Budapest Bar Association – Complaint Upheld (Hungary, 2022)

The data subject had been a member of the Budapest Bar Association (the controller) until 2011 when their membership was terminated after their failure to pay their membership fees in time. On 1 October 2020, the data subject requested information about their account balance and the decision on the termination of their membership. After they did not receive the information asked for, they sent another request to the controller on 12 December 2020, referring to Article 15(1) GDPR, and asking for information relating to their account balance, the amount of their debt, the legal basis of the registered debt and the existence of the suspension and termination decisions. On 4 February 2021, the data subject complained to the DPA that the controller did not provide them with access to this information which constituted their personal data. In its submission to the DPA, the controller claimed that the data subject’s communication from 1 October 2020 did not qualify as an access request within the meaning of the GDPR. Additionally, the request from 12 December 2020 was only received by the controller on 23 December 2020. Since the offices of the controller were closed between 19 December 2020 and 3 January 2021, the controller claimed that the time limit for complying with the access request only started running on 4 January 2021. The controller claimed that due to the complexity of the request, it was entitled to extending the deadline by additional two months as provided for in Article 12(3) GDPR. Hence, the controller considered itself to have properly provided access to the data subject within the time limit when it replied to the data subject’s request on 2 April 2021. The DPA held that the controller violated Article 15(1) and (3) and Article 12(3) GDPR. The DPA considered the communication sent by the data subject on 1 October 2020 to be too general to qualify as an access request. On the other hand, it regarded the communication sent on 12 December 2020 and received on 23 December 2020, which explicitly referred to the data subject‘s rights under the GDPR, as a proper access request from the data subject. The DPA further held that because the time limit set in Article 12 GDPR is calculated in calendar days and not in working days, the time limit for complying with the request started running on 24 December 2020 and not on 4 January 2021. Contrary to the controller’s assertions, the calculation of the time limit is not affected by the leave arrangements of the controller, as it is obliged to organise its work in such a way that it complies with the provisions of the GDPR. Consequently, the deadline for complying with the data subject's access request had already passed when the controller replied on 2 April 2021. In addition, although the controller claimed that the complexity of the request entitled it to extending the deadline for replying by further two months, the data subject was not informed of any such extension and the reasons for it as required under Article 12(3) GDPR. The controller was also unable to supply evidence of any internal decision made to actually extend the deadline. Lastly, whilst the controller could have possibly refused to comply with the access request for being too excessive under Article 12(5) GDPR, it did not invoke this ground in its letter to the data subject sent on 2 April 2021. Consequently, the DPA held that the controller violated Article 15(1) and (3) and Article 12(3) GDPR by not replying to the access request within the time limit and for not complying with the requirements relating to the extension of the deadline.