data processing by an interim measureand prohibit the disclosure of personal information.3. The Authority shall reject the part of the application concerning the imposition of a data protection fine ,however, due to the violations found, the Debtor ex officioHUF 2,000,000, ie HUF 2 milliondata protection fineobliges to pay.No procedural costs were incurred during the official proceedings and therefore no costs were incurredprovided by the Authority.The data protection fine is the starting point for initiating a judicial review15 days after the expiry of the time limit or, in the case of initiation of a review, after the decision of the courtthe Authority’s centralized revenue collection special purpose forint account (10032000-01040425-00000000 Centralized direct debit account IBAN: HU83 1003 2000 0104 0425 00000000). Upon transfer of the amount, NAIH / 2020/1154/9 JUDGMENT. numberto refer to.Failure by the Applicant to meet its obligation to pay the fine within the time limit shall result in delayis required to pay a supplement. The rate of the late payment interest is the statutory interest, which is in arrearsthe central bank base rate in force on the first day of the calendar half-year in question.Section 1.3.1. from the date of notification of the decisionin writing within 30 days of the date of entry into force of this Regulation, together with theto the Authority.The Applicant shall be notified of the decision 1.3.3. in order to comply with the obligation laid down inmeasures shall be taken in writing within 30 days of the date of notification of the decisiontogether with the submission of evidence, to the Authority.The Authority shall impose fines and periodic penalty payments or for failure to comply with the prescribed obligationsinitiate the implementation of the decision.There is no administrative remedy against this decision, but it is from notificationwithin 30 days of the application to the Metropolitan Court in an administrative lawsuitcan be challenged. The application must be submitted to the Authority, electronically, which is the caseforward it to the court together with its documents. Indicate the request for a hearing in the applicationmust. For those who do not receive a full personal exemption from judicial reviewprocedure fee is HUF 30,000, the lawsuit is subject to the right to record material fees. Before the Metropolitan Courtlegal representation is mandatory in proceedings.
Line 82: Line 83:
 
4- Forbes released in January 2020 - and in the meantime […] recalled - 50 richestThe printed and online version of the Hungarian publication (Data Management 2) . [Onlineversion under the link https://forbes.hu/extra/50-leggazdagabb-magyar-2019/ , the specificand the article is available under […] .]For Data Management 1, the following content was released:- In the printed version, the name of the family ([…] family) is the business in which they have an interestname ([…]), estimated value of the enterprise ([…]), head office of the enterprise ([…]),year of establishment ([…]) and the number of generations interested in the business ([…])indication. The entry contains the following description:[…]- The online version originally included the family name, but this […]has been removed as a result and the term […] can be read instead. In addition, thebusiness name, estimated value, year of incorporation and generations interested in the businessnumber has been indicated. The online version has a shorter description, the entrycontains only:[…]- The full names of the Applicants were not included in either the printed or online versionsas no other family members were named. The Applicantshis portrait was not or is not included in either the print or online versions.For Data Management 2, the following content was released:- In the printed version, only […] of the Applicants were named, the publication isit did not contain any direct or indirect reference to another member of the family. In the publicationthe amount of […] 's estimated assets ([…].), the source of the estimated assets ([…]) has been indicatedand also his age ([…]). The article contained the following description:[…]- The printed version included one of the MNB's Growth Bond Programalso a box describing the purpose of the issue, which also included the name of […] and the volume of the issue.([…]).- The online version also originally included […] 's name, but this […]has been removed as a result and the term […] can be read instead, as well as on thisin addition, the estimated value of the property was also indicated. The online version is shorter anda slightly different description can be read:[…]- The portrait of the Applicants (including […]) is not available in either the printed or online versionscontained or contained.For Data Management 1 and Data Management 2, it is managed and disclosed by the Applicantprovided is not specific under Article 9 of the General Data Protection Regulationpersonal data (racial or ethnic origin, political opinion, religious or worldview)personal data indicating beliefs or trade union membership, as well as naturalgenetic and biometric data, health data andpersonal information about the sexual life or sexual orientation of natural personsdata) category.The publicly available data in the […] business register include the compilation of the objectionable lists andAt the time of its publication, it was found that […] and […] held management positions in theand that […] and […] are members (ie owners) of the undertaking. Although the members of […](owners) occurred on the day ()] of the members (owners)amended on [vált] and replaced […] and […] by […] and […]registration, that development is irrelevant to the case, not least because
 
4- Forbes released in January 2020 - and in the meantime […] recalled - 50 richestThe printed and online version of the Hungarian publication (Data Management 2) . [Onlineversion under the link https://forbes.hu/extra/50-leggazdagabb-magyar-2019/ , the specificand the article is available under […] .]For Data Management 1, the following content was released:- In the printed version, the name of the family ([…] family) is the business in which they have an interestname ([…]), estimated value of the enterprise ([…]), head office of the enterprise ([…]),year of establishment ([…]) and the number of generations interested in the business ([…])indication. The entry contains the following description:[…]- The online version originally included the family name, but this […]has been removed as a result and the term […] can be read instead. In addition, thebusiness name, estimated value, year of incorporation and generations interested in the businessnumber has been indicated. The online version has a shorter description, the entrycontains only:[…]- The full names of the Applicants were not included in either the printed or online versionsas no other family members were named. The Applicantshis portrait was not or is not included in either the print or online versions.For Data Management 2, the following content was released:- In the printed version, only […] of the Applicants were named, the publication isit did not contain any direct or indirect reference to another member of the family. In the publicationthe amount of […] 's estimated assets ([…].), the source of the estimated assets ([…]) has been indicatedand also his age ([…]). The article contained the following description:[…]- The printed version included one of the MNB's Growth Bond Programalso a box describing the purpose of the issue, which also included the name of […] and the volume of the issue.([…]).- The online version also originally included […] 's name, but this […]has been removed as a result and the term […] can be read instead, as well as on thisin addition, the estimated value of the property was also indicated. The online version is shorter anda slightly different description can be read:[…]- The portrait of the Applicants (including […]) is not available in either the printed or online versionscontained or contained.For Data Management 1 and Data Management 2, it is managed and disclosed by the Applicantprovided is not specific under Article 9 of the General Data Protection Regulationpersonal data (racial or ethnic origin, political opinion, religious or worldview)personal data indicating beliefs or trade union membership, as well as naturalgenetic and biometric data, health data andpersonal information about the sexual life or sexual orientation of natural personsdata) category.The publicly available data in the […] business register include the compilation of the objectionable lists andAt the time of its publication, it was found that […] and […] held management positions in theand that […] and […] are members (ie owners) of the undertaking. Although the members of […](owners) occurred on the day ()] of the members (owners)amended on [vált] and replaced […] and […] by […] and […]registration, that development is irrelevant to the case, not least because
 
