HUNGARY Law and Practice Contributed by: Adam Liber and Tamás Bereczki, PROVARIS Varga & Partners
measures. It can be initiated independently of an investigation procedure. Both procedures can be triggered ex officio or through complaints. For administrative pro - cedures, complaints can only be filed by the directly affected data subject. The NAIH has extensive investigatory powers, including on- site inspections and access to data process - ing equipment. Controllers are often required to provide GDPR-compliant documentation swiftly, highlighting the importance of GDPR’s account - Regarding the calculation of fines, the EDPB Guidelines 04/2022 on the calculation of admin - istrative fines under the GDPR generally apply. According to the Information Act, the NAIH shall consider all circumstances of the case to decide whether imposing a fine is justified and to deter - mine the amount of the fine. In particular, the NAIH takes into account: • the scale of the group affected by the infringement; • the severity of the infringement; • the culpability of the behaviour; and • whether the infringer has previously been found to have committed a breach of per - sonal data protection rules. Under the Act on the Sanctions for Administra - tive Violations, when imposing a fine, the NAIH must evaluate all relevant circumstances of the case, including but not limited to the criteria set forth in the Information Act. Specifically, the NAIH shall also consider the following factors in determining the amount of the fine: ability principle. Fine Calculation
• the harm caused by the infringement, includ - ing costs related to preventing, mitigating, or remedying the harm, as well as the benefits gained through the infringement; • the reversibility of the harm caused by the infringement; • the scale of the group affected by the infringement; • the duration of the infringing conduct; • the frequency and recurrence of the infringing behaviour; • the infringer’s co-operative conduct and assistance during the proceedings; and • the economic standing of the infringer. 1.4 Data Protection Fines in Practice • Incomplete Camera Warning Signs in Bank Lobby: In 2024, the NAIH fined a bank approximately EUR145,000 for deficiencies in the camera warning signs in the lobby of a branch office. The NAIH highlighted that camera warning signs must be detailed and placed at the entrance, with references to detailed privacy information, and that a sim - ple pictogram is insufficient. Detailed notices must not be placed where access is limited outside business hours and should also be available online. A single data subject’s com - plaint led to an investigation of the transpar - ency practices concerning all branches. The unlawful practice persisted for one-and-a-half years, which was considered an aggravating factor, but the bank’s prompt correction of the issue was treated as a mitigating circum - stance. A three-day delay in responding to the data subject’s request was noted but did not result in a fine. • AI Use: In 2022 the NAIH imposed a fine of approximately EUR650,000 on one of Hunga - ry’s largest banks for using emotion analysis software in customer care. This decision was later upheld by the court, reinforcing the
167 CHAMBERS.COM
Powered by FlippingBook