Magyar Éremkibocsátó Kft. – €73,500 Fine (Hungary, 2022)

The controller is a limited liability company in Hungary and also part of the Samlerhuset Group, an international group of companies based in Amsterdam. It sold different versions of commemorative and historical coins, with a specific focus on Hungarian history. The controller acquired the data of its customers as follows: they can place an order by filling in a form, received as part of advertising materials via postal mail. This data includes name, address, phone number, e-mail address. Since July 2020, the DPA received several complaints from data subjects concerning the processing of their data by the controller and objecting to its data processing practices. In most cases, the controller created a user account (profile) with the personal data provided during the purchase or ordering process. However, it only informed the data subjects afterwards about the processing. The DPA therefore carried out a test registration on the controller's website and analysed the privacy notices on the website and from the postal mail. Based on its findings, the DPA suspected an infringement of GDPR and launched an investigation. During the DPA’s investigation, the controller provided the following information on its data processing: potential new customers received a promotional mailing by post. In the controller's view, this did not constitute direct marketing under the Hungarian Act CXIX of 1995 on the processing of name and address data for research and direct marketing. The controller argued that the promotional material was sent to the data subjects together with a newspaper, to which they were subscribed pursuant to a contract with another separate company. Thus, the controller did not contact data subjects directly by itself. The data subjects could then contact the controller online, by phone or by post, in case they would like to order coins. In the online shopping process, the information on data processing is linked at the end of the order. The controller emphasized that the online registration did not involve the processing of any more personal data than a purchase without registration. It was also possible to order products by phone or by post, without registering an online account. The data subjects gave their consent by signing the order form in writing for postal orders, verbally for phone orders and by ticking a specific checkbox for online orders. The controller also informed the DPA that for the purpose of targeted advertising on Facebook and Google social media platforms, the controller manually selected – without automated decision-making – a group of its customers with an e-mail address for whom the given advertisement may be relevant. This list of addresses was hashed and uploaded to the Facebook and Google advertising systems for the display of the advertisement to data subjects whose email address hash matched an element of the uploaded hash list. The controller further stressed that it found data protection highly important, and it employed a dedicated data protection officer (DPO) as well. The DPA found that, on the form sent out by the controller, the information was provided in very small print, so barely legible. When requesting consent for direct marketing, only the identity of the controller was indicated, with a very general purpose to send “further favourable offers.” The information also stated that the processing was unlimited in time and scope, until consent would be withdrawn. The DPA noted that a more specific purpose limitation and other information as required under Article 13 GDPR, as well as the fact of data transfer abroad, were completely missing. The DPA stated that Article 13 GDPR only provides the bare minimum content. Additional, case-specific information would be necessary for transparency and informed choice. On the forms of the controller, the mandatory data were distinguished from the non-mandatory data with a tiny asterisk. Thus, the DPA found that the average data subject was not given clear and easily accessible information. It was not possible to indicate that you only wanted to provide your data to receive updates on an order, and not for direct marketing. Individual purposes and individual contact methods were not separated on the postal form. Over the phone – if the data subjects shared that they did not have an internet connection – a list of data processors was read out to them. In this case, it was not possible either to choose whether the data subject wished to consent to be contacted only by certain means, e.g. by post only, by phone only, by e-mail only, or by any combination of these. As in the case of postal communications, no information was provided about other forms of processing, such as Google and Facebook targeted advertising. For online orders, the data subject could easily access the privacy notice, which contained information on data processing related to direct marketing. However, the DPA found that it was not possible to give specific, separate consent for receiving emails and targeted advertising through Google and Facebook. The DPA noted that the absence of any meaningful information on the use of these complex services in itself raised a serious validity issue in relation to consent. With regard to the legal basis for consent, the DPA stressed that consent was not intended to be a general authorization for the controller to process any personal data without restriction, at any time and for any reason, irrespective of other legal conditions. It was only valid when requested for specific, separately identifiable purposes, and preceded by appropriate information that puts the data subject in a position to make an informed decision. Article 12(1) GDPR explicitly requires the controller to be result-oriented, i.e. to provide the data subject with the assistance necessary to enable him or her to exercise all his or her data subject rights in an informed manner. The DPA deemed it not the responsibility of the data subject to obtain the information from another source. It should be readily and reasonably available to them at the time of the request for consent. The DPA concluded a data subject would most likely not look online for information on data processing before placing an order by post or phone. This is also not expected by GDPR. The DPA held that the controller had an active obligation to provide the information to the data subject, appropriate for the communication channel used. The DPA further stated that there was currently no DPO under the name of the controller in the designated database operated by the DPA (accessible for everyone). The controller also did not prove otherwise that it had in fact appointed a DPO. DPA noted that, if there was a technical reason beyond the control of the controller for which the entry was not made, it could have been detected and corrected by the controller in the last 4 years since the introduction of the GDPR, if it really considers data protection to be of high importance. In short, the DPA found that the processing was explicitly for profit, using small print and without easily accessible information, implementing a poor business practice that was, and is problematic, even before the GDPR. The lack of adequate information put the data subjects in a position where they were not aware of their rights and how to exercise them. Therefore, the DPA fined the controller €73,500. The DPA further instructed the controller to modify its data processing practices in relation to direct marketing in order to properly separate specific purposes, obtaining the consent of data subjects, and providing them with adequate prior information appropriately. Also, to delete contact personal data where there was no valid consent.