Page 5
 
Page 5
5publications, lists based on the data and information available and taken into account at that timehave been compiled.Data forming part of the public and public register of companies and / or the Applicantsin the accounts and on the website of the undertaking in which it has an interest, on […] , […] and […]In addition to the information under reference, for Data Management 1, […] is estimatedand for Data Management 2 […] (after the amendment: [módos])estimated assets from its activities have been disclosed.Although the (estimated) value of the company in which the Applicants have an interest, […] / […] (estimated)the amount of its assets is not part of the company register, it is not public data in the public interest,however, publications are not personal to Applicants (e.g., inherited, donated, married)acquired, etc.) are presented to the readership but to the businessand the amount of assets accumulated as a result of the business activityfrom publicly available company data, information, company reports and the companythe Applicant drew a conclusion from his own communications. The Applicant shall estimate these acollected data from public sources and then used them in a specific wayevaluated and communicated as an opinion.I.3. Correspondence between the Applicants and the ApplicantFor several correspondence between the Applicants and the Applicant regarding Data Management 1 and Data Management 2also took place. These exchanges of letters, which are set out in Annex III.4 to the Decision, at the point of concernwill be explained in detail in the context of the exercise of the right - the Authority willobligation to provide information, the balance of interests carried out by the Applicant and the ApplicantsGeneral Data Protection Regulation in response to requests from data subjects to exercise their rightsexamined and assessed for compliance with the relevant provisions ofI.4. Procedure, Statements made by the Applicants and the Requested ProcedureElectronic applications sent by the Applicants on 6 December 2019 and to the Authority on 6 December 2019.in their application received by post on 12 December and on 17 December 2019electronically and by application received by post on 19 December 2019.in their supplement, Data Management 1 and Data Management 2, as well as the Applicants ’such as prior information, access, rectification andthe right to protest - inadequate provision of objections and data protection authority proceedingsinitiated against the Applicant.In the application and its supplement, the Applicants stated the following:- The Applicant first implemented data collection in 2016 when the ApplicantsOn the basis of the data collected regarding the financial situation of the Company, the Applicants wished to be included in thein its publication summarizing the largest family businesses. The Applicants are already at this timestrongly protested against the data processing operations affecting them, as a result of which theApplicant then refused to disclose the data.- From the e-mail sent by the Applicant on 26 August 2019have been informed that they want the “[…] family” for the Requested Data Management 1indicated in the [] context, so that […] discloses the financial position of the familycalculation of public company data of companies owned by Forbes and Forbes editorial staffbased on its methods.- The Applicants were informed of this by a letter sent by the Applicant on 26 August 2019that [] Forbes ’family business listings in previous years did not include […] because
+
5publications, lists based on the data and information available and taken into account at that timehave been compiled.Data forming part of the public and public register of companies and / or the Applicantsin the accounts and on the website of the undertaking in which it has an interest, on […] , […] and […]In addition to the information under reference, for Data Management 1, […] is estimatedand for Data Management 2 […] (after the amendment: [módos])estimated assets from its activities have been disclosed.Although the (estimated) value of the company in which the Applicants have an interest, […] / […] (estimated)the amount of its assets is not part of the company register, it is not public data in the public interest,however, publications are not personal to Applicants (e.g., inherited, donated, married)acquired, etc.) are presented to the readership but to the businessand the amount of assets accumulated as a result of the business activityfrom publicly available company data, information, company reports and the companythe Applicant drew a conclusion from his own communications. The Applicant shall estimate these acollected data from public sources and then used them in a specific wayevaluated and communicated as an opinion.I.3. Correspondence between the Applicants and the ApplicantFor several correspondence between the Applicants and the Applicant regarding Data Management 1 and Data Management 2also took place. These exchanges of letters, which are set out in Annex III.4 to the Decision, at the point of concernwill be explained in detail in the context of the exercise of the right - the Authority willobligation to provide information, the balance of interests carried out by the Applicant and the ApplicantsGeneral Data Protection Regulation in response to requests from data subjects to exercise their rightsexamined and assessed for compliance with the relevant provisions ofI.4. Procedure, Statements made by the Applicants and the Requested ProcedureElectronic applications sent by the Applicants on 6 December 2019 and to the Authority on 6 December 2019.in their application received by post on 12 December and on 17 December 2019electronically and by application received by post on 19 December 2019.in their supplement, Data Management 1 and Data Management 2, as well as the Applicants ’such as prior information, access, rectification andthe right to protest - inadequate provision of objections and data protection authority proceedingsinitiated against the Applicant.In the application and its supplement, the Applicants stated the following:- The Applicant first implemented data collection in 2016 when the ApplicantsOn the basis of the data collected regarding the financial situation of the Company, the Applicants wished to be included in thein its publication summarizing the largest family businesses. The Applicants are already at this timestrongly protested against the data processing operations affecting them, as a result of which theApplicant then refused to disclose the data.- From the e-mail sent by the Applicant on 26 August 2019have been informed that they want the “[…] family” for the Requested Data Management 1indicated in the [[] context, so that […] discloses the financial position of the familycalculation of public company data of companies owned by Forbes and Forbes editorial staffbased on its methods.- The Applicants were informed of this by a letter sent by the Applicant on 26 August 2019that [[]] Forbes ’family business listings in previous years did not include […] because
 
Page 6
 
Page 6
 
6based on the data for the given year and our estimates based on them, in our opinion notranked among the 25 largest companies. ” From this, the Applicants concluded thatthat the Applicant has also collected data about them in recent years, however, the Applicanthe did not inform them in any way.- According to the Applicants, the use of the term "[család] family" is misleading and untrueand the use of the term in this context infringes the rights of members of the […] family whowho are not members of the […] and also includes a reference to minor children. THEAccording to the register of companies, […] is not owned by the '[…] family' but by […]and […]. […] And […] are not owners, but only executives of the company,consequently, according to the Applicants, the effectiveness of […] isthe conclusion regarding the property relations of the executives is false.- On 30 August 2019, the Applicants submitted a request to the Applicant in whichfirstly, they protested against the processing of their personal data and secondly against informationrequested in connection with the processing of their personal data and also requested that the Applicantcorrect inaccurate personal information.- In its reply to the request for the exercise of the rights of the data subject, the Applicant:According to the applicants, it was not provided for in the General Data Protection RegulationProvided all the information listed in Article 15 and did not provide any informationtheir rights regarding the processing of their personal dataand the legal remedies available against the data processing.- The Applicants further submitted that the Applicant had not indicated in its reply thaton what legal basis he handles personal data did not indicate that the data processingnor did it pass on the result of the balancing test. THEApplicant raised the issue of informing the public as the purpose of data management, the Applicantsconsiders, however, that this objective does not create a legitimate interest on the part of thewhich would lawfully process personal data, and the Applicants ’privacy andhis right to privacy takes precedence over any legitimate interests of the Applicantopposite. The Applicants claim that for years they have been paying special attention to private andto separate their business and the confidentiality of their privacy, not in the pressthey make a statement, their possible manifestations strictly on business considerationsconcentrate.- The Applicants submitted that the publication containing the largest family businessesFollowing its release in September 2019 - information confirmed by policebased on - identified, persons with a criminal record appeared in the family propertyaround. While the family has previously been able to successfully protect its privacy, the Applicantsin his view, the Forbes list published in September 2019 directed it to Applicantsattention of criminal circles .- By e-mail of 6 November 2019, the Applicant informed theApplicants to be included in the case of Requested Data Management 2 as wellApplicants as individuals.- As in the previous request, that letter did not contain a general data protectionDecree 13-14. and was not included in the listthe person (s) and specific data to be included,on what legal basis Forbes would publish the Applicantspersonal data established on the basis of certain calculations, which the Applicants asthe financial situation of individuals. Excel spreadsheet attached to the letterits document name refers to the “[…] family”, so in the Applicants ’view, the Applicantalready deals specifically with data relating to Applicants as individuals. THEHowever, in the applicants' view, the '[…] family' is inaccurate personal data, as it isit contains a reference to all family members, including children, but […] is ownedits range is limited to […] and […]. Also, according to the Applicants, the alleged propertythe calculation of data on their situation is based on a method of calculation not described,
 
6based on the data for the given year and our estimates based on them, in our opinion notranked among the 25 largest companies. ” From this, the Applicants concluded thatthat the Applicant has also collected data about them in recent years, however, the Applicanthe did not inform them in any way.- According to the Applicants, the use of the term "[család] family" is misleading and untrueand the use of the term in this context infringes the rights of members of the […] family whowho are not members of the […] and also includes a reference to minor children. THEAccording to the register of companies, […] is not owned by the '[…] family' but by […]and […]. […] And […] are not owners, but only executives of the company,consequently, according to the Applicants, the effectiveness of […] isthe conclusion regarding the property relations of the executives is false.- On 30 August 2019, the Applicants submitted a request to the Applicant in whichfirstly, they protested against the processing of their personal data and secondly against informationrequested in connection with the processing of their personal data and also requested that the Applicantcorrect inaccurate personal information.- In its reply to the request for the exercise of the rights of the data subject, the Applicant:According to the applicants, it was not provided for in the General Data Protection RegulationProvided all the information listed in Article 15 and did not provide any informationtheir rights regarding the processing of their personal dataand the legal remedies available against the data processing.- The Applicants further submitted that the Applicant had not indicated in its reply thaton what legal basis he handles personal data did not indicate that the data processingnor did it pass on the result of the balancing test. THEApplicant raised the issue of informing the public as the purpose of data management, the Applicantsconsiders, however, that this objective does not create a legitimate interest on the part of thewhich would lawfully process personal data, and the Applicants ’privacy andhis right to privacy takes precedence over any legitimate interests of the Applicantopposite. The Applicants claim that for years they have been paying special attention to private andto separate their business and the confidentiality of their privacy, not in the pressthey make a statement, their possible manifestations strictly on business considerationsconcentrate.- The Applicants submitted that the publication containing the largest family businessesFollowing its release in September 2019 - information confirmed by policebased on - identified, persons with a criminal record appeared in the family propertyaround. While the family has previously been able to successfully protect its privacy, the Applicantsin his view, the Forbes list published in September 2019 directed it to Applicantsattention of criminal circles .- By e-mail of 6 November 2019, the Applicant informed theApplicants to be included in the case of Requested Data Management 2 as wellApplicants as individuals.- As in the previous request, that letter did not contain a general data protectionDecree 13-14. and was not included in the listthe person (s) and specific data to be included,on what legal basis Forbes would publish the Applicantspersonal data established on the basis of certain calculations, which the Applicants asthe financial situation of individuals. Excel spreadsheet attached to the letterits document name refers to the “[…] family”, so in the Applicants ’view, the Applicantalready deals specifically with data relating to Applicants as individuals. THEHowever, in the applicants' view, the '[…] family' is inaccurate personal data, as it isit contains a reference to all family members, including children, but […] is ownedits range is limited to […] and […]. Also, according to the Applicants, the alleged propertythe calculation of data on their situation is based on a method of calculation not described,
Line 136: Line 137:
 
31Under Article 10 (1) of the European Convention on Human Rights, everyone has the right to: afreedom of expression. This right includes freedom of expression andit respects the freedom to know and communicate information and ideas across national borderswithout the intervention of an official body.III. Decision of the AuthorityIII.1. The identity of the controllerA natural person as defined in the General Data Protection Regulationany information on the basis of which that natural person is directly or indirectlyindirectly identifiable personal data, any operation performed on the datathe purpose and means of data management, alone or in association with othersnatural or legal person, public authority, agency or any other bodyand the body is considered a data controller.With regard to the data management examined, the full name, surname and economic situation of the Applicantspersonal data pursuant to Article 4 (1) of the General Data Protection Regulation,and the publisher of a press product that collects, processes, lists and publishes data isunder Article 4 (7) of the General Data Protection Regulation, a data controller is either online or offlinecontent, publications and personal data published in printed formwith regard to the (re) use of personal data andthe purpose of its publication is determined by the publisher of the press product.Data Management 1 and Data Management 2 pursuant to Article 2 (1) of the General Data Protection Regulationfalls within the scope of the General Data Protection Regulation and, consequently, thethe rules of the general data protection regulation apply.Pursuant to the above, the Applicant, as the publisher of Forbes in Hungary, is the objected data handlersis considered a data controller.III.2. The identity of the ApplicantsThe lack of public role of the Applicants was also repeatedly invoked by the Applicants in the proceedingsin their statements and correspondence with the Applicant.3145/2018. (V. 7.), the Constitutional Court emphasized that the change had taken placeexpansion of the range of public actors through the spread of social conditions, especially telecommunicationsso that people have the opportunity to become active participants in public debates,who were not previously included in the conceptual scope of public actors. These persons are the so-called. exceptionalpublic actors. {3145/2018 (V. 7.) Decision AB Justification [46]}Freedom of expression is primarily concerned with criticizing public authoritiesexpresses opinions, but in the interpretation of the Constitutional Court it is publicthe range of issues is wider than political speech and persons exercising public powercriticizing its activities. Accordingly, the public debate is not limited to the state andit covers the whole operation of the local government, the system of public authorities, but also encompasses itin the world of corporate social responsibility and businesspublic issues (eg environmental, energy efficiency, labor, etc.)road safety issues). {3145/2018 (V. 7.) AB Decision Justification [31] - [32]}According to the decision of the Constitutional Court, in deciding the quality of a public figure, the followingaspects are relevant:
 
