DPA case NAIH-1790-1/2023 – Complaint Upheld (Hungary, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A person asked a church for information about their personal data but received no response. This matters because it shows that organizations must reply to requests for information about personal data, or they may face complaints.
What happened
A person sent a letter to a church asking for details about their personal data but did not get a reply.
Who was affected
The individual who requested information about their personal data from the church.
What the authority found
The authority found that the church failed to respond to the person's request for information, which is required under GDPR.
Why this matters
This case highlights the importance of timely responses to personal data requests. Organizations should ensure they have processes in place to handle such inquiries to avoid complaints.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Applicant sent the 7th January 2022 a letter to the Controller, attaching the copy of an e-mail sent the 5th January, asking for information about the handling of his personal data. Although the Controller received the letter the 10th January according to the postal receipt, it did not respond to it. The Applicant complained and asked the Authority to start official proceedings against the Controller and also asked the Authority to levy a fine. Applicant asked information about the handling of his personal data, the documents related to his name, their registration data, the erasure of data, the date and reason of erasure as well as about transmission of his personal data to third persons. Additionally, he enquired about e-mails received to the official e-mail address of the priest serving at the Controller their attachments and about the e-mails forwarded to third persons. He also asked for a date for consultation and confession. According to the Controller, it did never collect or process any personal data of the Applicant. The Applicant went to the Church of the Controller and harassed one of the curates there. A private discussion was held between the Applicant and the vicar of the Controller about this. According to the Controller, the personal data related to this discussion are not subject to the GDPR. Controller declared that it processes in its e-mail box the name, assumed address, assumed phone number and assumed e-mail address of the Applicant, which are part of this complaint by the Applicant. The legal basis is the legitimate interest to respond to the complaint. According to the Controller, the purpose of the Applicant with his letter (incorrectly indicated as being dated the 7th January but dated the 5th January) only wanted to enter into contact with the Controller. The e-mail dated the 31st July 2022 submitted by the Controller to prove that was not written by the Applicant according to him, as it was not sent from his e-mail address and thus he
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case NAIH-1790-1/2023 in HU
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
6 April 2023
Authority
Nemzeti Adatvédelmi és Információszabadság Hatóság
GDPRhub ID
gdprhub-8531About this data
Cite as: Cookie Fines. DPA case NAIH-1790-1/2023 - Hungary (2023). Retrieved from cookiefines.eu
Last updated: