Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Hungary: NAIH fines Budapest Public Utilities HUF 16M for data security failures

The National Authority for Data Protection and Freedom of Information (NAIH) issued, on June 23, 2023, its decision in Case No. NAIH-6364-1/2023, in which it fined Budapest Public Utilities Ltd HUF 16 million (approx. $44,630), for violations of the General Data Protection Regulation (GDPR), following a public interest notification.

Background to the decision

The NAIH detailed that it had received a notification in the public interest which highlighted the fact that Budapest Public Utilities' legal predecessor had several documents on its website containing the personal data of customers. To this end, the NAIH noted that it wanted to confirm whether Budapest Public Utilities complied with Articles 33 and 34 of the GDPR in relation to the handling of a data protection incident due to the disclosure of personal data outlined above.

Findings of the NAIH

Following its investigation, the NAIH found that Budapest Public Utilities violated Articles 32(1), (2), and 33(3)(d) of the GDPR, as it did not apply technical and organizational measures in line with the state of art appropriate to the risks in connection with the anonymization of the minutes, which resulted in personal data contained in the minutes remaining available on the Internet.

Outcomes

In view of the above findings, the NAIH imposed a fine of HUF 16 million (approx. $44,630), for the abovementioned violations, taking into consideration aggravating and mitigating factors including that the data security deficiencies existed for a long time and that the illegal practice did not affect a large number of people.

You can download the decision, only available in Hungarian, here.