DPA case NAIH-5377-12/2023 – Dismissed (Hungary, 2023)

On 16 May 2023, the the Hungarian DPA (NAIH) received a complaint from a minor's legal guardian, which alleged that a bank (the controller) had processed the minor's (data subject) personal data unlawfully. The minor's legal guardian had applied for a 'baby loan' ('Babaváró' loan) with the bank. These loans are for the purpose of financing child-related costs. In order to process the loan application, the bank had requested a copy of the minor's identification documents, which included details such as the minor's residential address, gender, birth date and national identification number. To do so, the bank relied on Article 6(1)(b) GDPR (contract) as a legal ground for processing. In the complaint, the applicant argued that the processing was disproportionate and unnecessary for the purposes of their contract with the bank, which the minor was not party to. In response to the complaint, the NAIH contacted the bank for more information. The bank responded that Article 14(4) and Article 9(2)(c) of Decree 44/2019. (III. 12.), which regulates the conditions of a “Babaváró” loan, requires banks to process minor's identification documents. Moreover, in order to be able to demonstrate compliance under domestic banking regulations, banks are obliged to document the basis on which they have granted loans and store any relevant information in relation to this. The NAIH rejected the complaint. The NAIH held that Article 14(4) and Article 9(2)(c) of Decree 44/2019. (III. 12.), required banks to process the data referred to. Therefore the processing was legitimate as it was necessary for compliance with a legal obligation to which the controller was subject (Article 6(1)(c) GDPR). The NAIH acknowledged that the bank had wrongly indicated Article 6(1)(b) GDPR as a legal basis for processing. However, the NAIH held that the indication of an incorrect legal basis for processing under Article 6 GDPR, did not make the processing illegitimate.