DPA case NAIH-3076-14/2024 – Violation Found (Hungary, 2024)

The data subject attempted to unsubscribe from a newsletter sent by a company. On September 29, 2019, the data subject submitted a request to unsubscribe through the controller’s website. The controller confirmed the removal of the email address from the mailing list on October 17, 2019. However, the data subject continued to receive newsletters on several occasions, specifically on October 26, October 29, and November 1, 2019. On December 16, 2020, the data subject lodged a complaint with the Romanian data protection authority, which subsequently referred the matter to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) in accordance with the GDPR’s cooperation mechanism. The NAIH commenced an investigation (case number: NAIH-1478/2021), during which the controller acknowledged a technical issue that prevented the unsubscribe requests from reaching the newsletter system. On February 1, 2024, following the conclusions of the earlier investigation, the NAIH initiated an authority procedure for data protection ex officio (case number: NAIH-3076/2024) to assess whether the controller had breached the GDPR. The NAIH found that the controller violated multiple provisions of the GDPR by failing to properly address the data subject’s unsubscribe requests. First, the NAIH held that the controller violated Article 6(1)(a) GDPR, as it continued processing the data subject’s email address for marketing purposes without a valid legal basis. The data subject had withdrawn consent by attempting to unsubscribe multiple times, but the controller still sent newsletters between 30 July 2019 and 11 May 2021. Second, the NAIH determined that the controller breached Article 12(3) GDPR by providing misleading information about the status of the data subject’s request. The controller confirmed the removal of the data subject’s email address on 17 October 2019, but in reality, due to a technical failure, the email remained in the newsletter system. Th