HUNGARY Trends and Developments Contributed by: Adam Liber and Tamás Bereczki, PROVARIS Varga & Partners
spondence. Accordingly, in response to a DSAR, the data controller does not need to provide information on facts and documents not related to the related data processing activity, includ - ing internal policy document copies, information on the company structure/organisation, internal procedures and copies of documents that can - not be entirely considered as the personal data of the data subject, such as email correspond - ence with technical details on the handling of a complaint. A data controller can lawfully reject a request for copies of internal documents and correspondence on the basis that such internal documents and correspondence do not contain the data subject’s personal data. In this case, there is no need for the controller to prove that the provision of a copy will not adversely affect the rights and freedoms of others. CCTV Use and Household Exemption The use of CCTV surveillance remained one of the enforcement priorities of the NAIH in 2024. The NAIH issued a decision addressing the legality of surveillance camera usage on private property. The investigation was initiated following neigh - bours’ complaints that the property owner’s security cameras were monitoring shared land and public areas. Upon inspection, the NAIH confirmed that the cameras’ fields of view did indeed capture these areas, and although digital masking was employed to obscure parts of the footage, some portions beyond the owner’s pri - vate property remained under surveillance. The NAIH emphasised that the GDPR does not apply to personal data processing conducted by a
natural person purely for personal or household activities, provided there is no connection to pro - fessional or commercial activities. This is com - monly referred to as household data processing, which falls outside the GDPR’s scope. However, the NAIH clarified that the use of surveillance systems qualifies as household data process - ing only if (i) the monitoring is confined to the boundaries of the private property, or (ii) excep - tionally and minimally extends to the immediate vicinity of the property when such coverage is essential for effective protection. The NAIH further stated that if surveillance extends beyond private property, it must be ensured through appropriate organisational and technical measures – such as digital mask - ing – that the monitoring does not cover public areas or property owned by others. Failure to implement such measures means the data pro - cessing falls under the GDPR’s scope of appli - cability, thereby establishing a need for a lawful basis for processing. In this particular case, the NAIH determined that the property owner’s sur - veillance practices were unlawful due to inad - equate masking, resulting in the monitoring of areas beyond their private property without a valid legal basis. This decision underscores the importance of ensuring that surveillance sys - tems on private property are configured to avoid capturing images beyond one’s own premises unless strictly necessary for security purposes, and even then, only with proper safeguards to protect the privacy of others.
183 CHAMBERS.COM
Powered by FlippingBook