Enforcing jurisdiction
Hungary · Geography does not establish applicable law.
Confirmed applicable legislation

DPA case NAIH-3734-15/2023 – Complaint Upheld (Hungary, 2023)

Complaint Upheld
Nemzeti Adatvédelmi és Információszabadság Hatóság30 November 2023Hungary
final
Complaint Upheld

Privacy enforcement record

This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.

A Hungarian data protection authority found that a shop's surveillance cameras were not justified in covering public areas. This is significant because it shows that businesses must carefully consider privacy when using surveillance.

What happened

The shop's surveillance cameras were found to cover parts of a public area without proper justification.

Who was affected

People passing by the shop who were recorded by the surveillance cameras.

What the authority found

The authority acknowledged the shop's interest in preventing theft but ruled that it failed to justify the extent of its surveillance.

Why this matters

This case highlights the need for businesses to balance security measures with privacy rights. Companies should evaluate their surveillance practices to ensure they are necessary and proportionate.

Recorded legal citations
Automatically processed
Art. 6(1)(f) GDPR
Art. 58(2)(d) GDPR
View original scraped data
Art. 6(1)(f) GDPR
Art. 38(2) GDPR
Art. 58(2)(d) GDPR
Art. 83(GDPR)

Original imported citations before automated processing; the processing history does not establish independent verification.

Source checks

Secondary-source text retrieved.

Automated check recorded — 18 October 2026.

Processing notes: articles corrected.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

The Hungarian DPA received a complaint from a data subject regarding the presence of surveillance cameras outside the controller's shop ocovering a wide public area in front of its entrance. Due to the angle and distance of the cameras, the people recorded were not identifiable since the image of an adult person, for example, could only be recorded up to the waist. A warning sign of camera surveillance and an information sheet were present at the store's entrance, as well as on the gate next to the store's entrance and on the panel covering the front door when the store is closed. Following a request by the DPA on 8 March 2023, the controller made a minor modification to the camera's field of view by means of physical masking in such a way that it covered only a smaller portion of the public road. The controller further explained that the legal basis for the surveillance in question was its legitimate interest: to prevent and detect theft and vandalism. To corroborate this, the controller gave a few examples of incidents and explained that some burglars covered their faces when entering the shop, meaning that it was not sufficient to observe only the shop. The controller also presented an assessment weighing the interest of privacy against his legitimate interest in protecting his property. He explained that storage of the images was necessary to reconstruct what happened and discover who committed the infraction during an investigation. Considering the balancing assessment presented by the controller, the DPA acknowledged that the controller had a legitimate interest in installing the surveillance system. However, the DPA found relevant to consider whether it was necessary and proportionate for the surveillance system to also cover certain parts of public areas. In this respect, the DPA stated that the controller failed to justify why the camera surveillance could also cover areas not part of the property. Moreover, considering that surveilling the public area in

Outcome

Complaint Upheld

A data subject complaint that was upheld by the DPA.

Related Enforcement Actions (0)

No other enforcement actions found for DPA case NAIH-3734-15/2023 in HU

This is the only recorded action for this entity in this jurisdiction.

Details

Decision Date

30 November 2023

Authority

Nemzeti Adatvédelmi és Információszabadság Hatóság

GDPRhub ID

gdprhub-7442

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. DPA case NAIH-3734-15/2023 - Hungary (2023). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: