Case number: NAIH/2020/1154/9
Antecedent: NAI H/2019/8402

Re: Decision part iallysustaining the complaint

The Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data
Protection and Freedom of Information, hereinafter: Authority) brings the following decisions in thedata protection procedure of the Authority launched upon the petition submitted by the […]complainants (hereinafter jointly referred to as: Complainants) through […] representing themagainst Mediarey Hungary Services Zártkörűen Működő Részvénytársaság (address: 1061
Budapest, Andrássy út 12, Trade Registry number: 01-10-140295; hereinafter: Obligee) concerning
unlawful processing of data in relation to the printed and electronic versions of Forbes Magazin(hereinafter: Forbes) published by the Obligee and inadequately guaranteeing the exercise of therights of the Complainants’ as data subjects:

I. The Authority
IN ITS DECISION
1. Partially sustains the petition of the Complainants
1.1. and establishes that the Obligee inadequately carried out the assessment of interests inrelation to the printed and on-line versions of the publication listing the largest family
undertakings published in September 2019 (Processing 1) and the printed and on-line
versions of the Forbes publication listing the 50 richest Hungarians published in January
2020 (Processing 2) and it failed to inform the Complainants in advance about its own
legitimate interests and those of a third party (the public) and the results of comparing
them with the interests of the Complainants infringed Article 6(1)(f) of the General Data
Protection Regulation.
1.2. Further, the Authority establishes that through failing to provide appropriate informationin relation to Processing 1 and Processing 2 to the Complainants about all the essential
circumstances of processing and of the Complainants’ right to object to the processing of
their personal data, and furthermore, it failed to provide information on the possibilities ofenforcing the rights of the Complainants in its answers to the Complainants’ requests
aimed at exercising their rights as data subjects, the Obligee infringed Article 5(1)(a),Article 5(2), Article 12(1) and (4), Article 14, Article 15 and Article 21(4) of the General
Data Protection Regulation.
1.3. The Authority condemns the Obligee on the grounds of unlawful data processing, and at
the same time instructs the Obligee
1.3.1

to fully meet its obligations to inform the Complainants in connection with dataprocessing, including the interests taken into account in the course of interest
assessments on the part of both the Obligee and the Complainants, the result of
the interest assessment, information on the right to object and information
concerning the possibilities of the enforcement of rights within 15 days from thedecision becoming final.

1.3.2

if the Obligee intends to use legitimate interest as the legal basis for envisaged
future data processing, it shall carry out interest assessment in accordance withthe legal regulations and the provisions of this decision, including a second
individual interest assessment following objection.

1.3.3

Obligee shall modify its practices related to providing information in advance inaccordance with the legal regulations in force and the provisions of this decision.

2

2. The Authority rejects the part of the petition, in which
2.1 the Complainants request the Authority to order the restriction of data processing, theerasure of the personal data of the Complainants and to ban the Obligee from processing
personal data;
2.2 the Complainants request the Authority to restrict data processing and prohibit thedisclosure of personal data by interim measure.
3. The Authority rejects the part of the petition on levying a data protection fine, but because of
the established infringements, the Authority levies
a data protection fine of
HUF 2,000,000, i.e. two million forints
ex officio on the Obligee.
Procedural costs did not arise in the course of the procedure of the Authority, hence the Authority did
not provide for who should bear them.
The data protection fine shall be paid to the targeted forint account for the collection of centralised
revenues of the Authority (10032000-01040425-00000000 Centralised collection account IBAN: HU83
1003 2000 0104 0425 0000 0000) within 15 days from the expiry of a period open for initiating a review
by the court, or if a review was initiated, following the decision of the court. Upon transfer of theamount, reference shall be made to the NAIH/2020/1154/9 BÍRS number.
If the Obligee fails to pay the fine when due, it shall pay a penalty for delay. The rate of the penalty fordelay is the legal interest rate corresponding to the central bank base rate quoted on the first day ofthe calendar half year affected by the delay.
The Obligee shall verify the performance of the obligations required under Section 1.3.1 of thedecision, submitting the substantiating evidence in writing to the Authority within 30 days from thecommunication of the decision.
The Obligee shall verify the measures it has taken in order to meet the obligations set forth in Section
1.3.3 of the decision in writing, submitting the substantiating evidence to the Authority within 30 days
from the communication of the decision.
In the event of failure to pay the fine and the penalty for delay and to meet the obligations set forth,the Authority shall launch the enforcement of the decision.
There is no legal remedy against this decision through the administrative route, but it can be attacked
in an administrative lawsuit with a petition addressed to the Fővárosi Törvényszék (Budapest
Tribunal) within 30 days from its communication. The petition is to be submitted to the Authority
electronically, which it shall forward to the court together with the documents of the case. The request
to hold a hearing must be indicated in the petition. For those who are not subject to full personal
exemption from levies, the levy on the review procedure by the court is HUF 30,000; the lawsuit issubject to the right of prenotation of duties. Legal representation is mandatory in a procedure in frontof the Budapest Tribunal.

II. With regard to the part of the petition aimed at the establishment of infringement concerning dataprocessing prior to 25 May 2018, the Authority terminates the data protection procedure

3

IN ITS WARRANT
because the General Data Protection Regulation is not applicable to this period.
There shall be no administrative legal remedy against this warrant, but it can be attacked in an
administrative lawsuit with a petition addressed to the Fővárosi Törvényszék (Budapest Tribunal)
within 30 days from its notification. The petition is to be submitted to the Authority electronically,
which shall forward it to the court together with the documents of the case. The petition must indicate
if there is a request for holding a hearing. For those who are not subject to full personal exemption
from levies, the levy for the court review procedure is HUF 30,000; the lawsuit is subject to the rightof prenotation of duties. Legal representation is mandatory in a procedure in front of the Budapest
Tribunal.

JUSTIFICATION

I. The facts of the case
I.1. The period studied in the course of the procedure
The Obligee included the “[…] family” in its compilation “Largest Hungarian family undertakings” forthe first time in the August 2015 issue of Forbes. After this, the […] owned by “[…] family” wasincluded in the compilation “Largest Hungarian family undertakings 2019” in the September 2019
issue. Then, […] was also included in the compilation “Richest Hungarians” in the January 2020
issue. As a result of […] the Obligee recalled the January 2020 issue of Forbes, showing the list of
the 50 richest Hungarians and in the on-line version of the lists related to Processing 1 andProcessing 2, it replaced the phrase […] and the […] name with the phrase […].
The Authority conducted this data protection procedure in relation to the data processing activitiesof the Obligee after 25 May 2018, in particular in relation to the processing of the Complainants’personal data (name, family name, assets) and inadequate ensuring of the exercise of the data
subject’s rights. Data processing prior to 25 May 2018 was carried out before the effective date ofRegulation (EU) 2016/679 on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter:
General Data Protection Regulation), hence the rules of the General Data Protection Regulation are
not applicable to them, a petition requesting data protection procedure from the Authority cannot be
submitted and the Authority has no competence to examine compliance with the provisions of theGeneral Data Protection Regulation with regard to such processing within the framework of this dataprotection procedure.

I.2. The data disclosed in relation to the Complainants in the publications studied in the course of
the procedure
The Complainants objected to data processing related to the following publications and lists:- Printed and on-line versions of the September 2019 issue of Forbes containing the largest
family undertakings (Processing 1). [The on-line version is accessible through the link
https://forbes.hu/extra/csaladi-lista-2019/#/ and the concrete entry is accessible here […] .]- The printed and on-line versions of the January 2020 issue of Forbes containing the 50
richest Hungarians, which was subsequently […] recalled (Processing 2). [The on-line
version is accessible through the link https://forbes.hu/extra/50-leggazdagabb-magyar-2019/
and the concrete entry is accessible here […] .]4In the case of Processing 1, the following content was displayed:-

The printed version showed the family name ([…] family) the name ([…]) of the undertaking
in which they held interests, the estimated value of the undertaking ([…]), the registered officeof the undertaking ([…]), the year of foundation of the undertaking ([…]) and the number ofgenerations with interests in the undertaking ([…]) . The entry contained the following
description:[…]-

Initially, the name of the family was shown in the on-line version; this, however, was removed
as a result of […] and was replaced by the phrase […]. In addition, the name of theundertaking, its estimated value, the year of foundation and the number of generations withinterests in the undertaking were shown. The on-line version has a shorter description, theentry contains no more than this:[…]-The full names of the Complainants were not displayed either in the printed or in the on-line
versions, and other family members were not named either. Neither the printed, nor the online version showed or shows the portraits of the Complainants.

In the case of Processing 2, the following content was published:-

In the printed version only […] was named of the Complainants, the publication contained
neither direct, nor indirect reference to any other member of the family. The publication
showed the amount of the estimated assets ([…].) of […], the source of the estimated assets([…]), as well as his age ([…]). The entry contained the following description:[…]-

The box entry describing the purpose of the MNB Growth Bond Programme was also
included in the printed version, which also contained the name of […], as well as the volumeof issue ([…]).

-

Initially, the on-line version also displayed the name of […]; this, however, was removed asa result of […] and was replaced by the phrase […]; in addition, the estimated value of theassets was also shown. The description in the on-line version was shorter and somewhat
different:[…]-

Neither the printed, nor the on-line versions showed or shows the portraits of theComplainants (including […]).

The data processed and published by the Obligee in relation to Processing 1 and Processing 2 are
not among the special categories of personal data according to Article 9 of the General Data
Protection Regulation (personal data revealing racial or ethnic origin, political opinions, religious orphilosophical beliefs or trade union membership, genetic and biometric data for the purpose of
uniquely identifying a natural person, data concerning health or data concerning a natural person’s
sex life or sexual orientation).
The publicly accessible data of the […] Trade Registry included that […] and […] held managerial
positions in the undertaking and that […] and […] were members (that is, owners) of the undertaking
at the time of the compilation and publication of the lists objected to. As a result of a change in thedata of the members (owners) of […] and in the persons of the members (owners) registered on the
day of […] were modified, and […] and […] were replaced by […] and […], this development is not
relevant to the case because the publications and lists were compiled on the basis of the data andinformation accessible at that time.
Over and above the data constituting part of the certified public Trade Registry and/or the data in thereports and the website of the undertaking in which the Complainants held interests accessible on
pages […] […] and […], the estimated value of […] in the case of Processing 1 and the estimated5

assets of […] (after the modification in the case of Processing 2: […]) originating from his activities
in the undertaking were indicated.
Although the (estimated) value of the business organisation held by the Complainants and the(estimated) amount of the assets of […] / […] are not part of the Trade Registry, they are not data
accessible on public interest grounds, at the same time, the publications do not present the amountof the personal assets (e.g. inherited, presented, obtained via marriage, etc.) of the Complainants to
the readers, but estimate the value of the undertaking or the amount of the assets collected as aresult of the business activities, concerning which the Obligee drew its conclusions from publicly
available company data, information, company reports and the communications of the company
itself. The Obligee collected these data from public sources for making the estimates, evaluatedthem on the basis of a specific method and published them as its opinion.

I.3. Correspondence between the Complainants and the Obligee
In relation to Processing 1 and Processing 2, correspondence between the Complainants and the
Obligee took place on several occasions. The Authority studied and evaluated this correspondence
detailed under Section III.4 of the decision in relation to the exercise of the rights of data subjects inthe context of the Obligee’s obligation to provide information in advance, the interest assessment
carried out by the Obligee and the compliance of the answers given to the requests of theComplainants aimed at the exercise of their rights as data subjects with the relevant provisions of
the General Data Protection Regulation.

I.4. The course of the procedure, the statements of the Complainants and of the Obligee made in
the course of the procedure
In their petition sent electronically on 6 December 2019 and by mail received by the Authority on 12
December 2019 and in the supplement to their petition sent electronically on 17 December 2019 andby mail received by the Authority on 19 December 2019 objected to Processing 1 and Processing 2
and in relation to them, to the inadequate ensuring of the exercise of the rights of the Complainants
as data subjects, thus the right to be informed in advance to access, to rectify and to object andinitiated a data protection procedure by the Authority against the Obligee.
The Complainants presented the following in the petition and in the supplement thereto:-

The Obligee collected data in 2016 for the first time, when it wished to include theComplainants in its publication summarising the largest family-owned companies based on
the data collected concerning the financial position of the Complainants. The Complainants
strongly objected to the processing of their data at that time, as a result of which Obligee
then refrained from the publication of the data.

-

The Complainants learned from an electronic mail sent by the Obligee on 26 August 2019that the Obligee wished to present “[…] family” in relation to […] in the case of Processing 1
by disclosing the financial position of […] on the basis of the public company data of thecompanies held by the family and the calculation methods of the Forbes editorial board.

-

It was also from the letter sent on 26 August 2019 by the Obligee that the Complainants
learned that “[…] was not included in the family company lists of Forbes in the preceding
years because in our view, based on the data of the given year and our estimates made onthat basis, they were not among the 25 largest companies.” The Complainants concluded
from this that the Obligee collected data about them even in the preceding years, but failed
to inform them in any way about this.

-According to the Complainants, the use of the term “[…] family” is misleading and untrue
and the use of this phrase in this context infringes the rights of those members of the […]6family who are not members of […] and also refers to underage children. Based on the dataof the trade registry, the owner of […] is not the “[…] family”, but […] and […], […] and […]are not owners, but only managing directors of the company, hence according to theComplainants a conclusion drawn from the profitability of […] with regard to the financial
circumstances of the managing directors is false.
-

On 30 August 2019, the Complainants submitted a request to the Obligee, in which theyobjected first and foremost to the processing of their personal data, and secondly, they
requested information concerning the processing of their personal data and also requested
that Obligee rectify the inaccurate personal data.

-

In its response to the request to exercise their rights as data subjects, the Obligee - according
to the Complainants - failed to give them all the information listed in Article 15 of the General
Data Protection Regulation, and did not provide any information concerning their rights
related to the processing of their personal data and about the legal remedy available against
such processing.

-

The Complainants also presented that in its response, the Obligee failed to indicate the legal
basis of processing their personal data, it did not indicate that it based the processing of thedata on its legitimate interests, and it failed to provide them with the results of the interest
assessment test. The Obligee indicated providing information to the public as the purpose ofdata processing; according to the Complainants, however, this purpose does not create
legitimate interest on the part of the Obligee on the basis of which it could lawfully process
personal data, and that the right of the Complainants to privacy enjoys priority vis-a-vis theeventual legitimate interest of the Obligee. The Complainants stated that they had paid
particular attention to the separation of their private and business lives and to the confidential
nature of their privacy, they do not make statements in the press and their eventual
statements were strictly focused on business aspects.

-

The Complainants presented that following the September 2019 publication of the issue
containing the largest family undertakings, persons identified as having criminal records
appeared around the family estate as confirmed by information provided by the Police. WhiletThe family used to be able to successfully defend its privacy; in their view, the Forbes list
published in September 2019 directed the attention of criminal circles to the Complainants.

-

In its electronic mail sent on 6 November 2019, the Obligee informed the Complainants that
it wished to include the Complainants as private individuals also in the case of Processing 2.

-

Similarly to the earlier correspondence, this letter also failed to include the mandatory
information required under Articles 13-14 of the General Data Protection Regulation, it did
not include the person(s) to be included in the list and the concrete data, nor any informationon the legal basis of disclosing personal data concerning the Complainants set by Forbes on
the basis of certain calculations, which concerned the financial positions of the Complainants
as private individuals. The file name of the excel table enclosed with the letter referred to“[…] family”, thus according to the Complainants, the Obligee was processing data
concerning the Complainants expressly as private individuals. According to theComplainants, the “[…] family” is inaccurate personal data, as it refers to every member ofthe family including children, while the ownership in […] is limited to […] and […].
Furthermore, according to the Complainants an undisclosed method of calculation was thebasis of the establishment of the data concerning their alleged financial position based on
the public company data of the company held by […] and […] and the proprietary calculation
methods of the Obligee. Concerning the calculation, the Obligee only disclosed an excel
table, which in contrast to the text of the letter sent on 6 November 2019 did not include apresentation of the method of calculation.

-

In the cease and desist letter sent by their attorney on 15 November 2019 to the Obligee, theComplainants strongly objected to the data processing carried out by the Obligee affecting
the Complainants on the basis of Article 21 of the General Data Protection Regulation andprohibited their access to any personal data concerning them, to collect their data or to carry

7

out any other data processing activity, including publication. They also prohibited theirpresentation in the issue directly or indirectly whether by name or by reference to the family
and they called upon the Obligee to immediately erase the personal data of the Complainants
and to refrain from any kind of data processing operation in relation to them. Based on Article
18(1)(a) and (d) of the General Data Protection Regulation, the Complainants also asked forthe restriction of processing and emphatically called upon the Obligee to refrain from thedisclosure of data concerning the Complainants until the clarification of the circumstances
specified under Article 18(1)(a) and (d) of the General Data Protection Regulation and as aresult of their objection also beyond it.
-

According to the Complainants, the Obligee in its response delivered on 20 November 2019,provided deficient information, thus, for instance, it failed to provide any information
concerning the rights of the Complainants in relation to the processing of their personal data
and about the legal remedy available to them against the processing of their data.
Furthermore, the Obligee indicated Article 6(1)(f) of the General Data Protection Regulation
as the legal basis of processing without providing any information on the results of the generalinterest assessment and the individual interest assessment, which is mandatory after
objection. According to the Complainants, the information failed to meet Article 13(2)(f) and
Article 14(2)(g) of the General Data Protection Regulation as the Complainants have noknowledge of the logic used to analyse their personal data, or the significance and expectedconsequences of processing with respect to the Complainants. The information fails toaccurately specify the duration of processing; furthermore, the Obligee failed to meet theComplainants’ request aimed at the exercise of their right as data subjects under the General
Data Protection Regulation, and it failed to restrict processing in view of the fact that
according to the notification by the Complainants, the data were not true and failed to meet
its erasure obligation.

Over and above this, the Complainants made the following (supplementary) remarks about the dataprocessing carried out by the Obligee with regard to the legal background:-Paragraph [62] of the justification of the Constitutional Court Decision 7/2014. (III. 7.) of thedata protection commissioner stipulates that ”persons exercising public powers andpoliticians who are public actors also have a right to the protection of personality, if the value
judgment affects their persons not in relation to disputes about public affairs, or their public
activities, but their private or family life.” Information not related to disputes about publicaffairs, but related to private or family life qualify as protected also in the case of public actors,
thus the disclosure of such information constitutes a severe violation of privacy according to
the Complainants.

-

According to the Complainants, the satisfaction of the curiosity of society is insufficient basis
for privacy intervention, even if it concerns a person participating in social decision-making(BDT2017.3693). According to the Complainants, this protection prevails in particular withregard to persons who cannot be regarded as public actors as their activities are not public,
such as in the case of the Complainants.

-

With regard to the legal assessment of data processing by the press, the Complainants
underlined that the position set forth in earlier decisions by the data protection commissioner,
namely that “legal practice also indicates that newspapers give priority to increasing thenumber of copies sold, improving their position in market competition and as against this,they insufficiently take the obligation to protect personal data into account” continues to hold.

-

The Complainants also refer to opinion WP 217 of the Article 29 Working Party, consistingof the representatives of the data protection authorities of the European Union, according towhich “the media must not be granted general authorisation to publish any detail on theprivate lives of public actors, which is not part of the subject matter”.

-

According to the Complainants, the legal practice of earlier years has been unambiguous inestablishing that being included in lists such as “The 100 richest Hungarians” and other8

similar lists, in spite of the objection of the data subject, constituted an infringement (cf.
Resolution ABI 1472/A/2003 in relation to a similar list published by Magyar Hírlap or ABI
922/A/2000 in relation to a Playboy’s list). According to the earlier resolutions of the dataprotection commissioner “with regard to people who are not public actors, only rich people, I
do not regard this procedure as lawful, as their names were published in this context without
their consent. In my view, the fact that somebody is wealthy in itself does not mean that heis also a public actor. The right of self-determination of the data subject must be guaranteedwith respect to the personal data published in the list, in the absence of a consent personal
data may not be published.” Although the resolutions referred to were made prior to the entry
into force of the General Data Protection Regulation, according to the Complainants, they
continue to be governing to this day even though with some differences.
-

The Complainants referred to the resolution of the Authority concerning the databaseconsisting of photos unlawfully made public in the entry entitled “A nagy köcsög adatbázis 2”
accessible on the website www.deres.tv, according to which the database was suitable for anegative representation of the data subjects, making them targets.

-

The Complainants also referred to Resolution NAIH/2018/2618/6/V of the Authority
concerning the Soros listing of Figyelő-lap, in which the Authority stated that ” the purpose of
the listing was a kind of negative social evaluation of the data subjects with regard to persons
who do not qualify as public actors, do not participate in public life and they have no intention
to influence public opinion through their activities.”-

With respect to Article 85(3) of the General Data Protection Regulation, Hungary has notified
the following relevant legal regulations: Section 2:44 of Act V of 2013 on the Civil Code(hereinafter: Civil Code) (in relation to the free discussion of public affairs); Section 4(3)(principles) and Section 6 (protection of sources) of Act CIV of 2010 on the Freedom of thePress and the Fundamental Rules of Media Content (hereinafter: Press Freedom Act).
According to the Complainants, the Obligee could at best refer to the above legal regulations
to lay the grounds for legitimate interest according to Article 6(1)(f) of the General Data
Protection Regulation in the context of the freedom of the press, otherwise data processing
is directly governed by the provisions of the General Data Protection Regulation.

-

According to the Complainants, the basis of the infringement is the principle, according towhich well-grounded or presumed statements concerning the financial circumstances of aperson - irrespective of the magnitude of the assets - are statements within the narrowest
circle of a given person and constitute parts of the private sphere due to the person, and they
have a direct impact, inter alia, on the evaluation of the given person, his acceptance and insome cases, his safety.

-

To safeguard and maintain the safety of the entire family, including its minor members, theComplainants handled their financial position strictly in confidence. They did not hide thesuccess of […], but they never made any statement concerning its details or the magnitudeof the assets due to individuals. Any true or false information published in the press may havea direct or indirect effect on the quality of life of the Complainants and other members of thefamily, because of the various safety measures and the employment of staff. According to
the Complainants, safeguarding the life and safety of minor children can only be implemented
in a manner that is detrimental to the spiritual development of the children, future implications
are unforeseeable and even a single appearance in the press may result in an irreversible
sense of dread in the members of the “[…] family”, irrespective of whether or not their life,
health or assets are endangered by a minor or major direct or indirect threat.

