Magyar Éremkibocsátó Kft. – €73,500 Fine (Hungary, 2022)

The controller is a limited liability company in Hungary and also part of the Samlerhuset Group, an international group of companies based in Amsterdam. It sold different versions of commemorative and historical coins, with a specific focus on Hungarian history. The controller acquired the data of its customers as follows: they can place an order by filling in a form, received as part of advertising materials via postal mail. This data includes name, address, phone number, e-mail address. Since July 2020, the DPA received several complaints from data subjects concerning the processing of their data by the controller and objecting to its data processing practices. In most cases, the controller created a user account (profile) with the personal data provided during the purchase or ordering process. However, it only informed the data subjects afterwards about the processing. The DPA therefore carried out a test registration on the controller's website and analysed the privacy notices on the website and from the postal mail. Based on its findings, the DPA suspected an infringement of GDPR and launched an investigation. During the DPA’s investigation, the controller provided the following information on its data processing: potential new customers received a promotional mailing by post. In the controller's view, this did not constitute direct marketing under the Hungarian Act CXIX of 1995 on the processing of name and address data for research and direct marketing. The controller argued that the promotional material was sent to the data subjects together with a newspaper, to which they were subscribed pursuant to a contract with another separate company. Thus, the controller did not contact data subjects directly by itself. The data subjects could then contact the controller online, by phone or by post, in case they would like to order coins. In the online shopping process, the information on data processing is linked at the end of the order. The controller emphasized th