31Under Article 10 (1) of the European Convention on Human Rights, everyone has the right to: afreedom of expression. This right includes freedom of expression andit respects the freedom to know and communicate information and ideas across national borderswithout the intervention of an official body.III. Decision of the AuthorityIII.1. The identity of the controllerA natural person as defined in the General Data Protection Regulationany information on the basis of which that natural person is directly or indirectlyindirectly identifiable personal data, any operation performed on the datathe purpose and means of data management, alone or in association with othersnatural or legal person, public authority, agency or any other bodyand the body is considered a data controller.With regard to the data management examined, the full name, surname and economic situation of the Applicantspersonal data pursuant to Article 4 (1) of the General Data Protection Regulation,and the publisher of a press product that collects, processes, lists and publishes data isunder Article 4 (7) of the General Data Protection Regulation, a data controller is either online or offlinecontent, publications and personal data published in printed formwith regard to the (re) use of personal data andthe purpose of its publication is determined by the publisher of the press product.Data Management 1 and Data Management 2 pursuant to Article 2 (1) of the General Data Protection Regulationfalls within the scope of the General Data Protection Regulation and, consequently, thethe rules of the general data protection regulation apply.Pursuant to the above, the Applicant, as the publisher of Forbes in Hungary, is the objected data handlersis considered a data controller.III.2. The identity of the ApplicantsThe lack of public role of the Applicants was also repeatedly invoked by the Applicants in the proceedingsin their statements and correspondence with the Applicant.3145/2018. (V. 7.), the Constitutional Court emphasized that the change had taken placeexpansion of the range of public actors through the spread of social conditions, especially telecommunicationsso that people have the opportunity to become active participants in public debates,who were not previously included in the conceptual scope of public actors. These persons are the so-called. exceptionalpublic actors. {3145/2018 (V. 7.) Decision AB Justification [46]}Freedom of expression is primarily concerned with criticizing public authoritiesexpresses opinions, but in the interpretation of the Constitutional Court it is publicthe range of issues is wider than political speech and persons exercising public powercriticizing its activities. Accordingly, the public debate is not limited to the state andit covers the whole operation of the local government, the system of public authorities, but also encompasses itin the world of corporate social responsibility and businesspublic issues (eg environmental, energy efficiency, labor, etc.)road safety issues). {3145/2018 (V. 7.) AB Decision Justification [31] - [32]}According to the decision of the Constitutional Court, in deciding the quality of a public figure, the followingaspects are relevant:
 
Page 32
 
Page 32
32- whether the public statement expressing the opinion reflects the position expressed in the public interest debate,- whether the public communication involves a public performance,- whether the communication to the public involves a statement of fact or a judgment of value,- whether the communication to the public infringes the human dignity or reputation of the person concerned(honor).Public actor quality is the fact of public involvement that goes hand in hand with the discussion of public life issueswhich, according to AB, must always be assessed individually on the basis of the specified criteria:the manner and circumstances of the communication and the subject and context of the opinion (eg the medium)type, subject of communication, content, style, purpose, topicality, reactions to it).The exercise of freedom of expression can only be justified in cases wherein which the participants have become, at their own discretion, more active actors in public affairs than others,thereby also undertaking public assessments and criticisms of the community concerned. Public affairstherefore, statements which affect or characterize them and which attack themthey have to put up with more patience. { 3145/2018 (V. 7.) Decision AB Justification [48]}The Applicants emphasized that they had always wanted to separate their private lives frommarket life, and although the establishment of a business is voluntary, this does not in itself mean thatbusiness owners, senior executives become public actors, andthat someone is rich is not necessarily a sufficient condition for restricting privacy, that israther, it is only one component of influence.However, in the case of the Applicants, the fact that the […]in a few years - from state subsidies and from state or other public fundsresources - has become a market leader in several countries. Applicants must counthad to be a successful, high-wealth company in the case of the business world as a public life onethey also become active shapers of its segment, undertaking the accompanying evaluations and criticismswhich they thus have to endure with greater patience.In connection with the present case, it can also be stated that one of the content elements of the examined communications is the Applicantsname and managing position, ownership position shall be considered as public data in the public interestdue to:- The Ctv. Pursuant to Section 10 (2), the existing or deleted data of the register of companies are in fullare public. Thus, the data contained in company files, including personal data,which, during registration in the register of companies, the purpose of the register of companiesaccordingly, data subjects provide their personal data with a view to disclosureaccessible to anyone. Existing or deleted data in the register of companies, as well aspersonal data contained in company records are public data in the public interest which are personaldata and also public data in the public interest.- On the mandatory content of the register of companies, the Ctv. Section 24 (1), as well as limited liabilitycompanies such as […] - Ctv. Section 27 (3) provides. The referencedlegislation stipulates that the register of companies for all companies, inter alia,contains the name of the company's senior executive or the person authorized to represent the company,the position of the persons entitled to represent and, in the case of a limited liability company,among other things, the names of the members or, in the case of a jointly owned share, the owners.- The publicity of the data included in the register of companies is regulated by Ctv. according to its preamblepurposes and the legislator considered that this interest outweighed the data subjectsinterests.It should also be noted that the information provided in the publications on […] is on the one handcan be found in […] 's own accounts and website, and on the other hand, that [] publichas implemented and is implementing various expansions, capacity enhancements,
+
32- whether the public statement expressing the opinion reflects the position expressed in the public interest debate,- whether the public communication involves a public performance,- whether the communication to the public involves a statement of fact or a judgment of value,- whether the communication to the public infringes the human dignity or reputation of the person concerned(honor).Public actor quality is the fact of public involvement that goes hand in hand with the discussion of public life issueswhich, according to AB, must always be assessed individually on the basis of the specified criteria:the manner and circumstances of the communication and the subject and context of the opinion (eg the medium)type, subject of communication, content, style, purpose, topicality, reactions to it).The exercise of freedom of expression can only be justified in cases wherein which the participants have become, at their own discretion, more active actors in public affairs than others,thereby also undertaking public assessments and criticisms of the community concerned. Public affairstherefore, statements which affect or characterize them and which attack themthey have to put up with more patience. { 3145/2018 (V. 7.) Decision AB Justification [48]}The Applicants emphasized that they had always wanted to separate their private lives frommarket life, and although the establishment of a business is voluntary, this does not in itself mean thatbusiness owners, senior executives become public actors, andthat someone is rich is not necessarily a sufficient condition for restricting privacy, that israther, it is only one component of influence.However, in the case of the Applicants, the fact that the […]in a few years - from state subsidies and from state or other public fundsresources - has become a market leader in several countries. Applicants must counthad to be a successful, high-wealth company in the case of the business world as a public life onethey also become active shapers of its segment, undertaking the accompanying evaluations and criticismswhich they thus have to endure with greater patience.In connection with the present case, it can also be stated that one of the content elements of the examined communications is the Applicantsname and managing position, ownership position shall be considered as public data in the public interestdue to:- The Ctv. Pursuant to Section 10 (2), the existing or deleted data of the register of companies are in fullare public. Thus, the data contained in company files, including personal data,which, during registration in the register of companies, the purpose of the register of companiesaccordingly, data subjects provide their personal data with a view to disclosureaccessible to anyone. Existing or deleted data in the register of companies, as well aspersonal data contained in company records are public data in the public interest which are personaldata and also public data in the public interest.- On the mandatory content of the register of companies, the Ctv. Section 24 (1), as well as limited liabilitycompanies such as […] - Ctv. Section 27 (3) provides. The referencedlegislation stipulates that the register of companies for all companies, inter alia,contains the name of the company's senior executive or the person authorized to represent the company,the position of the persons entitled to represent and, in the case of a limited liability company,among other things, the names of the members or, in the case of a jointly owned share, the owners.- The publicity of the data included in the register of companies is regulated by Ctv. according to its preamblepurposes and the legislator considered that this interest outweighed the data subjectsinterests.It should also be noted that the information provided in the publications on […] is on the one handcan be found in […] 's own accounts and website, and on the other hand, that [[] publichas implemented and is implementing various expansions, capacity enhancements,
 
