Ide kerülhet az előadás címe

1. Ide kerülhet az előadás címe Enforcement of personal data protection in Hungary by Dr. Attila Péterfalvi "Business and Security" Research Center for Legal Informatics, Kiev Ide kerülhet az előadás címe

2. Trends in the enforcement, Hungary 1992: Data Protection Act 1993: Data Protection Commissioner – ombudsman Main tool: recommendation, report and publicity 2004: modification of the Data Protection Act due to the European Union membership of Hungary → authority-like decisions of the commissioner to order the correction, deletion of illegally processed personal data or prohibit the further control or transfer of data to third countries Data controller should challenge the decision at the court + burden of proof Very rarely used tool, e.g. publication of hunting – diaries of VIP persons (state secretaries) or attacking the broadcasting of a commercial television show „Wife Swap” or Frauentausch”) because of unetchically publishing minors’ personal data

3. Ombudsman-like approach Main tools: recommendation, report and publicity Informal investigation Authority-like approach Main tool:official enforcement Official public administration procedure on the bases of a prior assessment report If the unlawful data control concern a wide-scope of persons orconcern special data or significantly harm interests or endengers the risk of damages Constitutional changes, Hungary 2011: new Pivacy Act (Act on Informational Self-determination and Freedom of Information) 1st January 2012: National Authority for Data Protection and Freedom of Information

4. Decisions of the Authority • order the correction of unauthentic personal data; • order the blocking, deletion or destruction of illegally controlled personal data; • prohibit the illegal control or processing of the personal data;   • prohibit the transfer of the personal data to other countries; • order notification of the data subject, should the controller have unlawfully refused to, • impose a fine + and may also disclose the decision – with the ID data of the controller – should this be required in the interest of data protection or to protect the rights of a greater number of data subjects

5. Litigation Options for the Authority • Should the controller fail to respond to the warning issued the Authority may, due to the infringement of law regarding data of public interest and data public on grounds of public interest, request the court to oblige the controller to act in accordance with the warning notification issued within a period of 30 days following the expiry of the deadline period for providing information.   • The controller is obliged to prove that the data control corresponds to provisions governing relevant legislation.

6. Practical examples • Company stores files with personal data of ex-employees in a stall without door or custody (5 million HUF fine) • Internal group e-mail of a bank sent to 600 adressees without anonymising the addresses (800 000 HUF fine) • Group e-mail of a voluntary mutual insurance fund sent to 300 members without anonymising the addresses (2 million HUF fine)

7. Address: H-1125 Budapest, Szilágyi Erzsébet fasor 22/c. H-1530 Budapest, Pf. 5. Tel.: +36 391-1400 Fax: +36 391-1410 ugyfelszolgalat@naih.hu www.naih.hu