-

According to the Complainants, the purpose indicated by the Obligee (informing the public,
exercising the right to the freedom of the press) is not a true purpose, because the financial
position presented paints a false picture of the natural persons behind the “[…] family”
suggesting that the entire “[…] family” is wealthy. According to the Complainants, thepresentation of the financial position of certain private individuals (i.e. not public actors), the9processing of their personal data cannot be a lawful purpose, because they fail to inform thepublic properly through this.
-According to the Complainants, if the Obligee wishes to achieve the purpose of informing the
public, it would have to obtain the consent of every single private individual concerned,
otherwise, the disclosure of the assets by name, company name and calculated with a uniquemethod constitutes unlawful data processing. According to the Complainants, the purpose ofprocessing does not correspond to the purpose, for which the Trade Registry and the e-report
processes the personal data of the Complainants, consequently, the processing of thepersonal data of the “[…] family” affecting a larger circle of persons by the Obligee is not tied
to a purpose, hence it is unlawful.

-

A condition for recourse to Article 6(1)(f) of the General Data Protection Regulation (withrespect to both Processing 1 and Processing 2) is that the Obligee as controller should carryout an interest assessment test and inform the data subjects of its results. The controller has
to demonstrate through the interest assessment test that the processing of the data is anecessary and proportionate intervention in the privacy of the data subject for theenforcement of its legitimate interests. The Obligee failed to make an interest assessment
test available to the Complainants.

-

The Complainants’ position holds with regard to both Processing 1 and Processing 2 when
information based on speculation containing untrue data cannot be suitable for informing the
public accurately, and data processing also extends to persons with regard to whom there isno interest linked to publicity. The publication of information concerning the outstanding
financial position of the Complainants, whether true or not, has a substantial impact on theevaluation of the data subjects, their relationships, acceptance and even personal safety,
moreover there are minor children in the “[…] family” whose particular protection is required
by Article 6(1)(f) of the General Data Protection Regulation referred to by the Obligee.

-

According to the Complainants, even if some of the data originates in public databases, thisdoes not create a legal basis for the processing of the conclusions drawn from this as
personal data. The Obligee did not provide any additional information concerning this.
According to the Complainants, the processing of data concerning their financial position
cannot in any way be deducted from company transparency, from the category of data
accessible to the public on the grounds of public interest, because an individual may haveproperty other than holdings in a company, as well as debts.

-

According to the Complainants, Obligee published such data concerning “[…] relationship”
and “[…] generation”, which data could not stem from any public registry.

-

According to the Complainants, only Article 6(1)(a) of the General Data Protection Regulation
could provide a legal basis for data processing with regard to Processing 2, but theComplainants never made a statement consenting to the processing of their personal data.

-

In its response, the Obligee indicated the use of state subsidies or subsidies from other publicfunds granted to […], their role in its success, thereby informing the public and in a wider
sense, the exercise of the right to the freedom of the press, as the purpose of dataprocessing. In relation to this, the Complainants refer to warrant number NAIH/4454/6/2012/Vof the Authority [brought prior to the General Data Protection Regulation becoming
applicable], which states that public company data including the personal data of theshareholders and senior officials cannot be used for purposes other than that specified by
the act providing a legal basis for this (currently, this is Act V of 2006 on Company
Transparency, the Trade Court Procedure and Final Settlement; hereinafter: Company
Transparency Act). According to the preamble of the Company Transparency Act, these data
can be used exclusively in the interest of the constitutional rights of entrepreneurs for the
purposes of the safety of economic transactions and the protection of creditor’s interests orother public interests. According to the Complainants, the purposes indicated by the Obligee
cannot be reconciled with these purposes and the purpose specified by the Obligee cannot
provide a legal basis indicated as its legitimate interest for violating the rights of the10Complainants, restricting their privacy and these data in the Trade Registry can absolutely
not be used to draw conclusions concerning the financial position of persons who are notshareholders in the company concerned.
-

The Complainants notified the Obligee that estimates based on speculation do not give a true
result and the data processed do not meet the principle of accuracy. In view of this, according
to the Complainants, the Obligee would have been under the obligation of immediately
erasing the untrue data processed by it based on Article 17(1)(c) of the General Data
Protection Regulation, or at least it would have had to take all reasonable measures in orderto immediately erase or rectify the personal data, which were inaccurate from the viewpointof the purposes of processing the data based on Article 5(1)(d) of the General Data Protection
Regulation. The Complainants strongly demanded the erasure of the data based on theirobjection; however, the Obligee indicated in its response a willingness to rectify the personal
data only with respect to the name.

-

The Complainants refer to the decision of the Constitutional Court No. IV/1235/2019 rejecting
a constitutional complaint, in which the Constitutional Court declared that “the freedom toexpress an opinion provides no protection against statements of facts, whose veracity cannot
be verified”.

-

Primarily, Article 14 of the General Data Protection Regulation specifies the obligation of the
Obligee as controller to provide information, because the personal data were not collectedfrom the Complainants. According to the Complainants, Obligee evidently and repeatedly
failed to meet this obligation to provide information and it failed to supply the appropriate
information. Furthermore, Obligee failed to inform the Complainants of the results of theindividual interest assessment, which is mandatory following the objection of theComplainants, which also constitutes an infringement of the obligation to supply information.

-

Based on Article 18(1)(a) and (d) of the General Data Protection Regulation, theComplainants requested the Obligee to restrict the processing of their data in the context ofdisputing the accuracy of the personal data and the objection to processing. According to theComplainants, the Obligee should have restricted the processing of the data affected by thedemand for restriction because none of the reasons for continuing the processing aresupported by Article 18(2) of the General Data Protection Regulation.

-

According to the Complainants, they cannot be regarded as public actors, their activities do
not belong to the sphere of being in the public sphere, thus pursuant to Article 21 of theGeneral Data Protection Regulation they rightfully objected to the processing. The
Complainants made use of their right to object with regard to both Processing 1 andProcessing 2. According to the Complainants, the Obligee failed to prove its legitimate
interest of compelling force that would enjoy priority vis-a-vis the rights and freedoms of theComplainants and furthermore, it failed to provide an interest assessment test to theComplainants, which is mandatory following an objection. According to the Complainants,
there are no legitimate interest of compelling force on the part of the Obligee, because the
Obligee only processes the personal data in order to create a large audience for the website
and to increase the sales figures of Forbes. According to the Complainants, these cases arein no respect subject to the exemption established by Article 21(1) of the General Data
Protection Regulation.

-

According to the Complainants, this case is very similar to Judgment C-131/12 Google Spain
SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja
González adjudged by the Court of Justice of the European Union (hereinafter: CJEU) undera preliminary ruling procedure, in which CJEU declared that the public has a substantial
interest in making the data accessible, if that is verified by the role of the data subject in publiclife. According to the Complainants, no such circumstance prevailed in the current casesimilarly to the case referred to, and in spite of the fact that the disclosure of the data in otherplaces was lawful, the processing by the Obligee was unlawful because of the expressed
objection.

11-

Of the Complainants, […] buildings the export markets, […] is present in more than […]countries. Their partner […] was kidnapped three times, his wife once. According to theComplainants, appearance in such lists puts the family and the members of the family on themap even internationally, search engines preposition these lists, whereby there is a higher
probability that a member of the family may fall victim even to foreign perpetrators.

-

According to the Complainants, Processing 1 directed the attention of criminal circles to theComplainants. To substantiate this, the Complainants sent the correspondence to the
Authority in which the security director of […] indicates the introduction of changes in the
personal protection tasks affecting the […] family and provides information on the related
measures.

In view of the above, the Complainants initiated the conduct of a data protection procedure by the
Authority with regard to both Processing 1 and Processing 2 and requested the Authority to establish
the fact of unlawful data processing because of infringements of Article 5(1)(a), (b), (d) and (e),Article 6(1)(f), Article 13(2)(f) and Article 14(2)(g), Article 14(1) and (2), Article 15(1)(h), and Article
21(1); to order the restriction of personal data on the basis of Article 18(1)(a) and (d) and then theerasure of personal data according to Article 17(1)(c) and to prohibit the Obligee to process personal
data based on Article 58(2)(f).
The Complainants requested the Authority to apply the fine according to Article 83(4) of the General
Data Protection Regulation against the Obligee based on Article 61(1)(a) of the Privacy Act.
The Complainants also requested the Authority to restrict data processing and prohibit the
publication of personal data by an interim measure in accordance with the provisions of Section 106
of Act CL of 2016 on General Public Administrative Procedures (hereinafter: Administrative
Procedures Act), in view of the fact that in its absence the Complainants and their children of minor
age (who are also data subjects, although they are not Complainants in this procedure) would sustain
inevitable damage and threat and inevitable infringement of personality rights if Processing 2 was toappear.
Based on the complaint, the data protection procedure by the Authority was launched pursuant to
Article 57(1)(f) of the General Data Protection Regulation and Section 60 (1) of the Privacy Act.
After the procedure was launched, the Complainants informed the Authority in an e-mail dated 24
January 2020, which was also sent by e-mail on 27 January 2020, and received by the Authority on
28 January 2020, that in parallel with the procedure in progress based on their petition submitted to
the Authority for a data protection procedure, a civil procedure was also taking place, in the courseof which […] in the first instance ordered the Obligee in its warrant made in the subject matter of aninterim measure- to indicate the personal data processed in relation to the Complainants,- to process the personal data processed in relation to the Complainants only in the event ofobtaining the express written consent of the Complainants,- to refrain from the disclosure of the personal data processed in relation to the Complainants.
The Complainants furthermore informed the Authority that the Obligee failed to meet its above
obligations and published the personal data of the Complainants both on-line and in its paper
publication, and has included the Complainants in the list of the richest Hungarians (Processing 2).
On […] […] established the preliminary enforceability of the warrant on the basis of which theprovisions of the warrant of the first instance can be enforced independently of the procedure in thesecond instance.

12

The Complainants sent the abstract of warrant No. […] to the Authority made in the subject matterof an interim measure by […] and the warrant No. […] establishing the preliminary enforceability of
the interim measure.
In its warrant No. NAIH/2020/1154/2 dated 28 January 2020, the Authority notified the Obligee about
launching its data protection procedure, and with reference to Section 63 of the Administrative
Procedures Act called upon it to make a statement with a view to clarifying the facts of the case.
Based on the acknowledgement of receipt returned to the Authority, the warrant was received on 3
February 2020.
On […] Forbes issued a communique in its own website […]. The communique contained, inter alia,
the following:[…]
The entire communique is accessible at URL […].
In its letter dated 6 February 2020, received by the Authority on 12 February 2020, the Obligee
informed the Authority as follows:-

The members of the […] family initiated a civil lawsuit against the Obligee. The antecedentof the civil lawsuit was that the Complainants submitted a petition for an interim measure.
[…] brought a warrant under No. […] in the subject matter of the interim measure, which wasapproved by […] with its warrant No. […]. A precondition of the petition for the interim
measure is that the Complainants submit a petition for the adjudgment of the alleged
infringement in merit within 30 days. […] ordered the preliminary implementation of theinterim measure subject to the submission of the petition. According to the knowledge of thelegal representative of the Obligee, the petition was submitted and its study under procedural
law is in progress.

-

In view of the fact that there is a procedure in front of the court in progress in relation to thesubject matter of the Authority’s warrant, according to the Obligee, the complaint which
serves as the basis for the Authority’s warrant cannot be examined under Section 53(3((a) of
Act CXII of 2011 (hereinafter: Privacy Act). [Privacy Act Section 53(3)(a): The Authority shalldismiss the notification without examining it on its merits, if court proceedings are in progress,
or a final and binding court decision has previously been rendered in the given case.]

The Authority disagreed with the position of the Obligee as Section 53 of the Privacy Act is applicable
only to procedures not subject to the Administrative Procedures Act, i.e. procedures that do not
qualify as procedures of an administrative authority. In view of all this, in its warrant No.
NAIH/2020/1154/4 dated 13 February 2020, the Authority again called upon the Obligee to make astatement. Based on the acknowledgement of receipt returned to the Authority, the warrant wasreceived on 19 February 2020.
In its e-mail dated 27 February 2020, but sent on 26 February 2020, the Obligee provided therequested information through its legal representative ([…]) verified by a power of attorney and sent
the documents substantiating the statements to the Authority.
In its response to the Authority, the Obligee stated the following:-Through their legal representative, the Complainants submitted a petition for an interim
measure prior to initiating litigation. […] sustained the interim measure in its warrant with theprovision that the Complainants may submit a petition requesting […] to examine the meritsof the case within 30 days. Until sending the response to the Authority, the petition was notdelivered to the Obligee, it only received a warrant in which […] notified the Obligee of therejection of the petition […] warrant No [….]).

13-

According to the Obligee, the data protection procedure by the Authority should besuspended because of the court procedure in progress between the Complainants and the
Obligee in relation to the processing of the Complainants’ personal data. The Obligee argued
for its position as follows: under Section 48(1)(a) of the Administrative Procedures Act, theAuthority shall suspend the procedure, if decision on the preliminary issue is within thecompetence of the court. In view of the fact that as a result of the warrant ordering the interim
measure, there is a civil litigation as well as a non-litigious proceeding in progress concerning
the data processing constituting the basis of the Authority’s procedure and there is apossibility that a rejection according to Section 46(1)(b) of the Administrative Procedures Act
will be called for, or the examination of a fully identical legal issue in terms of content may
prejudice the procedure of the tribunal because if the Authority continues its data protection
procedure, a situation may arise that two courts bring decisions on a single legal issue (theprocessing of the personal data of the Complainants by the Obligee) as there is a procedure
in progress under Act CXXX of 2016 on Civil Procedures (hereinafter: Civil Procedures Act)and the clients may request the review of the Authority’s decision by the court. This is afunction of the court procedure: either it examines the petition in its merits, or it does not bringa final decision from some reason, and the Complainants lose the possibility of enforcing
their rights according to the Civil Procedures Act. This is a preliminary issue, which will bedecided in the course of the court procedure in progress. In view of all this, the Obligee
requested the Authority to suspend its data protection procedure.

-

The Forbes magazine is primarily a business magazine, which informs its readers about
Hungarian companies, their shareholders, their business activities, their development
projects, their impact on the market economy and their eventual relationships with the state,
among other things. The Complainants are owners of […] ([…] and […]), and its senior
officials ([…] and […]).

-For the first time, Forbes presented the “[…] family” in its compilation of “Largest Hungarianfamily undertakings” in August 2015 (not in 2016 as stated by the Complainants). After this,[…] owned by the “[…] family” was included in the compilation of “Largest Hungarian family
undertakings 2019” (Processing 1) in the September 2019 issue. In addition, […] are included
in entry […] of the compilation “Richest Hungarians” published in January 2020 (Processing
2).

-

The compilations are made by Forbes journalists on the basis of publicly accessible company
data. They always send the calculations made on the basis of the public data to the company
or person concerned, providing the opportunity to rectify the calculations or to make otherremarks. The employees of the Obligee proactively took up contact with the Complainants
and provided them with information in advance.

-

The information available at URL […] indicate that […] regularly benefited from large amountsof state and EU support amounting to several billion forints over the past few years.

-

The processing of personal data cannot be separated from the content published in theForbes compilations; hence it cannot be separately evaluated legally either. The Forbes
compilation presented information related to the company: what state subsidies theyreceived, what marketing activities they conduct and what development projects they
implement.

-

According to the Obligee, the phrase “[…] family” cannot be regarded as personal dataaccording to Article 4(1) of the General Data Protection Regulation.

-

Hungary’s Fundamental equally recognizes the right to the protection of personal data andthe accessibility of data in the public interest [Article VI(3)], the freedom of the press and thediversity of the press [Article IX(2)] and it declares that Hungary’s economy is based on thefreedom of enterprise [Article M(1)].

-

According to Article 39(2) of the Fundamental Law, every organisation managing public funds
shall account for its management of public funds in front of the public. Public funds must be14

managed according to the principles of transparency and the purity of public life, and data
concerning public funds and national assets are data in the public interest.
-

Article 85(1) of the General Data Protection Regulation also shows that Member Statesreconcile the right to express an opinion and to be informed with data protection. Section 2of the opinion [WP 227] of the Article 29 Working Party of the European Data Protection
Commissioners published on 26 November 2014 formulates the requirement of interest
assessment, according to which data protection rights must be interpreted (also) with regard
to the right to express an opinion. Paragraph 93 of the judgment of the Court of Justice of theEuropean Union brought in the case of Tele2Sverige AB [C-203/2015.] promulgated on 21
December 2016 contains the following: “Accordingly, the importance both of the right toprivacy guaranteed in Article 7 of the Charter and of the right to protection of personal data
guaranteed in Article 8 of the Charter as derived from the court’s case law (see to that effect:
judgment of 6 October 2015, Schrems, C-362/14, EU:C:2015:650, paragraph 39 and thecase law cited) must be taken into consideration in interpreting Article 15(1) of Directive
2002/58. The same is true of the right to freedom of expression in the light of the particularimportance accorded to that freedom in any democratic society. That fundamental rightguaranteed in Article 11 of the Charter, constitutes one of the essential foundations of apluralist democratic society and is one of the values on which under Article 2 TEU the Union
is founded (see to that effect: judgments of 12 June 2003, Schmidberger, C-112/00,
EU:C:2003:333, paragraph 79; and of 6 September 2011, Patriciello, C-163/10,
EU:C:2011:543, paragraph 31).”-

As put by Constitutional Court Decision 7/2014. (III. 7.) “[the] freedom of the press - which
includes the freedom of all types of media - is an institution of the freedom of speech. The
press is first and foremost the instrument of expressing an opinion, forming an opinion andobtaining information indispensable for formulating an opinion, even though its activities are
increasingly complex and diverse.” (Justification [40]). This role of the press is particularly
important for formulating opinions on public life because “[the] social and political debates toa substantial extent consist in the actors of public life or the participants of public debates characteristically through the press - criticising one another’s idea and, political performanceand in relation to that one another’s personality. It is the constitutional mission of the press
to check those exercising public powers, an organic part of which is the presentation of theactivities of persons and institutions forming public affairs” (Justification [48]).

-

As interpreted by the Constitutional Court, the central role of the media in forming democratic
public opinion does not lead to “not having legal regulations applicable to the information
activity of the press [...], but when acting and interpreting these, action must always be taken
not to prevent or hinder the performance of the constitutional mission of the press, thedisclosure of information in the public interest” {Constitutional Court Decision 3/2015. (II. 2.),
Justification [25]}. According to Constitutional Court Decision 28/2014. (IX. 29.) ”so long as
information is not an abuse of the exercise of the freedom of the press in the context of theprotection of human dignity, reference to an infringement of personality rights rarely provides
good grounds for restricting the exercise of the freedom of the press.” (Justification [42]). This
interpretation was consistently upheld also in Constitutional Court Decisions 16/2016. (X.
20.), and 17/2016. (X. 20.) in favour of the freedom of the press.

-

Pursuant to Article 6(1)(f) of the General Data Protection Regulation, processing is lawful, if
it is necessary for the purposes of the legitimate interests pursued by the controller or by athird party, except where such interests are overridden by the interests or fundamental rights
and freedoms of the data subject, which require protection of personal data, in particularwhere the data subject is a child.

-

In view of the fact that Hungary is a market economy, the mission of the press cannot bestrictly interpreted, so that the public cannot be provided with information in relation to theoperation and ownership background of private undertakings held by private individuals at
any level. Naturally, this activity also has its limits: the protection of business secrets, the15protection of human dignity, etc.; at the same time, business journalism is a legitimate activity.
The Obligee does not process and does not publish any personal data that would constitutea disproportionate violation of privacy. The personal data processed and disclosed by the
Obligee (of minimal extent) are closely related to business activity. Essentially, the Obligee
processes data related to the ownership background of the company (name). The estimates
related to the magnitude of the assets are based exclusively on public data linked to theactivities of the undertaking, thus the compilation does not cover the real property private
assets of private individuals (e.g. assets obtained through inheritance, by marriage, lottery
prizes). Similarly, the Obligee does not process and does not disclose data that would mean
severe intervention in privacy. (E.g. a compilation that would forecast changes in thebusiness on the basis of the health data of entrepreneurs would be obviously unlawful.)-Section 10(1) of the Act on Press Freedom also declares: “Everyone has a right to beappropriately informed of the affairs of local, national and European public life and events ofsignificance for the citizens of Hungary and the members of the Hungarian nation. The entire
media system is responsible for providing credible, rapid and accurate information on thesecases and events.”-

Section 10 of the Act on the Publicity of Company Data (Company Transparency Act??)
requires the publicity of company data for reasons for public interest. Company data andpersonal data included in them serve not only the safety of transactions. (The preamble tothis act also refers to the protection of public interest.) According to Section 10(2) of this act,
company data are fully accessible to the public.

-

The task of business journalism analysing a market economy is to explore the nodes of theeconomy, its internal interrelations, its owners, their contact networks and the role played by
the state. According to the Obligee, the paper issued by the Obligee did exactly this in relation
to the company held and managed by the Complainants. According to the Obligee, theinterpretation of the provisions of the Act on the Publicity of Company Data aligned with theFundamental Law is that the right of the press to provide information on the operation of theeconomy must be included in the public interest justifying their transparency. According to
the Obligee, a contrary interpretation would result in a situation in which information on theshareholders and senior officials of business organisations could be disclosed exclusively inthe event of the consent of the data subject, which would obviously render the “watchdog”
role of the press impossible, which cannot be narrowed to checking the public power of thestate.

-

According to the Obligee, information concerning the assets of the Complainants and their
public attachment to the Complainants means that these are personal data accessible to the
public on the grounds of public interest in accordance with Section 3(6) of the Privacy Act,the disclosure, availability or accessibility of which is prescribed by an act for the benefit of
the general public. Names of the Complainants and the business organisation held by themand its value are available in central, state-run, certified registries accessible to anyone.

-

Pursuant to Section 26(2) of the Privacy Act, personal data accessible on public interest
grounds shall be disseminated in compliance with the principle of data processing, limited tothe intended purpose. The Obligee processes the data of the Complainants for the purposeof exercising its rights stemming from the freedom of the press and to fulfil the informative
activities of the press in a democratic society. The Obligee sets forth the richest natural
persons and families of Hungary based on databases accessible to the public in every
calendar year. The purpose of this is to let Hungarian society know the persons having thegreatest economic influence because economic influence itself grants certain persons asubstantial role in public life, which is frequently concomitant with other social and politicalinfluence. Presenting such power concentration to the society and setting forth the changes
taking place in it year after year are within the provision of information for the public interest.
Another purpose of the Obligee was to provide information to the Hungarian business
community about the owners behind the largest Hungarian-owned companies, contributing

16

thereby to the transparency and traceability of business life. In addition, the Obligee regards
the reinforcement of Hungarian entrepreneurial culture as its tasks through reporting about
the activities of successful Hungarian entrepreneurs and the compilation of the annual richlist serves this purpose in part.
-

The Obligee regards its activities as being in the public interest. Economic journalism is alegitimate activity in the public interest and within this, the compilation and archiving of therichest persons having the largest (or much larger than average) social influence based on
publicly available data according to a reliable methodology serves the public interest. The
Obligee compiled the list of the richest persons exclusively on the basis of databases
accessible to the public. These registries (land registry, company database generated on thebasis of Trade Cxourt data and the communications of the companies themselves to the
public) and the personal data included in them are accessible to the public, so that economic
life be transparent and the citizens could learn of it. Journalism adds the added value to the
public databases by helping to interpret and summarise the gigantic quantity of information
accessible to the public for lay citizens. […] held and managed by the Complainants received
substantial state support, which in itself justifies presenting the person of the owner behind
the investments to the citizens (the readers).