Page 33
 
Page 33
 
33public data in the public interest according to the Property Act. Section 5, paragraphs (1) - (2), and Infotv. Section 27 (3)pursuant to paragraphIII.3. Legality of data processingThe subject matter of the present case is not usually the data protection analysis of economic journalism, and although the nature of the caseand circumstances, the Authority also makes general findings to emphasize that it is presentIn this procedure, the Authority is linked to specific publications ("products") issued by the Applicantexamined data treatments.Under the provisions of the General Data Protection Regulation, there are a number of reasons for the lawfulness of data processingrequirement must be met.Article 5 of the General Data Protection Regulation contains the main principles that are personalmust be taken into account in the processing of the data and which must be in force at all timesduring data management. Such principles include legality, due process and transparency,the principles of purpose limitation, data saving, accuracy and limited storage [5. Article 1paragraph 1 (a) to (e)]. From the principle of accountability [5. Article 2 (2)]is responsible for complying with data protection principles and must be able to do soalso to prove. Accordingly, the data controller must be able to prove that it is personalthe purpose for which it processes the data and why it can be considered for that purposeit is imperative to process your personal information, in addition, you must do everythingreasonable steps to ensure that it is inaccurate for the purposes of the processingdelete or rectify personal data without delay and document andkeep records of data processing so that its lawfulness can be proved afterwards.The controller must have a legal basis in accordance with Article 6 of the General Data Protection Regulationhave access to the data and be able to demonstrate that, with the consent of the data subject, orwhich legal provision it handles / has handled personal data in accordance with or whichdata processing is necessary to enforce the legitimate interests of the controller or a third party,and the processing restricts the data subject's right to the protection of the personal data proportionately.The name and financial situation of the Applicants are undoubtedly personal to the Applicantshowever, their activities in relation to the company in which they have an interesthaving regard to the fact that their data entered in the business register are public data in the public interest, as well asa Ctv. Company data pursuant to Section 10 (1).Of course, the quality of the company data in the data in question does not mean that the data in the company registercould be used in any way: respecting the principle of purposeful data managementappropriate legal basis, and - ensuring the right to information self-determinationwith due regard for the rights of the data subject.According to the Applicant's statement, the purpose of data processing is the rights arising from the freedom of the pressinformation activities of the press in a democratic societyimplement. The Applicant also aims to inform the Hungarian business community, aabout the owners behind the largest Hungarian-owned companies, thus contributing to businesstransparency and traceability. The Applicant also considers it his responsibility to be Hungarianstrengthening the entrepreneurial culture by reporting on the activities of successful Hungarian entrepreneurs- the compilation of the annual rich list partly serves this purpose.In the publications, the Applicant linked […] to the “[…] family”. The Authority considers thatin the context of publications, the word ‘family’ is synonymous with family businessshould be interpreted, and although there is no legal definition of a family business in Hungary,according to professional interpretation, regardless of their size and results, it is a family-run economy
 
