Amplifon Magyarország Kft. – €200,000 Fine (Hungary, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Amplifon Magyarország was fined for sending marketing letters to people without their consent. The company used data from the Ministry of Interior, claiming it was allowed for marketing, but the DPA disagreed. This case emphasizes that silence cannot be considered consent and stresses the need for active user agreement.
What happened
Amplifon Magyarország sent marketing letters without obtaining explicit consent from recipients.
Who was affected
Individuals who received unsolicited letters inviting them to free hearing tests.
What the authority found
The Hungarian DPA found that Amplifon Magyarország lacked a valid legal basis for processing personal data for marketing purposes.
Why this matters
This ruling reinforces that companies must obtain explicit consent for marketing communications and cannot assume consent from inaction. It serves as a caution for businesses relying on third-party data for marketing.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
The DPA received a number of complaints from data subjects about Amplifon, a company selling hearing aids (the controller). The controller allegedly sent them a written letter via post inviting them to a free hearing test, despite the fact that they had not previously consented to receiving such marketing communication. The DPA therefore launched an ex officio investigation on 1 January 2020. The controller claimed that letter assessing the need for hearing tests were only sent to persons listed in the database provided by the Ministry of Interior. On average, the controller requested data every 2-3 months, with an average of 3-400.000 data subjects' names and addresses per request. All data were transferred to a separate, secure server by the controller's competent employees, and the entire contents of the device were irretrievably deleted after the transfer. The purpose of the data collection – stated by the controller in the request to the Ministry – was to contact and maintain contacts for direct marketing purposes and, in subsequent requests (after 23 February 2021), for market research. In the controller's view, Article 3(1)(d) of the Act CXIX of 1995 on the processing of name and address data for research and direct marketing allowed the collection of data from the sources specified in the legislation. Accordingly, the market researcher may request name and address data from the register of the Ministry of Interior for the purpose of contacting the data subject. Provided that the data subject had not refused the disclosure of his or her data. The controller stated that it used consent of the data subjects as the legal basis, arguing that the data subjects had the possibility to withdraw their consent at the Ministry of Interior or the controller if they do not wish their personal data to be processed. First, in the DPA's view, the silence of the data subject could not be accepted as an affirmative act. If the data subject did not take any active steps to g
Related Enforcement Actions (0)
No other enforcement actions found for Amplifon Magyarország Kft. in HU
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
11 August 2022
Authority
Nemzeti Adatvédelmi és Információszabadság Hatóság
Fine Amount
€200,000
GDPRhub ID
gdprhub-5391About this data
Cite as: Cookie Fines. Amplifon Magyarország Kft. - Hungary (2022). Retrieved from cookiefines.eu
Last updated: