DPA case NAIH-1743/2021 – Complaint Upheld (Hungary, 2021)

A data subject submitted a complaint with the Hungarian DPA for the unlawful processing of their personal data and the personal data of their child, including special categories of data. The complaint was made regarding the recording and subsequent sharing of a private conversation between the defendant and the complainant, as well as an employee of a daycare attended by both of their respective children. The recording contained personal data, including sensitive information about the health of a minor. It was then shared by the controller within a Facebook group containing of all the parents whose children attend the daycare, as well as via e-mail with other parties. Upon questioning, the defendant admitted that they had no legal grounds for the collection or sharing of this data. The Hungarian DPA noted that both recording the conversation for purely personal use or sharing information about the meeting with other interested parents could have fallen under the household exemption of the GDPR under Article 2(2)(c). However, NAIH held that the sharing of such recording excluded the exemption and was also contrary to the principles of purpose limitation and data minimisation under Articles 5(1)(b) and 5(1)(c) GDPR. Moreover, the DPA held that the defendant had no legal ground for the processing of the data, including special categories of data, under Article 6(1) and Article 9 GDPR.Subsequently, NAIH decided to reprimand the controller under Article 58(2)(b) and impose a ban on any further processing under Article 58(2)(f). The DPA also ordered the controller to inform those with whom the data was shared to erase it without undue delay under Article 58(2)(g). However, NAIH did not find it necessary to impose an administrative fine under Article 83(2), taking into account that the controller is a natural person who had accepted that their conduct had been unlawful.