33public data in the public interest according to the Property Act. Section 5, paragraphs (1) - (2), and Infotv. Section 27 (3)pursuant to paragraphIII.3. Legality of data processingThe subject matter of the present case is not usually the data protection analysis of economic journalism, and although the nature of the caseand circumstances, the Authority also makes general findings to emphasize that it is presentIn this procedure, the Authority is linked to specific publications ("products") issued by the Applicantexamined data treatments.Under the provisions of the General Data Protection Regulation, there are a number of reasons for the lawfulness of data processingrequirement must be met.Article 5 of the General Data Protection Regulation contains the main principles that are personalmust be taken into account in the processing of the data and which must be in force at all timesduring data management. Such principles include legality, due process and transparency,the principles of purpose limitation, data saving, accuracy and limited storage [5. Article 1paragraph 1 (a) to (e)]. From the principle of accountability [5. Article 2 (2)]is responsible for complying with data protection principles and must be able to do soalso to prove. Accordingly, the data controller must be able to prove that it is personalthe purpose for which it processes the data and why it can be considered for that purposeit is imperative to process your personal information, in addition, you must do everythingreasonable steps to ensure that it is inaccurate for the purposes of the processingdelete or rectify personal data without delay and document andkeep records of data processing so that its lawfulness can be proved afterwards.The controller must have a legal basis in accordance with Article 6 of the General Data Protection Regulationhave access to the data and be able to demonstrate that, with the consent of the data subject, orwhich legal provision it handles / has handled personal data in accordance with or whichdata processing is necessary to enforce the legitimate interests of the controller or a third party,and the processing restricts the data subject's right to the protection of the personal data proportionately.The name and financial situation of the Applicants are undoubtedly personal to the Applicantshowever, their activities in relation to the company in which they have an interesthaving regard to the fact that their data entered in the business register are public data in the public interest, as well asa Ctv. Company data pursuant to Section 10 (1).Of course, the quality of the company data in the data in question does not mean that the data in the company registercould be used in any way: respecting the principle of purposeful data managementappropriate legal basis, and - ensuring the right to information self-determinationwith due regard for the rights of the data subject.According to the Applicant's statement, the purpose of data processing is the rights arising from the freedom of the pressinformation activities of the press in a democratic societyimplement. The Applicant also aims to inform the Hungarian business community, aabout the owners behind the largest Hungarian-owned companies, thus contributing to businesstransparency and traceability. The Applicant also considers it his responsibility to be Hungarianstrengthening the entrepreneurial culture by reporting on the activities of successful Hungarian entrepreneurs- the compilation of the annual rich list partly serves this purpose.In the publications, the Applicant linked […] to the “[…] family”. The Authority considers thatin the context of publications, the word ‘family’ is synonymous with family businessshould be interpreted, and although there is no legal definition of a family business in Hungary,according to professional interpretation, regardless of their size and results, it is a family-run economy
Line 156: Line 157:
 
41III.4. Rights of the data subject and limitations on the exercise of rightsIn connection with the rights of the data subject, the Applicants in their application Data Management 1 and Data Management 2Article 13 (2) of the General Data Protection Regulation(f) and Article 14 (2) (g), Article 14 (1) to (2), Article 15 (1)for infringement of Article 21 (1) (h) and Article 21 (1)unlawful processing and order, pursuant to Article 18 (1) (a) and (d),personal data and then personal data in accordance with Article 17 (1) (c)deletion.The duality already detailed above - that certain personal data is also in the public interestpublic company data - it cannot, of course, mean that the person concerned is completely affected by this circumstancewould lose its right to self-determination over the data and the disclosure of personal data aunrestricted and complete loss of the right to privacy.Rights of data subjects (including the right to information, protest and cancellation)data controller obligations related to the exercise ofArticle 12 of the Data Protection Regulation.Based on the statements and available documents Applicants (or their legal representative)The following exchanges of letters took place between the Applicant (and its journalists) during the period under review:- An e-mail from the journalist employed by the Applicant on 16 August 2019contacted the company related to the Applicants in connection with Data Management 1,attached to which letter was used to compile the compilationThe following is a brief description of the methodology:“We evaluated the companies based on the methodology of our US parent company. Wherewe knew, we calculated on the basis of EBIDTA and we took into account company court data. THEaccording to international company valuation practice, we used an industry multiplier. This is AswathWe used Damodaran, a professor at New York University, as a starting point, buttogether with our domestic company valuation experts and our regional siblingstailored to the region and the Hungarian market, where necessary. To the value thus obtainedwe added the cash stock available to the company and subtracted theloans. You can find our detailed calculation in the attached Excel file. ”In addition to the methodological description, as an attachment to the e-mail in the form of an excel spreadsheeta calculation (estimate) based on […] data was also sent.Based on the above, it can be concluded that the Applicants, contrary to their claim, did not apply in 2019.on August 26, 2019, but on August 16, 2019, were informed that aApplicant wishes to be on Forbes ’list of most valuable family businessesto be indicated in the […] Following a journalistic request, 22-26 August 2019. betweenThe following exchanges of letters took place between […] and the Applicant during the period:• Applicant on August 22, 2019 - to an e-mail unknown to the Authorityin his reply, informed the person acting on behalf of […] (or the Applicants)person that the company name and surname will be included in the list for everyone, aabove the article the owners in the company registration are indicated,as when […] was last on this list.• On 26 August 2019, […] addressed a request to the Applicant that aAs in previous years, it was requested to exclude the […] and […] familiesData Management 1 and should not be used in any compilationthe term “[…] family”.• The Applicant provided information in its reply sent on 26 August 2019that […] had not been listed in the Forbes family business in previous yearsbecause of the data for that year and the estimates based on themin their opinion, they did not fit into the top 25 companies. For three years the family and
 
41III.4. Rights of the data subject and limitations on the exercise of rightsIn connection with the rights of the data subject, the Applicants in their application Data Management 1 and Data Management 2Article 13 (2) of the General Data Protection Regulation(f) and Article 14 (2) (g), Article 14 (1) to (2), Article 15 (1)for infringement of Article 21 (1) (h) and Article 21 (1)unlawful processing and order, pursuant to Article 18 (1) (a) and (d),personal data and then personal data in accordance with Article 17 (1) (c)deletion.The duality already detailed above - that certain personal data is also in the public interestpublic company data - it cannot, of course, mean that the person concerned is completely affected by this circumstancewould lose its right to self-determination over the data and the disclosure of personal data aunrestricted and complete loss of the right to privacy.Rights of data subjects (including the right to information, protest and cancellation)data controller obligations related to the exercise ofArticle 12 of the Data Protection Regulation.Based on the statements and available documents Applicants (or their legal representative)The following exchanges of letters took place between the Applicant (and its journalists) during the period under review:- An e-mail from the journalist employed by the Applicant on 16 August 2019contacted the company related to the Applicants in connection with Data Management 1,attached to which letter was used to compile the compilationThe following is a brief description of the methodology:“We evaluated the companies based on the methodology of our US parent company. Wherewe knew, we calculated on the basis of EBIDTA and we took into account company court data. THEaccording to international company valuation practice, we used an industry multiplier. This is AswathWe used Damodaran, a professor at New York University, as a starting point, buttogether with our domestic company valuation experts and our regional siblingstailored to the region and the Hungarian market, where necessary. To the value thus obtainedwe added the cash stock available to the company and subtracted theloans. You can find our detailed calculation in the attached Excel file. ”In addition to the methodological description, as an attachment to the e-mail in the form of an excel spreadsheeta calculation (estimate) based on […] data was also sent.Based on the above, it can be concluded that the Applicants, contrary to their claim, did not apply in 2019.on August 26, 2019, but on August 16, 2019, were informed that aApplicant wishes to be on Forbes ’list of most valuable family businessesto be indicated in the […] Following a journalistic request, 22-26 August 2019. betweenThe following exchanges of letters took place between […] and the Applicant during the period:• Applicant on August 22, 2019 - to an e-mail unknown to the Authorityin his reply, informed the person acting on behalf of […] (or the Applicants)person that the company name and surname will be included in the list for everyone, aabove the article the owners in the company registration are indicated,as when […] was last on this list.• On 26 August 2019, […] addressed a request to the Applicant that aAs in previous years, it was requested to exclude the […] and […] familiesData Management 1 and should not be used in any compilationthe term “[…] family”.• The Applicant provided information in its reply sent on 26 August 2019that […] had not been listed in the Forbes family business in previous yearsbecause of the data for that year and the estimates based on themin their opinion, they did not fit into the top 25 companies. For three years the family and
 
