National Health Insurance Fund of Hungary – €1,200 Fine (Hungary, 2022)

On 25 March 2021, the data subject noticed that the National Health Insurance Fund Manager (NEAK) “published” information on its website that the data subject registered for the COVID-19 vaccine. By entering their social security number and date of birth, anyone who knew these pieces of personal information, could check the validity of a person’s registration. The data subject e-mailed the controller on the same day, objecting to the processing of his personal data on the website. On 6 April 2021, the data subject sent another e-mail to the controller, this time invoking their right of access under Article 15 GDPR. They also requested the controller to send the date and IP address from which the data subject requested the vaccination registration. As they did not receive any answer from the controller, the data subject turned to the DPA on 11 May 2021. The controller neither responded to the DPA's request for clarification, nor did it inform the DPA of the reason for the delay and when the data subject could expect a substantive response. Therefore, the DPA carried out an on-site visit at the premises of the controller on 24 November 2021. During the visit, the DPA found that the controller logged all the data requests in accordance with the requirements of its privacy policy and had the data subject’s request as well. The controller responded to the data subject only after the visit of the DPA, on 26 November 2021, and even then not in substance, saying: “As reasoning for the delay, we would like to mention that (...) NEAK has received nearly 70,000 requests for vaccine registration.” The controller also claimed to process and respond to thousands of inquiries per day, using the same number of human resources employees it had before the COVID-19 pandemic. The DPA found that the controller's reply did not contain any information on the right to lodge a complaint or to seek redress. Therefore, the DPA declared an infringement of Article 12(3) GDPR and Article 12(4) GDPR. Additionally, the DPA held that the controller, whether or not it considered the request under Article 15 GDPR, should have dealt with it within the time frame under Article 12 GDPR. As the controller mentioned that there were another unanswered requests, among the altogether 70,000 requests, the DPA requested the controller to provide evidence. However, the DPA did not receive the evidence promised to be sent until the present decision became final. Nevertheless, the DPA took into account – as a mitigating factor – that the COVID-19 pandemic required the establishment of data management processes on an unprecedented scale and at very short notice. The controller could not have previously assessed the resources needed to ensure the data subject's rights, but had to ensure them with unchanged human and budgetary resources. The DPA concluded that registration for vaccination does not automatically mean that someone actually takes the vaccine, therefore it did not constitute processing of special categories of personal data. The DPA interpreted that the displayed information on the status of registration in itself was not necessarily disproportionate to the risks to the rights and freedoms of natural persons. The protection measures applied in the identification process may be proportionate, and for these measures, the controller was responsible.