15
Tue, Oct
42 New Articles

The Court of Justice Clarified the Power of the National Data Protection Authority

The Court of Justice Clarified the Power of the National Data Protection Authority

Hungary
Tools
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Based on a Hungarian case, on 14 March 2024 the Court of Justice ruled that the supervisory authority of a Member State, to ensure that the GDPR is fully enforced, may order the erasure of unlawfully processed data even if prior request by the data subject has not been submitted. Such erasure may cover data collected from the affected person and data originating from another source.

The basis of the ruling is the decision of the municipality of Újpest (District IV of Budapest), which in 2020 decided to provide financial support to persons affected by COVID-19 pandemic. The municipality had asked the Hungarian State Treasury and the government office of District IV of Budapest to provide it with the personal data needed to verify the eligibility requirements for receiving the aid. The Hungarian data protection authority was informed of this practice and found that the authorities had jointly breached the rules of the GDPR and imposed related fines, as the Újpest municipality had failed to inform the data subjects, within one month provided for that purpose, of the actual use of their data, the purpose thereof and of their rights in relation to data protection. As a sanction, it also called the municipality to erase the data of eligible persons who had not applied for the support. The municipality then challenged that decision before the Budapest Regional Court. In its opinion, the national authority does not have the power to order the erasure of personal data in the absence of a prior request made to that effect by the data subject, as Article 17 of the GDPR explicitly defines the right of erasure as the right of the data subject.

Based on the above, the Hungarian court has suspended the procedure and asked for the interpretation of the GDPR from the Court of Justice, which stated that the data protection authority of a Member State, based on Article 58 of the GDPR, may take the necessary measures to fulfil its responsibility to ensure the enforcement of the GDPR. If the authority finds that the treatment of data does not comply with the GDPR, it must remedy the infringement, even without a prior request from the data subject, as if a related request would be required, it would mean that the controller, where no request is made, could continue to process them unlawfully. Based on the above, the authority may, even in the absence of a prior request made by the data subject, order the erasure of unlawfully processed data, regardless of whether those data originate directly from the data subject or another source.

As the Court of Justice does not decide the dispute itself, the procedure shall continue before the Hungarian court, with regard to the preliminary ruling.

By Borbala Maglai, Attorney at Law, KCG Partners Law Firm

KCG Partners at a Glance

KCG Partners is a Hungarian business law firm providing a comprehensive range of legal services to international and local clients seeking local knowledge and global perspective. The firm comprises business-minded lawyers with sector-specific expertise, creating value for clients by applying a problem-solving approach and delivering innovative solutions.

The firm has a wealth of knowledge in corporate law, M&A, projects and construction, energy, real estate, tax, employment, litigation, privacy and forensics, securitization, estate planning and capital markets.

To address clients’ regional and international concerns, the firm maintains active working relationships with other outstanding independent law firms in Central and Eastern Europe, whilst senior counsel Mr. Blaise Pásztory brings over 40 years’ of US capital market and fund management experience.

KCG Partners Law Firm is the result of the teamwork of passionate and talented lawyers guided by the same principles and sharing the same values: 

  • Our most valuable asset is our people. They are the engine of our business and the key to our success.
  • We push boundaries by looking for innovative solutions that can empower our clients to achieve greater results.
  • We place our experience, commitment and professionalism to your service.
  • We are driven by our vision to shape and lead the Hungarian legal market and become a first choice law firm in our practice areas.

Firm's website: http://www.kcgpartners.com