Page 42
 
Page 42
42the company was on the list at the time because it was calculated at the time to fit into the 25thamong the largest companies. On other Forbes lists - for example, the 100 largest Hungariansowned private company ranking - in recent years has also been included in the […], then formention of the family was omitted because it was not justified.- In their letter dated 30 August 2019, the Applicants referred to the General Data Protection RegulationArticle 14 of the General Data Protection Regulation.Article 16 of the General Data Protection Regulationthe right to rectification (as regards the term ‘[család] family’) and the generalincluding the right to object under Article 21 of the Data Protection Regulationa request for the exercise of a right was made to the Applicant. The right to protestThe Applicants did not explain in sufficient detail in their application for the exercise of thereasons for the protest, they merely indicated that in their view there was no such coercionlegitimate reason on the basis of which the Applicant would be entitled to process their personal data.- In its reply to the data subject's request for the exercise of the right, the Applicant• indicated the purpose of data management (informing the public, for freedom of the pressexercise of the right of access), indicated the categories of personal data (names of owners,name of their mother, names of senior executives) and personal or […]sources of information on the results of (Information in the Company Database, the e-reports downloaded from beszamolo.im.gov.hu , previous announcements of […],public announcements);• provided information that, although external experts were consulted, they did sotypically only industry multipliers are negotiated with them, external experts are preparedspecific estimates only in exceptional cases, in personbut does not provide the Requested Data during the personal consultation,but only the company name, the balance sheet data used for the estimates, the multiplier and thethe final result of the estimate is shared with them, but neither [] nor […]in the case of other family interests;• marked the person involved in compiling the list and thus the data managerstaff, with the special reference to being a trainee on the listdid not have access to the database created to create the list - so did the data for […]and his work was covered by a traineeship contract supplemented by a confidentiality clauseperformed on the basis of;• in connection with the duration of the data processing, provided information that aavailable company data were used to verify the criteria for a family businessbut not recorded by the Applicant; required for estimationdata were used to compile the list and then deleted after the material was completed;• Finally, he mentioned that […] and the name of the control family were included in the magazine(no separate family member was mentioned) and the estimated goodwill was included;the same data are included on the forbes.hu page, where an extract of the list was placedfor communication.- The Applicant in November 2019 (according to the Applicants' statement on 6 November,according to the Applicant's statement on November 14 - the exact date before the Authorityunknown) contacted the Applicants (who exactly is, it is also not possible to determineon the basis of declarations and documents received by the Authority) in relation to Data Management 2,attached to which letter was used to compile the compilationThe following is a brief description of the methodology:“We evaluated the companies based on the methodology of our US parent company. Wherewe knew, we calculated on the basis of EBIDTA and we took into account company court data. THEaccording to international company valuation practice, we used an industry multiplier. This is AswathWe used Damodaran, a professor at New York University, as a starting point, buttogether with our domestic company valuation experts and our regional siblingstailored to the region and the Hungarian market, where necessary. To the value thus obtained
+
42the company was on the list at the time because it was calculated at the time to fit into the 25thamong the largest companies. On other Forbes lists - for example, the 100 largest Hungariansowned private company ranking - in recent years has also been included in the […], then formention of the family was omitted because it was not justified.- In their letter dated 30 August 2019, the Applicants referred to the General Data Protection RegulationArticle 14 of the General Data Protection Regulation.Article 16 of the General Data Protection Regulationthe right to rectification (as regards the term ‘[család] family’) and the generalincluding the right to object under Article 21 of the Data Protection Regulationa request for the exercise of a right was made to the Applicant. The right to protestThe Applicants did not explain in sufficient detail in their application for the exercise of thereasons for the protest, they merely indicated that in their view there was no such coercionlegitimate reason on the basis of which the Applicant would be entitled to process their personal data.- In its reply to the data subject's request for the exercise of the right, the Applicant• indicated the purpose of data management (informing the public, for freedom of the pressexercise of the right of access), indicated the categories of personal data (names of owners,name of their mother, names of senior executives) and personal or […]sources of information on the results of (Information in the Company Database, the e-reports downloaded from beszamolo.im.gov.hu , previous announcements of […],public announcements);• provided information that, although external experts were consulted, they did sotypically only industry multipliers are negotiated with them, external experts are preparedspecific estimates only in exceptional cases, in personbut does not provide the Requested Data during the personal consultation,but only the company name, the balance sheet data used for the estimates, the multiplier and thethe final result of the estimate is shared with them, but neither [[] nor […]in the case of other family interests;• marked the person involved in compiling the list and thus the data managerstaff, with the special reference to being a trainee on the listdid not have access to the database created to create the list - so did the data for […]and his work was covered by a traineeship contract supplemented by a confidentiality clauseperformed on the basis of;• in connection with the duration of the data processing, provided information that aavailable company data were used to verify the criteria for a family businessbut not recorded by the Applicant; required for estimationdata were used to compile the list and then deleted after the material was completed;• Finally, he mentioned that […] and the name of the control family were included in the magazine(no separate family member was mentioned) and the estimated goodwill was included;the same data are included on the forbes.hu page, where an extract of the list was placedfor communication.- The Applicant in November 2019 (according to the Applicants' statement on 6 November,according to the Applicant's statement on November 14 - the exact date before the Authorityunknown) contacted the Applicants (who exactly is, it is also not possible to determineon the basis of declarations and documents received by the Authority) in relation to Data Management 2,attached to which letter was used to compile the compilationThe following is a brief description of the methodology:“We evaluated the companies based on the methodology of our US parent company. Wherewe knew, we calculated on the basis of EBIDTA and we took into account company court data. THEaccording to international company valuation practice, we used an industry multiplier. This is AswathWe used Damodaran, a professor at New York University, as a starting point, buttogether with our domestic company valuation experts and our regional siblingstailored to the region and the Hungarian market, where necessary. To the value thus obtained
 