-

In relation to Processing 1, the journalist employed by the Obligee contacted the undertaking
linked to the Complainants on 16 August 2019. Description presenting the methodology used
for the compilation was annexed to the letter, including the sources of the data used for thecompilation (company data accessible to the public). An excel table was also attached to thee-mail showing the calculation based on the data of […]. In response to the request by thelegal representative of the Complainants, the Obligee sent an answer containing its legal
position on 12 September 2019, in which it provided information on the range of dataprocessed; the employees performing the data processing were also named.

-[…] was contacted again by Obligee’s journalist on 14 November 2019 in relation to
Processing 2. The information on methodology and the excel table presenting the businessdata were again annexed to a letter. On 20 November 2019, the Obligee’s employee sent a
response to the legal representative of the Complainants presenting the legal position of the
Obligee.

Beyond providing information to the Authority, the Obligee requested the Authority to electronicallysend a petition of the Complainants and its annexes based on Section 33(1) and (4) of the
Administrative Procedures Act, in view of the fact that in the knowledge of the petition, the Obligee
wishes to make additional observations.
In its warrant No. NAIH/2020/1154/6 dated 16 March 2020, the Authority sustained the request for
inspecting the documents with restrictions, without sending the documents that were not to beaccessed and sent the petition about conducting a data protection procedure by the Authority andits annexes, the supplement to the petition and its annexes (except for the information sent by the
security director of […] concerning the introduction of changes in the personal protection tasks
affecting the […] family and the related measures) and the information sent by the Complainants to
the Authority on 24 January 2020, as well as its annexes, both by mail and electronically to the
Obligee.
In its e-mail sent on 23 March 2020, which was received by mail by the Authority on 26 March 2020,
the Obligee made the following supplementary remarks:-

The assessment of the truthfulness or untruthfulness of the facts of the case is not an issue
for data protection, it can be evaluated on the basis of the rules of the Civil Code or theFreedom of the Press Act in a procedure aimed at protecting personality rights or rectificationby the press. The Complainants did not launch such a procedure. In this context according
to the Obligee, it is obviously absurd to include minor children in the term “[…] family” as they
do not have the ability to act, hence they cannot be actors in an undertaking.

17-

The Complainants complain that they did not receive information on their rights and thepossibilities of legal remedy. True enough, the response did not include the relevant
provisions of the Privacy Act and of the General Data Protection Regulation, but the Privacy
Statement was available on the website forbes.hu, providing accurate information on thepossibilities of enforcing their rights on the one hand, and on the other hand, theComplainants contacted the Obligee through their legal representative and pursuant to Act
LXXVIII of 2017 on the Activities of the Attorneys-at-law (hereinafter: Lawyers Act), the legal
representative had the obligation to inform the Complainants of their enforceable rights andthe mode thereof. The cease and desist letters expressly refer to the fact that theComplainants would initiate a procedure to enforce their rights. The legal representative
cannot make such a statement without informing his clients about the enforcement of theirrights.

-According to the Obligee, the statement of the Complainants according to which it is notpossible to determine the logic with which the Forbes journalists analysed the data is
misleading. Annexed to the responses, a methodological letter was sent, detailing the methodof data analysis. In relation to this, the Obligee notes that the journalist has the sovereign
right to formulate conclusions after the analysis of the raw data. In the event of inaccuracy inthe personal data, the Complainants had the opportunity to make remarks, the Obligee’s
employee expressly requested a feedback on the calculations.

-

According to the Obligee, the other deficiencies of information listed by the Complainants are
not verified, the documents sent earlier to the Authority verify that the Complainants were
given appropriate information.

-

In relation to the resolution of the data protection commissioner referred to by theComplainants [“the fact that somebody is wealthy in itself does not mean that he is also apublic actor”], the Obligee points out that the basis of the current procedure is the General
Data Protection Regulation, it is pursuant to its Article 6(1)(f) that interest assessment has tobe carried out. As the Obligee stated in its response earlier sent to the Authority, an argument
for publicity is that the personal data were processed in relation to the use of public funds.
According to the Obligee, publicity is warranted not because of the fact of being wealthy, but
because the state has been supporting the Complainants’ undertaking with several billion
forints for years.

-

The Obligee rejects the parallels drawn by the Complainants between its professional workand homophobic or discrediting government propaganda lists referred to by theComplainants. According to the Obligee, this argumentation is not only tasteless, it is also
false, because the lists referred to embodied the processing of special personal data with aview to discrediting the data subjects. Obligee never processed any kind of special personal
data about the Complainants and the statements published in Forbes did not appear with aview to discrediting them.

-

In relation to the court decision BDT2017.3693 refer to by the Complainants, the Obligee
notes that the basis of the facts of the case of the decision was infringement of the right toportrait according to the Civil Code. According to the Obligee, one of the paragraphs of thedecision should be underlined. Accordingly: “in a case of public interest, the person of theclaimant was in the forefront of interest, but he may qualify as an actor in public life not in
relation to public power, but in relation to economic power, his name recognition is narrowerand his appearance in the media cannot be regarded as frequent. Although in this respect,
he has a great obligation to tolerate based on the Constitutional Court resolutions referred
to, his obligation to tolerate is not the same as that of a person having political or public
power. He is not the kind of actor in public life, who should tolerate the publication of thephotographs under litigation without good reason.” According to the Obligee, this reveals that
persons having economic power also have a greater obligation to tolerate.

-

The data processing and the content of the public disclosures based on it does not deal withthe private lives of the Complainants, but with the company they own and manage and with18

the financial support received from the state; neither the data processed, nor the statements
objected to have anything to do with their family and private lives.
-

The Complainants cite the serious threat to the rights of minor children as the grounds oftheir complaint. In relation to this, the Obligee notes that the documents enclosed reveal that
the Obligee does not process any data about any minor person and there is no minor among
the Complainants, not even through a legal representative.

-

The Complainants alleged that the September 2019 compilation directed the attention of
criminal circles to the family owing to which they have been living under an ongoing safety
risk. According to the Obligee, it is not verified in what way the attention of criminal circles
was directed at the family, and what kind of causal relationship is there between the
publication of the Forbes list and the actions of criminals. According to the Obligee, such a
relationship would be speculative and unverifiable even if - unfortunately - some behaviour
was implemented in the recent past to the detriment of the Complainants, infringing Act C of2012 on the Penal Code (hereinafter: Penal Code).

-

According to the Obligee, the CJEU judgment in the case C-131/12. referred to by theComplainants is a misleading reference, because that case specifically determined thecriteria for erasing information that is no longer topical (“right to be forgotten”). Paragraphs
70 and 81 of the judgment also require that interest assessment be carried out. According to
the Obligee, the information published were topical information on the part of the press,
hence the reference by the Complainants is misleading.

-

In relation to being tied to a purpose, the Obligee underlines that the purpose of processing
the data is to carry out the work of journalism and informing the public on issues of public
interest.

-

The Obligee did inform the Complainants on the results of the interest assessment; in its viewthe responses unambiguously reveal a criteria and results of the interest assessment.

-

According to the Obligee, the information on the methodology sent to the Complainants, theintroductions to the lists and the entries on the Complainants unambiguously revealed that
only economic data related to the company were used.

-

According to the Obligee, there is no automatic obligation to erase in the case of inaccuracy
in the data [particularly not based on Article 17(1)(c) of the General Data Protection
Regulation referred to by the Complainants]. Obligee also notes that the Complainants did
not exercise their right to rectify guaranteed by Article 16 of the General Data Protection
Regulation, even though they had the opportunity to do so.

In the letter sent to the Authority exclusively electronically on 24 April 2020, the Complainants again
supplement what they had already stated, and inform the Authority as follows:-

The […] Police has been paying particular attention to the area around […] estate, because
according to the report of the security director of […] a known criminal, living in Keszthely,
but of Moldavian origin, appeared in the area close to the living quarters of the family, ofwhom a video recording was made.

-As a result of the events arising in relation to this case, the owners of […] because of theactions taken by the Forbes publisher parted with their business quota they had for 16 years
representing significant value by way of a gift contract. […]-The Complainants withdraw their petition with regard to the publication implemented inrelation to Processing 2.

-

The Complainants continue to maintain their petitions submitted earlier with regard to
Processing 1, i.e. the data processing operations of and before September 2019.

All in all, the Complainants maintain their petition for establishing the fact of unlawful data processing
by the Obligee according to Article 5(1)(a), (b) and (e), Article 6(1)(f) (including the failure to carry

19

out the individual interest assessment following the objection), Article 13 and Article 14(1) and (2),and Article 21(1) of the General Data Protection Regulation with regard to Processing 1 andProcessing 2 with the exception of the publication as described above. The Complainants requested
the Authority to evaluate the petition submitted within this restricted range.
II. Legal provisions applied
Pursuant to Article 2(1) of the General Data Protection Regulation, this Regulation applies to theprocessing of personal data wholly or partly by automatic means, and to the processing of personal
data by non-automatic means, which form part of a filing system or are intended to form part of afiling system.
Pursuant to Section 2(2) of the Privacy Act, the General Data Protection Regulation shall apply todata processing subject to this Regulation with the additional rules specified therein.
Pursuant to Article 4(1) of the General Data Protection Regulation, “personal data” means any
information relating to an identified or identifiable natural person (“data subject”); an identifiable
natural person is one, who can be identified directly or indirectly, in particular by reference to an
identifier such as a name, an identification number, location data, an on-line identifier or to one ormore factors specific to the physical, physiological, genetic, mental, economic, cultural or social
identity of that natural person.
Pursuant to Article 4(2) of the General Data Protection Regulation, “processing” means any
operational set of operations, which is performed on personal data or on sets of personal data,
whether or not by automated means, such as collection, recording, organisation, structuring, storage,
adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination orotherwise making available, alignment or combination, restriction, erasure or destruction.
Pursuant to Article 4(4) of the General Data Protection Regulation “profiling” means any form of
automated processing of personal data, consisting of the use of personal data to evaluate certain
personal aspects relating to a natural person, in particular to analyse or predict aspects concerning
the natural person’s performance at work, economic situation, health, personal preferences,interests, reliability, behaviour, location or movements.
Pursuant to Article 4(6) of the General Data Protection Regulation, “filing system” means any
structured set of personal data, which are accessible according to specific criteria whether
centralised, decentralised or dispersed on a functional or geographical basis.
Pursuant to Article 4(7) of the General Data Protection Regulation, “controller” means the natural or
legal person, public authority, agency or other body, which alone or jointly with others determines
the purposes and means of the processing of personal data; where the purposes and means of suchprocessing are determined by Union or Member State law, the controller or the specific criteria for
its nomination may be provided for by Union or Member State law.
Pursuant to Article 5(1)(a) of the General Data Protection Regulation, personal data shall beprocessed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness,fairness and transparency”).
Pursuant to Article 5(1)(b) of the General Data Protection Regulation, personal data shall becollected for specified, explicit and the legitimate purposes and not further processed in a mannerthat is incompatible with those purposes. (“purpose limitation”).
Pursuant to Article 5(1)(c) of the General Data Protection Regulation, personal data shall beadequate, relevant and limited to what is necessary in relation to the purposes for which they are20

processed (“data minimisation”).
Pursuant to Article 5(1)(d) of the General Data Protection Regulation, personal data shall be accurate
and where necessary kept up-to-date; every reasonable step must be taken to ensure that personalthat are inaccurate, having regard to the purposes for which they are processed are erased or
rectified without delay (“accuracy”).
Pursuant to Article 5(1)(e) of the General Data Protection Regulation, personal data shall be kept in
a form, which permits identification of data subjects for no longer than is necessary for the purposes
for which the personal data are processed; personal data may be stored for longer periods insofar,as the personal data will be processed solely for archiving purposes in the public interest, scientificor historical research purposes or statistical purposes in accordance with Article 89(1) subject toimplementation of appropriate, technical and organisational measures required by this Regulation inorder to safeguard the rights and freedoms of the data subject (“storage limitation”).
Pursuant to Article 5(2) of the General Data Protection Regulation, the controller shall be responsible
for and be able to demonstrate compliance with paragraph (1) (“accountability”).
Pursuant to Article 6(1) of the General Data Protection Regulation, the processing of personal data
shall be lawful only if and to the extent that at least one of the following applies:a) the data subject has given consent to the processing of his or her personal data for one ormore specific purposes;b) processing is necessary for the performance of a contract to which the data subject is party,
or in order to take steps at the request of the data subject prior to entering into a contract;c) processing is necessary for compliance with a legal obligation to which the controller issubject;d) processing is necessary in order to protect the vital interests of the data subject or of anothernatural person;e) processing is necessary for the performance of a task carried out in the public interest or in
the exercise of official authority vested in the controller;f) processing is necessary for the purposes of the legitimate interest pursued by the controller
or by a third party, except where such interests are overridden by the interests or fundamental
rights and freedoms of the data subject, which require protection of personal data, in particularwhere the data subject is a child.
Pursuant to Recital (47) of the General Data Protection Regulation the existence of a legitimate
interest would need careful assessment, including whether a data subject can reasonably expect at
the time and in the context of the collection of the personal that processing that purpose may takeplace. The interests and fundamental rights of the data subject could in particular override theinterest of the data controller where personal data are processed in circumstances where data
subjects do not reasonably expect further processing. [...] The processing of personal data strictly
necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data
controller concerned. The processing of personal data for direct marketing purposes may be
regarded as carried out for a legitimate interest.
Article 12 of the General Data Protection Regulation specifies the obligations of the controller in
relation to measures for the exercise of the rights of the data subject.
Pursuant to Article 12(1) of the General Data Protection Regulation the controller shall takeappropriate measures to provide any information referred to in Articles 13 and 14 and any
communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise,transparent, intelligible and easily accessible form, using clear and plain language, in particular for
any information addressed specifically to a child. The information shall be provided in writing, or byother means, including where appropriate by electronic means. When requested by the data subject,

21

the information may be provided orally, provided that the identity of the data subject is proven byother means.
Pursuant to Article 12(2) of the General Data Protection Regulation, the controller shall facilitate theexercise of data subject rights under Articles 15 to 22. In the cases referred to in Article 11(2) thecontroller shall not refuse to act on the request of the data subject for exercising their rights under
Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data
subject.
Pursuant to Article 12(3) of the General Data Protection Regulation the controller shall provide
information on action taken on a request under Articles 15 to 22 to the data subject without undue
delay and in any event within one month of receipt of the request. That period may be extended by
two further months where necessary, taking into account the complexity and number of the requests.
The controller shall inform the data subject of any such extension within one month of receipt of therequest, together with the reasons for the delay. Where the data subject makes the request byelectronic form means, the information shall be provided by electronic means, where possible,
unless otherwise requested by the data subject.
Pursuant to Article 12(4) of the General Data Protection Regulation, if the controller does not takeaction on the request of the data subject, the controller shall inform the data subject without delay
and at the latest within one month of receipt of the request of the reasons for not taking action andon the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
Pursuant to Article 12(5) of the General Data Protection Regulation, the information provided under
Articles 13 and 14 and any communication and any actions taken under Article 15 to 22 and 34 shallbe provided free of charge. When request from a data subject is manifestly unfounded or excessive,in particular because of their repetitive character, the controller may either charge a reasonable fee
taking into account the administrative costs of providing the information or communication, or taking
the action requested, or refused to act on the request. The controller shall bear the burden of
demonstrating the manifestly unfounded or excessive character of the request.
Article 14 of the General Data Protection Regulation sets forth a minimum information that thecontroller has to provide to the data subject, if the personal data have not been obtained from thedata subject. Accordingly:[Article 14] (1): Where the personal data have not been obtained from the data subject, the controller
shall provide the data subject with the following information:a) the identity and the contact details of the controller and the controller’s representative, if any;b) the contact details of the data protection officer, if any;c) the purpose of the envisaged processing as well as the legal basis for data processing;d) the categories of personal data concerned;e) the recipients of personal data and the categories of recipients, if any;f) where applicable, the fact that the controller intends to transfer personal data to a recipient
in a third country or to an international organisation, and the existence or absence of anadequacy decision by the Commission, or in the case of transfers referred to in Article 46 or
47 or the second subparagraph of Article 49(1), reference to appropriate or suitablesafeguards and the means to obtain copies thereof, or where they have been made available.
[Article 14] (2): In addition to the information referred to in paragraph (1), the controller shall provide
the data subject with the following information necessary to ensure fair and transparent processing
in respect of the data subject:a) the period for which the personal data will be stored, or if not possible, the criteria used todetermine that period;b) where data processing is based on point (f) of Article 6(1), the legitimate interest pursued by
the controller or by a third party;

22c) the existence of the right to request from the controller access to and rectification or erasureof personal data, or restriction of processing concerning the data subject, or to object toprocessing, as well as the right to data portability;d) where processing is based on Article 6(1) (a) of or of Article 9(2)point (a)), the existence ofthe right to withdraw consent at any time, without affecting the lawfulness of processing isbased on consent before its withdrawal;e) the right to lodge a complaint with a supervisory authority;f) from which source the personal data originate and, if applicable, whether it came frompublicly accessible sources; andg) the existence of automated decision-making, including profiling, referred to in Article 22(1)and (4), and at least in those cases, meaningful information about the logic involved, as wellas the significance and the envisaged consequences of such processing for the data subject.
[Article 14] (3): The controller shall provide information referred to in paragraphs (1) and (2):a) within a reasonable period after obtaining the personal data, but at the latest within one monthhaving regard to the specific circumstances in which the personal data are processed;b) if the personal data are to be used for communication with the data subject, at the latest at
the time of the firstc) communication to that data subject; ord) if a disclosure to another recipient is envisaged, at the latest when the personal data are first
disclosed.
[Article 14] (4): Where the controller intends to further process the personal data for a purpose otherthan that for which the personal data were obtained, the controller shall provide the data subject
prior to that further processing with information on that other purpose and with any relevant further
information as referred to in paragraph (2).
[Article 14] (5): Paragraphs (1) to (4) shall not apply where and insofar as:a) the data subject already has the information;b) the provision of such information proves impossible or would involve a disproportionate effort,in particular for processing for archiving purposes in the public interest, scientific or historicalresearch purposes, or statistical purposes, subject to the conditions and safeguards referred
to in Article 89(1) or insofar as the obligation referred to in paragraph (1) of this article is likely
to render impossible or seriously impair the achievement of the objectives of that processing.
In such cases the controller shall take appropriate measures to protect the data subject’s
rights and freedoms and legitimate interest, including making the information publicly
available;c) obtaining or disclosing the data is expressly laid down by Union or Member State law, towhich the controller is subject and which provides appropriate measures to protect the data
subject’s legitimate interests; ord) where the personal data must remain confidential, subject to an obligation of professionalsecrecy, regulated by Union or Member State law, including a statutory obligation of secrecy.
Pursuant to Article 15(1) of the General Data Protection Regulation. the data subject shall have theright to obtain from the controller confirmation as to whether or not personal data concerning them
are being processed and where that is the case, access to the personal data and the following
information:a) the purposes of data processing;b) the categories of personal data concerned;c) the recipients or categories of recipient, to whom the personal data have been or will be
disclosed, in particular, recipients in third countries or international organisations;d) where possible, the envisaged period for which the personal data will be stored, or if notpossible, the criteria used to determine that period;

23e) the existence of the right to request from the controller, rectification or erasure of personal
data or restriction of processing of personal data concerning the data subject, or to object tosuch processing;f) the right to lodge a complaint with a supervisory authority;g) where the personal data are not collected from the data subject, any available information as
to their source;h) the existence of automated decision-making, including profiling, referred to in Article 22(1)and (4), and at least in those cases, meaningful information about the logic involved, as wellas the significance and the envisaged consequences of such processing for the data subject.
Pursuant to Article 16 of the General Data Protection Regulation, the data subject has the right toobtain from the controller without undue delay the rectification of inaccurate personal data
concerning him or her. Taking into account the purposes of the processing, the data subject shallhave the right to have incomplete personal data completed, including by means of providing a
supplementary statement.
Pursuant to Article 17(1) of the General Data Protection Regulation, the data subject shall have theright to obtain from the controller the erasure of personal data concerning him or her without undue
delay and the controller shall have the obligation to erase the personal data without undue delay,
where one of the following grounds applies:a) the personal data are no longer necessary in relation to the purposes for which they werecollected or otherwise processed;b) the data subject withdraws consent on which the processing is based according to Article
6(1)(a), or Article 9(2)(a) and where there is no other legal ground for the processing.
c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding
legitimate grounds for the processing or the data subject objects to the processing pursuant
to Article 21(2);d) the personal data have been unlawfully processed;e) the personal data have to be erased for compliance with a legal obligation in Union or Member
State law, to which the controller is subject;f) the personal data have been collected in relation to the offer of information society services,
referred to in Article 8(1).
Pursuant to Article 17(2) of the General Data Protection Regulation, where the controller has madethe personal data public and is obliged pursuant to paragraph (1) to erase the personal data, thecontroller taking account of the available technology and the cost of implementation shall takereasonable steps, including technical measures, to inform controllers, which are processing thepersonal data that the data subject has requested the erasure by such controllers of any links to, or
copies, or duplicates of those personal data.
Pursuant to Article 17(3) of the General Data Protection Regulation, paragraphs (1) and (2) shall not
apply to the extent that processing is necessary:a) for exercising the right of freedom of expression and information;b) for compliance with a legal obligation, which requires professing by Union or Member State
law, to which the controller is subject or for the performance of a task carried out in the public
interest or in the exercise of official authority vested in the controller;c) for reasons of public interest in the area of public health in accordance with Article 9(2)(h)and (i) as well as Article 9(3);d) for achieving purposes in the public interest, scientific or historical research purposes, or
statistical purposes, in accordance with Article 89(1) insofar as the right referred to inparagraph (1) is likely to render impossible or seriously impair the achievement of theobjectives of that processing; ore) for the establishment exercise or defence of legal claims.

24

Pursuant to Article 18(1) of the General Data Protection Regulation, the data subject shall have theright to obtain from the controller restriction of processing where one of the following applies:a) the accuracy of the personal data is contested by the data subject for a period enabling thecontroller to verify the accuracy of the personal data;b) the processing is unlawful and the data subject opposes the erasure of the personal data
and requests the restriction of their use instead;c) the controller no longer needs the personal data for the purposes of the processing, but they
are required by the data subject for the establishment, exercise or defence of legal claims;ord) the data subject has objected to processing pursuant to Article 21(1) pending the verification
whether the legitimate grounds of the controller override those of the data subject.
Pursuant to Article 18(2) of the General Data Protection Regulation, where processing has been
restricted under paragraph (1) such personal data shall, with the exception of storage, only beprocessed with the data subject’s consent or for the establishment, exercise or defence of legal
claims, or for the protection of the rights of another natural or legal person, or for reasons of important
public interest of the Union or of a Member State.
Pursuant to Recital (67) of the General Data Protection Regulation, methods by which to restrict theprocessing of personal data could include, inter alia, temporarily moving the selected data to anotherprocessing system, making the selected personal data unavailable to users, or temporarily removing
published data from a website. In automated filing systems, the restriction of processing should in
principle be ensured by technical means in such a manner that the personal data are not subject tofurther processing operations and cannot be changed. The fact that the processing of personal data
is restricted, should be clearly indicated in the system.
Pursuant to Article 21(1) of the General Data Protection Regulation the data subject shall have theright to object on grounds relating to his or her particular situation at any time to processing of
personal data concerning him or her, which is based on Article 6(1)(e) or (f) including profiling basedon those provisions. The controller shall no longer process the personal data, unless the controller
demonstrates compelling legitimate grounds for the processing, which override the interests, rights
and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
Pursuant to Article 21(2) of the General Data Protection Regulation, when personal data areprocessed for direct marketing purposes, the data subject shall have the right to object at any timeto processing of personal data concerning him or her for such marketing, which includes profiling to
the extent that it is related to such direct marketing.
Pursuant to Article 21(3) of the General Data Protection Regulation, when the data subject objects
to processing for direct marketing purposes, the personal data shall no longer be processed for such
purposes.
Pursuant to Article 21(4) of the General Data Protection Regulation, at latest at the time of the firstcommunication with the data subject, the right referred to in paragraphs (1) and (2) shall be explicitly
brought to the attention of the data subject and shall be presented clearly and separately from anyother information.
Pursuant to Article 77(1) of the General Data Protection Regulation, without prejudice to any otheradministrative or judicial remedy, every data subject shall have the right to lodge a complaint with asupervisory authority, in particular in the Member State of his or her habitual residence, place ofwork or place of the alleged infringement, if the data subject considers that the processing of
personal data relating to him or her infringes this Regulation.
Pursuant to Section 38(2) of the Privacy Act, the Authority shall be responsible for monitoring andpromoting the enforcement of rights to the protection of personal data and access to data of public

25interest and data accessible on public interest grounds, as well as promoting the free movement of
personal data within the European Union. The tasks and powers of the Authority are detailed in
Article 57(1), Article 58(1)-(3) of the General Data Protection Regulation and Article 38(2)-(4) of thePrivacy Act.
Pursuant to Section 60(1) and (2) of the Privacy Act, to ensure that the right to the protection of
personal data is enforced, the Authority shall commence an administrative procedure for dataprotection at the application of the data subject and may commence an administrative procedure fordata protection ex officio. An application for commencing an administrative procedure for dataprotection may be submitted in the cases under Article 77(1) of the General Data Protection
Regulation and Section 22(b) of this Act.
Unless otherwise provided for in the General Data Protection Regulation, the provisions of the
Administrative Procedures Act shall apply to the administrative procedure for data protection
launched by application with the differences specified in the Privacy Act.
Pursuant to Section 61(1)(a) of the Privacy Act, in its decision adopted in admnistrative proceduresfor data protection, the Authority may apply the legal consequences specified in Article 58(2) of theGeneral Data Protection Regulation concerning the data processing operations specified in Section
2(2) of the Privacy Act. Accordingly, acting within its corrective powers, the Authority:a) issues warnings to a controller or processor that intended processing operations are likely to
infringe provisions of this Regulation;b) issues reprimands to a controller or a processor where processing operations have infringed
provisions of this Regulation;c) orders the controller or the processor to comply with the data subject’s request to exercise
his or her rights pursuant to this Regulation;d) orders the controller or processor to bring processing operations into compliance with theprovisions of this Regulation, where appropriate, in a specified manner and within a specificperiod;e) orders the controller to communicate a personal data breach to the data subject;f) imposes a temporary or definitive limitation, including a ban on processing;g) orders the rectification or erasure of personal data or restriction of processing pursuant to
Articles 16, 17 and 18, and the notification of such actions to recipients to whom the personal
data have been disclosed pursuant to Article 17(2) and Article 19;h) withdraws a certifice or orders the certification body to withdraw a certifice issued pursuant
to Articles 42 and 43, or orders the certification body not to issue a certifice, if therequirements for the certification are no longer met;i) imposes an administrative fine pursuant to Article 83, in addition to or instead of measuresreferred to in this paragraph depending on the circumstances of each individual case; andj) orders the suspension of data flows to a recipient in a third country or to an internationalorganisation.
Pursuant to Article 83(1) of the General Data Protection Regulation, each supervisory authority shallensure that the imposition of administrative fines pursuant to this article in respect of infringementsof this Regulation referred to in paragraphs (4), (5) and (6) shall in each individual case be effective,
proportionate and dissuasive.
Pursuant to Article 83(2) of the General Data Protection Regulation, administrative fines shall,depending on the circumstances of each individual case, be imposed in addition to, or instead of,measures referred to in Article 58(2)(a)-(h) and (j). When deciding whether to impose anadministrative fine and deciding on the amount of the administrative fine in each individual case due
regard shall be given to the following:

26a) the nature, gravity and duration of the infringement taking into account the nature, scope or
purpose of the processing concerned, as well as the number of data subjects affected andthe level of damage suffered by them;b) the intentional or negligent character of the infringement;c) any action taken by the controller or processor to mitigate the damage suffered by data
subjects;d) the degree of responsibility of the controller or processor taking into account technical andorganisational measures implemented by them pursuant to Articles 25 and 32;e) any relevant previous infringements by the controller or the processor;f) the degree of cooperation with the supervisory authority in order to remedy the infringement
and mitigate the possible adverse effects of the infringement;g) the categories of personal data affected by the infringement;h) the manner in which the infringement became known to the supervisory authority, in particularwhether, and if so, to what extent the controller or processor notified the infringement;i) where measures referred to in Article 58(2) have previously been ordered against thecontroller or processor concerned with regard to the same subject matter compliance withthose measures;j) adherence to approved codes of conduct pursuant to Article 40 or approved certification
mechanisms pursuant to Article 42; andk) any other aggravating or mitigating factor applicable to the circumstances of the case, suchas financial benefits gained, or losses avoided, directly or indirectly, from the infringement.
Pursuant Article 83(5) of the General Data Protection Regulation, infringements of the following
provisions shall, in accordance with paragraph (2), be subject to administrative fines up to
EUR 20,000,000, or in the case of an undertaking up to 4% of the total worldwide annual turnoverof the preceding financial year, whichever is higher:a) the basic principles for processing, including conditions for consent - pursuant to Articles 5,6, 7 and 9;b) the data subjects’ rights pursuant to Articles 12 to 22.
Pursuant to Article 83(7) of the General Data Protection Regulation, without prejudice to thecorrective powers of supervisory authorities pursuant to Article 58(2), each Member State may lay
down the rules on whether and to what extent administrative fines may be imposed on publicauthorities and bodies established in that Member State.
Pursuant to Section 61(1)(bg) of the Privacy Act, in its decision adopted in administrative proceduresfor data protection, the Authority may impose a fine.
Pursuant Section 75/A of the Privacy Act, the Authority shall exercise its powers specified in Article
83(2) to (6) of the General Data Protection Regulation according to the principle of proportionality,in particular by primarily issuing, in compliance with Article 58 of the General Data Protection
Regulation, a warning to the controller or processor for the purpose of remedying the infringement
when the provisions laid down by law or a binding legal act of the European Union on the processingof personal data are first infringed.
Pursuant to Section 17 of the Administrative Procedures Act, the authority shall examine its powers
and competency ex officio in every phase of the procedure. If the authority notes the absence ofeither, and the authority having competence in the case can be established excluding any doubt, thecase shall be transferred; in the absence of this, the petition shall be rejected and the procedure
shall be terminated.
Pursuant to Section 47(1)(a) of the Administrative Procedures Act, the Authority shall terminate theprocedure, if the petition should have been rejected, but the reasons for this came to the knowledgeof the authority only after launching the procedure.

