Dr. Hadházy Ákos Ányos – €2,823 Fine (Hungary, 2020)

The complainant objected to the controller processing their data in connection to the collection of signatures for the purpose of a petition supporting Hungary's accession to the European Public Prosecutor's Office. The data was initially connected for demonstrating support for the cause, and then was then used for other purposes. Was there a lawful basis for the processing under Article 6(1)? Did an exception to the prohibition of processing sensitive data under Article 9(2)? Were there any other GDPR violations incurred by the processing? The DPA held that there was no lawful basis, and in particular rejected the controller's contention that the processing was based on consent under Article 6(1)(a), given that the consent could not have been informed. Following on from this, the DPA held that the exception of explicit consent under Article 9(2)(a) also did not apply because the provision of requested data in a signature collection form, or an "acceptance" of Data Protection Information could not be considered a specific, unambiguous statement of the data subject's intention to process the data. Furthermore, the DPA also found that the controller violated the principle of data transparency under Article 5(1)(a), because of a lack of adequate information about the processing being provided to the data subject.