Page 43
 
Page 43
 
43we added the cash stock available to the company and subtracted theloans. The above methodology is most applicable to production companies. Financialfor service providers and real estate developers, it is also a U.S. parent fund guideWe act on the basis of: here the value accumulated in the company (mostly from assets)we start and deduct all liabilities. You will find our detailed calculationin the attached Excel file. "In addition to the methodological description, as an attachment to the e-mail in the form of an excel spreadsheeta calculation (estimate) based on business data was also sent.- The Applicants' lawyer sent to the Applicant on 15 November 2019letter of formal notice pursuant to Article 21 of the General Data Protection Regulationprotested against the data processing carried out by the Applicant concerning Applicants andthey were prohibited from accessing any personal data concerning themcollect and perform other data processing activities, includingdisclosure. Applicants were also prohibited from doing so - either by name ormentioned as a family, appear in the statement, either directly or indirectly,and called on the Applicant to provide the Applicants ’personal details without delaydelete them and do not carry out any data processing operations on them or on them.The Applicants are Article 18 (1) (a) and (d) of the General Data Protection Regulationalso requested a restriction on data processing and strongly called on theApplicant to refrain from publishing data concerning Applicants in generalcircumstances set out in Article 18 (1) (a) and (d) of the Data Protection Regulationas well as in the wake of the protest. The Applicants also called on theApplicant's attention is drawn to the fact that the data contained in the company register of the Applicants andthe conclusion reached regarding the financial situation of their family is inaccurate or erroneous, aThe data on the financial situation of the applicants differ significantly from the actual onesnotarised by a notary public. For the exercise of the right of objectionIn this application, the Applicants did not explain in sufficient detail the reasons for the protest,they merely indicated that, in their view, the data processing was seriously prejudicial toApplicants' rights and legitimate interests.- In its reply of 20 November 2019, the Applicant• Article 6 (1) (f) of the General Data Protection Regulationas a legal basis for data management; the Applicant justified this on the grounds that onean economic newspaper such as Forbes has a legitimate interest in Hungarian entrepreneursto inform the public and to refer to the State aid used by […]and to participate in the bond program of the Magyar Nemzeti Bank;• requested a proposal to change the name regarding the accuracy of personal data;• Concerned the discrepancy with the actual data, noted that earlierone of the purposes of the email sent was precisely to the Applicantshave the opportunity to comment on the valuation and the information sent by themdata and results for correction - if professionally justified andacceptable - taken into account in making estimates; the Requestedfurther noted that their professional opinion formed an approximationestimates for the publicly available fiscal year ended December 31, 2018at the same time informed the Applicants thatif there is a business decision, any other circumstances that make the assessmentaffected, the Applicant shall consider or agree to take this into accountwith the Applicants;• to inform and inform the public for the purpose of drawing up and publishing the list; andmarked the exercise of the right to freedom of the press; the position of the Candidateaccording to the presentation of whether the recipient of state mandates or stateor other public subsidies (and their owners)how the Hungarian entrepreneurial layer uses these resources
 
43we added the cash stock available to the company and subtracted theloans. The above methodology is most applicable to production companies. Financialfor service providers and real estate developers, it is also a U.S. parent fund guideWe act on the basis of: here the value accumulated in the company (mostly from assets)we start and deduct all liabilities. You will find our detailed calculationin the attached Excel file. "In addition to the methodological description, as an attachment to the e-mail in the form of an excel spreadsheeta calculation (estimate) based on business data was also sent.- The Applicants' lawyer sent to the Applicant on 15 November 2019letter of formal notice pursuant to Article 21 of the General Data Protection Regulationprotested against the data processing carried out by the Applicant concerning Applicants andthey were prohibited from accessing any personal data concerning themcollect and perform other data processing activities, includingdisclosure. Applicants were also prohibited from doing so - either by name ormentioned as a family, appear in the statement, either directly or indirectly,and called on the Applicant to provide the Applicants ’personal details without delaydelete them and do not carry out any data processing operations on them or on them.The Applicants are Article 18 (1) (a) and (d) of the General Data Protection Regulationalso requested a restriction on data processing and strongly called on theApplicant to refrain from publishing data concerning Applicants in generalcircumstances set out in Article 18 (1) (a) and (d) of the Data Protection Regulationas well as in the wake of the protest. The Applicants also called on theApplicant's attention is drawn to the fact that the data contained in the company register of the Applicants andthe conclusion reached regarding the financial situation of their family is inaccurate or erroneous, aThe data on the financial situation of the applicants differ significantly from the actual onesnotarised by a notary public. For the exercise of the right of objectionIn this application, the Applicants did not explain in sufficient detail the reasons for the protest,they merely indicated that, in their view, the data processing was seriously prejudicial toApplicants' rights and legitimate interests.- In its reply of 20 November 2019, the Applicant• Article 6 (1) (f) of the General Data Protection Regulationas a legal basis for data management; the Applicant justified this on the grounds that onean economic newspaper such as Forbes has a legitimate interest in Hungarian entrepreneursto inform the public and to refer to the State aid used by […]and to participate in the bond program of the Magyar Nemzeti Bank;• requested a proposal to change the name regarding the accuracy of personal data;• Concerned the discrepancy with the actual data, noted that earlierone of the purposes of the email sent was precisely to the Applicantshave the opportunity to comment on the valuation and the information sent by themdata and results for correction - if professionally justified andacceptable - taken into account in making estimates; the Requestedfurther noted that their professional opinion formed an approximationestimates for the publicly available fiscal year ended December 31, 2018at the same time informed the Applicants thatif there is a business decision, any other circumstances that make the assessmentaffected, the Applicant shall consider or agree to take this into accountwith the Applicants;• to inform and inform the public for the purpose of drawing up and publishing the list; andmarked the exercise of the right to freedom of the press; the position of the Candidateaccording to the presentation of whether the recipient of state mandates or stateor other public subsidies (and their owners)how the Hungarian entrepreneurial layer uses these resources

Please note that all contributions to GDPRhub are considered to be released under the Creative Commons Attribution-NonCommercial-ShareAlike (see GDPRhub:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To edit this page, please answer the question that appears below (more info):

Cancel Editing help (opens in new window)

Template used on this page: