Nemzeti Adatvédelmi és Információszabadság Hatóság – CJEU Judgment (Hungary, 2023)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
The Court of Justice of the European Union ruled on a case involving a shareholder who wanted a full recording of a company meeting. The court clarified how GDPR articles apply when a person requests access to their data. This ruling helps clarify the rights of individuals to access their data under GDPR.
What happened
A shareholder requested a full meeting recording, but was only given parts involving their contributions.
Who was affected
A shareholder of a Hungarian public limited company who attended a general meeting.
What the authority found
The Court of Justice clarified that individuals have the right to access their personal data, including full recordings of meetings they participated in.
Why this matters
This ruling clarifies that companies must provide full access to personal data when requested, reinforcing individuals' rights under GDPR. Businesses should ensure they understand and comply with data access requests.
GDPR Articles Cited
On 26 April 2019, a shareholder of a Hungarian public limited company attended its general meeting. The meeting was recorded and the shareholder, as a data subject, asked the company, as the controller, to send him the recording. The controller only provided him with the excerpts which reproduced his contributions, excluding those of the other persons attending the general meeting. The data subject filed a complaint with the Hungarian DPA asking it to order the controller to provide the complete recording, which the DPA refused in its decision of 29 November 2019. After this, the data subject started two proceedings at the same time, one against the controller and one against the Hungarian DPA. The first proceeding was filed with the Budapest Regional Court based on Article 79(1) GDPR. In this proceeding, the data subject asked the Court to order the controller to provide him the entire recording. The Regional Court found that the controller had violated the data subject's right of access and upheld his request. This decision became final. The second proceeding was filed with the Budapest High Court pursuant to Article 78(1) GPDR. In this proceeding, the data subject asked the High Court to anull the DPA's decision. This Court would later ask the preliminary questions to the CJEU which resulted in this ruling. As the decision of the Regional Court had already become final, the High Court was faced with a problem when it had to decide the request for annulment of the DPA decision. This is because both procedures referred to the same facts, which could lead to contradictory decisions and, consequently, to legal uncertainty. According to the High Court, the DPA's independence would be compromised if it were bound by the decision of the Regional Court. In those circumstances, the High Court decided to stay the proceedings and to refer the following questions to the CJEU for a preliminary ruling: ‘(1) Must Articles 77(1) and 79(1) GDPR be interpreted as meaning that
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (0)
No other cases found for Nemzeti Adatvédelmi és Információszabadság Hatóság in HU
This is the only recorded case for this entity in this jurisdiction.
Details
Judgment Date
12 January 2023
Authority
Court of Justice of the European Union
GDPRhub ID
gdprhub-cjeu-5880About this data
Cite as: Cookie Fines. Nemzeti Adatvédelmi és Információszabadság Hatóság - Hungary (2023). Retrieved from cookiefines.eu
Last updated: