TV2 Média Csoport Zrt. – €25,000 Fine (Hungary, 2023)

The TV2 Media Group Ltd., the controller, is one of Hungary's largest content providers. It operates several TV channels and online streaming services and has two websites tv2play.hu and tenyek.hu. "Tenyek.hu" contains predominantly news content, while "tv2play.hu" focuses on various audiovisual media content. In 2021, they had between 1.6 million and 2.4 million monthly visitors and a net revenue of 49,000,000,000 HUF (approx. €127,000,000). Based on a "public interest notification" the Hungarian DPA started an ex officio investigation into the data processing of the websites. There was a concern that the controller did not provide data subjects with adequate information about the processing and that the consent management platform (CMP) on the websites did not collect the consent of data subjects in a transparent and clear manner. The investigation revealed a number of potential data protection deficits. The CMP of the controller offered data subject's with the possibility to give consent to cookies by clicking an "OK, continue" button. However, the only alternative was a "more options" button which redirected to a second level of the CMP with more information and more detailed consent options. On this second level of the CMP, users were provided with two tabs for different categories of processing. On one tab, the user was able to give "consent" to different processing purposes. The other tab was titled "legitimate interest" and allowed the data subjects to object to data processing. Confusingly, the processes listed in both tabs was almost completely identical. They included purposes such as "selection of basic ads", "Measuring ad performance", and "creating a personalized advertising profile". The processing purposes ""storing and/or accessing information stored on the device"" was only listed under the consent tab. Regarding the meaning of "legitimate interest" the controller explained that, the way in which it is used on the website, the term would not relate to the legal basis under the GDPR but was meant as a "category". Consequently, the controller also had made no interest assessment. Lastly, it was unclear to the DPA how consent could be withdrawn, once it had been given. The DPA decided that the controller's conduct was in breach of the GDPR. First, the DPA concluded that the content provider is the controller, which is ultimately responsible for the processing of the personal data. The content provider used the websites to distribute its media content for its business interests. No other party had the right to decide whether the content provider should distribute its media content through the websites or whether it should cease to do so, and whether and through which service provider advertising should be displayed. The content provider operated the websites at its own discretion and in its commercial interest. For all the processing examined in relation to the websites, the content provider determined the purposes and means of the processing and enabled third parties to place content on the websites. The DPA therefore held that the content provider was the controller pursuant to Article 4(7) GDPR. Second, the DPA held that the controller violated the principle of fairness and transparency pursuant to Article 5(1)(a), Article 12(1), and Article 13 GDPR by not appropriately informing the data subjects about the legal basis of the processing. The DPA pointed out that Article 12(1) GDPR required controllers to take appropriate measures to provide data subjects with all the information referred to in Article 13 to 14 GDPR, in Article 15 GDPR to Article 22 GDPR, and in Article 34 GDPR. The information has to be provided in a concise, transparent, intelligible manner and an easily accessible form, in clear and plain language. Moreover, Article 13(1)(c) GDPR requires, among other things, that the controller informs its data subjects about the correct legal basis for their processing. However, in the present case, the controller indicated "consent" as a legal basis for browsing-related processing, irrespective of the fact that without certain technical cookies the websites cannot function. The purpose “To store and/or access information stored on the device” was only based on consent instead of legitimate interest. However, the DPA argued that without these cookies the websites would not be able to work. Consequently, the legal basis for consent is not appropriate, as a successful website visit of a data subject means that information on the data subject's terminal were written and read regardless of consent, and could not be opted out or withdrawn. In addition, the term “legitimate interest” used by the controller is equivalent to the term used in the GDPR under Article 6(1)(f). Therefore, since the controller explained that its "legitimate interest" would not refer to the "GDPR legitimate interest", it was either used incorrectly by the controller – and misleading – or used correctly, but without any information and without any consideration of the interests involved. Either way, the DPA considered it unfair and opaque contrary to Article 5(1)(a) GDPR to indicate substantially the same purposes on both the consent and the legitimate interest tabs. It gives data subjects the impression that the same processing is possible even if consent is not given. Moreover, the information on the second level of the CMP was provided in an exceptionally long text on data management and was only available in an unreasonably small area of the screen, readable only a few lines at a time. The long text cannot be described as concise or clear. As a result of the above, the DPA concluded that the controller violated the principle of fair and transparent processing pursuant to Article 5(1)(a), Article 12(1) GDPR and Article 13 GDPR. Third, the DPA held that the controller processed personal data without a legal basis as it neither fulfilled the conditions for Article 6(1)(a) GDPR "consent" nor Article 6(1)(f) "legitimate interest". The DPA decided that consent could not be used as a legal basis. It noted that it was not as easy to withdraw consent as it was to give it. The CMP did not provide an easily accessible possibility, neither for personal data directly processed by the controller nor for personal data transferred to third parties. There was no information provided on how to easily withdraw consent. Moreover, in addition, due to the opaqueness of the processing and the lack of clear information, as described above, consent, as a general rule, could not be considered to be a valid legal basis as it could not have been informed. Next, the controller could also not rely on legitimate interest for its processing. During the investigation, it became clear that the controller had not clearly indicated which processes were to be based on legitimate interest and which not. However, the DPA asserted that it is not the task and responsibility of the data subject, nor of the DPA, rather than that of the controller, to identify, describe and justify the specific purposes and legal grounds for the processing. Controllers are required to clearly justify, consider and provide safeguards for the purposes and legal basis on which they intend to process which personal data. These safeguards should ensure, among other things, that the data subject is aware of the processing and can object to it before the processing takes place. For the above reasons, the DPA concluded that the controller infringed Article 6(1) GDPR. In sum, the DPA found the controller to be in violation of the GDPR, specifically Article 5(1)(a) GDPR, Article 12(1) GDPR and Article 13 GDPR. It fined the controller 10,000,000 HUF (approx. €25,650). In determining the height of the fine, the DPA took into account some mitigating circumstances, namely, that the DPA had not previously found a data protection breach against the controller. Aggravating circumstances were that millions of data subjects were affected and that the processing was done for profiling purposes with commercial intent.