HUNGARY Trends and Developments Contributed by: Adam Liber and Tamás Bereczki, PROVARIS Varga & Partners
ing a customer satisfaction survey, where the survey invitation was included in delivery status update messages. The NAIH found the practice lawful and determined that the data process - ing was compatible with the performance of the contract, eliminating the need for a separate legal basis. The NAIH specified that the cus - tomer’s name and email address were lawfully processed for purposes necessary for contract performance and that the processing was not based on consent or EU/member state law, as these would preclude the application of the compatibility test under Article 6(4) of the GDPR. It emphasised the need to document the com - patibility test, including an analysis of the rela - tionship between the original and new purposes, the circumstances of data collection, whether special categories of data are involved, and the potential consequences of further processing. The NAIH concluded that the status updates and customer satisfaction survey were intrinsically linked to the service, its performance, and evalu - ation as part of the delivery service process and did not infringe on the privacy of data subjects, as the survey invitation was included in an email about the successful delivery, which recipients could choose to disregard. Adopting a business- friendly approach, the NAIH limited the scope of customer satisfaction measurement to contract- based grounds and noted that data subjects had no right to object to this type of data processing. Marketing Consent Validity Regarding consent validity, the NAIH stringently requires that consent be articulated clearly. For example, the NAIH does not accept vague con - sent terms that refer broadly to data process - ing goals such as “electronic communications”, which could imply various forms of digital com - munication that a data subject might not foresee or agree to. Furthermore, the NAIH has high - lighted the lack of an option for separate con -
sents for email messaging or data processing associated with targeted online advertisements by entities like Google and Facebook. The NAIH recognises these as distinct activities impact - ing data subjects’ privacy differently. However, the NAIH has not analysed in detail the trans - parency and data protection issues related to Google, Facebook, and similar mass automated advertising systems, as these are examined by other supervisory authorities within the EU. The absence of clear information about the use of such services, which are complex and challeng - ing to comprehend, may itself present signifi - cant issues regarding consent validity, as per the The NAIH follows a strict practice regard - ing transparency requirements, and regularly emphasises the need for clarity in privacy notic - es, insisting that they should not just list data processing purposes and legal bases, but also data retention and other relevant information in line with respective data processing activities in an easy-to-comprehend manner. This approach is in line with Articles 12(1) and 13(1) of the GDPR, which mandate clear and transparent communication about data processing activities. NAIH highlights that a detailed specification of the types of data processed, the legal provisions underpinning this processing, and the duration is crucial, especially for processing based on legal obligations. Furthermore, the NAIH criti - cises practices where there is a mix of service provision and legal obligation without clear dif - ferentiation, as this complicates the exercise of data subject rights. The NAIH also pointed out in its practice that optional website registration, purely for user convenience, does not constitute a necessary step for contract performance or pre-contractual measures under the GDPR and NAIH’s perspective. Transparency Issues
181 CHAMBERS.COM
Powered by FlippingBook