DPA case NAIH-6752-10/2023 – Complaint Upheld (Hungary, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Hungary's data protection authority upheld a complaint against a group that sent unsolicited messages without proper consent. This matters because it reinforces the need for clear communication about how personal information will be used. Organizations should ensure they provide adequate information to users to avoid similar complaints.
What happened
The authority found that a group sent unsolicited messages without giving proper information about data usage.
Who was affected
The data subject, who received unsolicited SMS and calls, was affected by the actions of the group.
What the authority found
The authority ruled that the group violated data protection rules by not informing users about the purpose of data collection.
Why this matters
This decision highlights the importance of transparency in data collection and communication. Organizations must clearly inform users about how their data will be used to avoid complaints.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
After joining the movement supporting the election of Karácsony Gergely as prime minister, a data subject complained to the Hungarian DPA that between 14 and 20 September 2021, they received unsolicited telephone inquiries via SMS and telephone calls from two phone numbers by LINK Mobility Kft. The DPA then contacted LINK Mobility Kft to request information. For further information regarding the SMS messages, the DPA was re-directed to Datadat Kft, which had tasked its subcontractor, Datadat GmbH, to send the messages. Datadat GmbH explained that it had sent the SMS messages on behalf of the association Ninety-Nine Movement (the Association). The DPA requested the Association to provide information on the matter but did not receive any reply. In the context of the processing under investigation, the DPA found that the Association, Datadat Kft and Datadat GmbH had decided together to send the SMS message to the data subject. Consequently, the DPA established the three to be joint controllers for the purposes of the data processing under examination under Article 26(1) GDPR. Next, the DPA acknowledged that the joint controllers claimed to be using consent as a legal basis pursuant to Article 6(1)(a) GDPR. From the information provided, it was understood that 36,000 data subjects' contact details were gathered by direct collection through the website ninenines.com, aimed to support the election of Karácsony Gergely. Specifically, on the website, under the "Join" option, data subjects could show their support by entering their full name, e-mail address, and telephone number, among other details. However, the DPA found that the joint controllers had infringed Article 5(1)(a) GDPR for not providing the data subjects with adequate information on the purposes of the processing. On the website in question, they had not clearly indicated that the data subjects' information would be used for further contact, nor explained the specific purposes to which the data subjects cons
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case NAIH-6752-10/2023 in HU
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
20 December 2023
Authority
Nemzeti Adatvédelmi és Információszabadság Hatóság
GDPRhub ID
gdprhub-7599About this data
Cite as: Cookie Fines. DPA case NAIH-6752-10/2023 - Hungary (2023). Retrieved from cookiefines.eu
Last updated: