University of Szeged – €5,000 Fine (Hungary, 2026)

The University of Szeged (SZTE, the controller) is a Hungarian private university. Under national law, the controller has the obligation to provide need based scholarships, including for student accommodation. During its dormitory admission procedure, the controller processed personal data of students. The legal basis was public interest (Article 6(1)(e) GDPR), and Article 9(2)(b) and (g) GDPR (legal obligation and public interest respectively) for special categories of personal data. This is because national law allowed the controller to provide dormitory accommodation on the basis of an application. Under national law, the controller could process a wide range of data related to data subjects, such as their address, medical and disability expenses, academic performance, or family background and living situation. The controller argued that not processing this data to take into consideration the data subject’s background would be a violation of national law. Furthermore, the processing of personal data ensured that the controller provided equal opportunities for data subjects with disabilities. Data subjects consented to the data processing by accepting the declaration on the data form, which could not be submitted without this consent. In terms of data minimisation, the controller claimed that it complied with Article 5(1)(c) GDPR by requesting data subjects to substantiate their individual circumstances with a single supporting document. It also accepted documents where unnecessary data was redacted. Finally, while documents were stored for five years, the controller revoked the reviewing committee’s access after the application process had ended (access was limited to dormitory data processors). The DPA began an ex-officio investigation in 2025. == The DPA first noted that the controller had the obligation to comply with provisions under the GDPR, even if the legislator does not include data protection obligations in its law allowing the processing under Article 6(1)(e) GDPR. This means it must not go beyond what is established in national law and the GDPR. This includes complying with Article 9 GDPR when processing special categories of personal data, as well as the principle of data minimisation (Article 5(1)(c) GDPR). In terms of personal data related to disabilities, the DPA stated that the controller processed data related to health beyond what was necessary under national law. The controller’s requirement of providing original copies of documents implied that the controller requested data subjects to provide complete medical certificates. Therefore, the controller accessed medical details of a purely private and sensitive nature, which put data subjects in a vulnerable position. The DPA stated that such a large scale processing could not be justified under Article 6(1)(e) GDPR, as national law did not require the controller to process complete medical documents. The controller did not have a legal basis under Article 9(2) GDPR, as it lacked a legal basis under Article 6(1) GDPR. This also applied to processing data related to medical expenses arising from the data subject’s medical condition (or that of a relative living in the same household). The DPA considered that the controller had processed excessive personal data of third persons related to the data subject applying for accommodation. According to the DPA, the controller required documentation to demonstrate aspects of the data subject’s living and family situation (e.g. complete housing contracts, divorce judgments, and court records). Overall, the DPA considered that the comprehensive background assessment of data subjects lacked a legal basis under Article 6(1) GDPR, and violated the principle of data minimisation (Article 5(1)(c) GDPR). == The DPA found a violation of the principle of transparency (Article 5(1)(a) GDPR) and the controller’s transparency obligations (Articles 13(1) and (2) GDPR). The DPA found that the controller required data subjects to check information from several different documents to determine which data processing activities they were subject to. In addition, the controller did not provide information in its College Regulations on data protection, but instead simply repeated the relevant provisions under national law. The DPA also found that the controller cited the wrong relevant law in its information, stating that the Dormitory Regulations were subject to the Information Act. Finally, the controller provided incorrect information regarding legal bases for processing; this meant that students were mislead into believing that they could consent (or not) to the processing (Article 6(1)(a) GDPR) when the processing was based on Article 6(1)(e) GDPR. This was a violation of Articles 13(1)(b)-(f) GDPR. The DPA fined the controller HUF 2,000,000 (approximately €5,286). In addition, the DPA ordered the controller to cease its data processing activities that violated the GDPR, erase the personal data stored in a non-compliant manner, and provide appropriate information.