27

Pursuant to Section VI(1) of the Fundamental Law, everyone shall have the right to have theirprivacy, family life, home, contacts and reputation respected. The freedom of expression and theexercise of the right of assembly may not involve the violation of the privacy, family life and home ofothers.
Pursuant to Sections 1-2 of Act LIII of 2018 on the Protection of Privacy (hereinafter: Privacy
Protection Act) everyone shall have the right to have their privacy, family life, home and contacts(hereinafter: right to privacy) respected. The right to privacy is part of the right to the free unfoldingof personality, pursuant to which the individual shall have freedom to responsibly and independently
develop their life, to create and safeguard their family, home and human relationships. […] This rightmay only be limited to enforce some other fundamental right or to protect a constitutional value tothe extent strictly necessary, proportionately to the purpose to be achieved, while respecting theessential content of the right to privacy and human dignity. The substance of the right to privacy isthat others should not be able to infringe it, in spite of the will of the individual, with exceptions
specified in a separate Act. When exercising the right to privacy, everyone shall respect the rights
of others.
Pursuant to Section 8(1)-(2) of the Privacy Protection Act, a purpose of the right to respect privacy
is in particular the protection of the right to bear a name, personal data, private secrets, photo andsound recordings, honour and reputation. Misuse of personal data, secrets, photos, soundrecordings that the individual wishes to safeguard particularly in relation to private life, or a violationof honour and reputation may constitute infringements of the right to respect privacy.
Pursuant to Section 9(1)-(3) of the Privacy Protection Act, everyone shall have the right to theincreased protection of family life as the medium of privacy. The right to respect family life shall be
due to the individual and their family member jointly. The unauthorised violation or disturbance ofthe family life of others, or an unauthorized intervention in the family life of others constituteinfringements of the right to respecting family life.
Pursuant to Section VI(3) of the Fundamental Law, everyone shall have the right to the protection of
their personal data and to accessing and disseminating data in the public interest.
Pursuant to Section 1 of the Privacy Act, the purpose of this Act is to lay down, in the areas fallingwithin its scope, the fundamental rules for data processing in order to ensure that natural person’s
right to privacy is respected by controllers and to achieve the transparency of public affairs throughthe enforcement of the right to access and disseminate data of public interest and data accessible
on public interest grounds.
Pursuant to Section 3(6) of the Privacy Act, data accessible on public interest grounds means any
data, other than data of public interest, the disclosure, availability or accessibility of which isprescribed by an Act for the benefit of the general public.
Pursuant to Section 26(2) of the Privacy Act, personal data accessible on public interest grounds
shall be disseminated in compliance with the principle of data processing, limited to the intended
purpose.
The preamble of the Company Transparency Act declares that its purpose is to determine the orderof company foundation and registration in accordance with the regulations of the European Union
by establishing a modern legal framework, and to ensure the full accessibility of the data of the public
Trade Registry directly or electronically in order to protect the constitutional rights of entrepreneurs,
the security of economic transactions, creditor’s interests or other public interests.
Pursuant to Section 10(1) of the Company Transparency Act, the Trade Registry consists of the listof companies and annexes verifying data in the list of companies, as well as other documents, the28submission of which is required by law to protect public interests, the safety of transactions andcreditors’ interests (hereinafter jointly: company documents).
Pursuant to Section 10(2) of the Company Transparency Act, the existing and erased data of the listof companies and the company documents, including electronically submitted company documentsor those transformed into electronic documents, shall be fully accessible to the public. Following the
successful completion of the tax registration procedure according to the Act on the Rules of Taxation,
the already submitted, but not yet evaluated registration application and its annexes shall also be
fully accessible with the provision that the Trade Registry shall refer to the fact that the evaluation of
the registration (change registration) application is in progress. Pursuant to the provisions of this Act,the documents of the supervisory procedure for compliance shall be accessible to the public.
Pursuant to Section 24(1)(b), (f) and (h) of the Company Transparency Act, the list of companies
shall, for each company, include the name of the company, its registered capital, the name of its
senior officer or of the person authorised to represent the company, its tax identification number, inthe case of a natural person their place of residence, date of birth, their mother’s name at birth, inthe case of legal entity, its registered office and Trade Registry number or registration number, theoffice of the persons authorised to represent the company, the date of the generation of this legal
relationship in the event of representation for a specific period of time as well as the date of thetermination of the legal relationship, or if the termination of the legal relationship took place prior to
the date indicated in the Trade Registry, the actual date of termination and the fact whether thesignature specimen of the company representative attested by a public notary or countersigned by
an attorney-at-law or solicitor (members of the Bar Association) was submitted.
Pursuant to Section 27(3)(a) and (e) of the Company Transparency Act, over and above the data
specified in Sections 24-26, the list of companies shall include in the case of limited liability
companiesa) the names of the members, in the case of natural persons: place of residence, date of birth,mother’s name at birth; in the case of a legal entities: the registered office and the Trade
Registry number or registration number and the fact if the voting rights of a member exceed
50 percent, or if the member has an influence of a qualified majority.
e) in case of a jointly held business quota, the names of the shareholders, in the case of natural
persons: the place of residence, date of birth, mother’s name at birth; in the case of legal
entities: their registered office, Trade Registry number or registration number.
Pursuant to Section 5(1)-(2) of Act CVI of 2007 on State Assets (hereinafter: State Assets Act), all
the data concerning the management of state assets that do not qualify as data of public interest
shall be accessible on public interest grounds. The body or person managing state assets or having
disposal over state assets shall qualify as a body or person performing public duties in accordancewith the act concerning the accessibility of data of public interest.
Pursuant to Section 27(3) of the Privacy Act, as data accessible on public interest grounds, thefollowing shall not qualify as business secret: the budget of the central government and the local
governments; furthermore, data related to the use of European Union funds, to benefits andallowances involving the budget, to the management, possession, use, utilisation and the disposal
and encumbrance of central and local government assets, and the acquisition of any right inconnection with such assets, as well as data, the accessibility or publication of which is prescribedon public interest grounds by a specific Act. Disclosure, however, shall not entail access to data, toprotected knowledge in particular, the knowledge of which would cause disproportionate harm withrespect to the performance of business activities, provided that this does not prevent the possibilityof access to data accessible on public interest grounds.
Pursuant to Section IX(1), (2) and (4) of the Fundamental Law, everyone shall have the right to thefreedom of expression. Hungary recognises and protects the freedom and diversity of the press andguarantees the conditions of free information needed for the development of democratic public

29

opinion. The exercise of the freedom of expression may not be directed at violating the human dignityof others.
Pursuant to Article 85(1) of the General Data Protection Regulation, Member States shall, by law,reconcile the right to the protection of personal data pursuant to this Regulation with the right to thefreedom of express and information, including processing for journalistic purposes and the purposesof academic, artistic or literary expression.
Pursuant to Article 85(2) of the General Data Protection Regulation, for processing carried out forjournalistic purposes or for the purposes of academic, artistic or literary expression, Member Statesshall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data
subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries
or international organisations), Chapter VI (independent supervisory authorities), Chapter VII(cooperation and consistency) and Chapter IX (specific data processing situations), if they arenecessary to reconcile the right to the protection of personal data with the freedom of expression
and information.
Pursuant to Recital (65) of the General Data Protection Regulation, […] the further retention of thepersonal data should be lawful where it is necessary for exercising the right of freedom of expression
and information, for compliance with a legal obligation, for the performance of a task carried out inthe public interest, or in order to exercise official authority vested in the controller, on the grounds ofpublic interest in the area of public health, for achieving purposes in the public interest, scientific or
historical research purposes or statistical purposes or for the establishment, exercise or defence oflegal claims.
Pursuant to Recital (153) of the General Data Protection Regulation, Member States’ law should
reconcile the rules governing freedom of expression and information, including journalistic,academic, artistic and/or literary expression with the right to the protection of personal data pursuant
to this Regulation. The processing of personal data solely for journalistic purposes, or for the
purposes of academic, artistic or literary expression should be subject to derogations or exemptions
from certain provisions of this Regulation, if necessary to reconcile the right to the protection of
personal data with the right to freedom of expression and information as enshrined in Article 11 of
the Charter. This should apply in particular to the processing of personal data in the audio-visual
field and in news archives and press libraries. Therefore, Member States should adopt legislative
measures, which lay down the exemptions and derogations necessary for the purpose of balancing
those fundamental rights. Member States should adopt such exemptions and derogations on generalprinciples, the rights of the data subject, the controller and the processor, the transfer of personal
data to third countries or international organisations, independent supervisory authorities,
cooperation and consistency and specific data processing situations. Where such exemptions orderogations differ from one Member State to another, the law of the Member State to which thecontroller is subject should apply. In order to take account of the importance of the right to freedomof expression in every democratic society, it is necessary to interpret notions relating to that freedom,such as journalism, broadly.
Pursuant to Section 4(3) of the Freedom of the Press Act, the exercise of the freedom of the press
may not entail a crime or an incitement to commit a crime, it may not violate public morality, nor
infringe the personality rights of others.
Pursuant to Section 10 of the Freedom of the Press Act, everyone shall have the right to beappropriately informed of the affairs of local, national and European public life and of events ofsignificance for the citizens of Hungary and the members of the Hungarian nation. The entirety ofthe media system is responsible for providing credible, rapid and accurate information on theseaffairs and events.

30

Pursuant to Section 13 of the Freedom of the Press Act, linear media services providing information
shall provide balanced information on the local, national and European events in the public interest,
as well as those of significance for the citizens of Hungary and members of the Hungarian nation,and on disputed issues in their informative or news programmes. The detailed rules of this obligation
are stipulated by the Act in accordance with the requirements of proportionality and ensuring a
democratic public opinion.
Pursuant to Section 2:44 (1)-(3) of the Civil Code concerning the protection of the personality rights
of public actors, the exercise of fundamental rights ensuring the free discussion of public affairs may
limit the protection of the personality rights of the public actor to a necessary and proportionate extent
without infringing human dignity; this, however, may not violate his or her privacy, family life andhome. A public actor shall have a protection against communication or behaviour outside the scopeof the free discussion of public affairs identical to that due to a non-public actor. Activities or data
concerning the private or family life of the public actor do not qualify as public affairs.
Article 8 of the Charter of the European Convention on Human Rights states that everyone has theright to respect for his or her private and family life, home and communications. An authority may
intervene in the exercise of this right only in cases specified by law when it is necessary in a
democratic society in the interest of national security, public safety or the economic wellbeing of thecountry, to prevent disturbances or criminal acts, to protect public health and morals, or to protect
the rights and freedoms of others.
Pursuant to Article 10(1) of the Charter of the European Convention on Human Rights, everyone has
the right to freedom of expression. This right shall include freedom to hold opinions and to receive
and impart information and ideas without interference by public authority and regardless of frontiers.
III. The decision of the Authority
III.1. The person of the controller
According to the definitions provided in the General Data Protection Regulation, any information
relating to an identified or identifiable natural person qualifies as personal data, any operation, whichis performed on personal data qualifies as processing, while the natural or legal person, publicauthority, agency or other body, which alone or jointly with others determines the purposes andmeans of the processing of personal data qualifies as controller.
With regard to the processing under study, the full name, family name and the data concerning the
economic situation of the complainants qualify as personal data pursuant to Article 4(1) of theGeneral Data Protection Regulation, while the publisher of the press product collecting, processing,listing and publishing the data qualifies as controller pursuant to article 4(7) of the General Data
Protection Regulation in respect of both the contents and publications whether published on-line orin a printed form, and the personal data disclosed in them in view of the fact that the publisher of thepress product determines the purpose of the (re)use of the personal data and their publication.
Pursuant to Article 2(1) of the General Data Protection Regulation, Processing 1 and Processing 2
are subject to the scope of the General Data Protection Regulation, consequently the rules of theGeneral Data Protection Regulation must be applied to these instances of processing.
In view of the above, the Obligee as the Hungarian publisher of Forbes qualifies as controller withrespect to the data processing acts objected to.

III.2. The persons of the Complainants

31

The Complainants mentioned in their statements made in the course of the procedure and in theircorrespondence with the Obligee that they were not public actors.
In its Decision 3145/2018. (V. 7.), the Constitutional Court underlined that as a result of the changedsocial relations, particularly the spreading of telecommunications, an expansion in the category of
public actors could be observed, thus persons who had earlier not been covered by the concept of
public actors also have a possibility to actively shape public debates. These persons are termed as
exceptional public actors. {3145/2018 (V. 7.) Constitutional Court Decision Justification [46]}The freedom of expression protects first and foremost the expression of opinion related to thecriticism of public powers, but as interpreted by the Constitutional Court, the range of issues in public
life is broader than political speech or the criticism of the activities of persons exercising public power.
Accordingly, public debate embraces not only the entirety of the operation of the state and local
governments and the institutions of public power, but also issues of the social responsibility ofbusinesses and issues of public life seen in increasing numbers in the business world (such asenvironment protection, energy efficiency, work and labour safety and transport safety issues).
{3145/2018 (V. 7.) Constitutional Court Decision Justification [31]-[32]}According to the decision of the Constitutional Court, the following criteria should be consideredwhen deciding on the criteria of being a public actor:- whether the public disclosure expressing an opinion reflects a position expressed in a
debate of public interest,- whether the public disclosure concerns public speaking,- whether the public disclosure is a statement of facts or a value judgement,- whether the public disclosure violates the human dignity or reputation (honour) of the data
subject.
Whether someone is a public actor is tied to the fact of public speaking being concomitant with thedebate of issues in public life, which should be assessed individually based on specific criteria: themode and circumstances of the publication of the disclosure, the subject matter and context of theopinion (e.g. the type of the medium, the apropos of the disclosure, its content, style, purpose andtopicality or the reactions to it) as stated by the Constitutional Court.
The existence of the freedom of expression can only be verified in the cases in which the participants
decide to shape public opinion more actively than others at their own volition, undertaking to makeevaluations and criticism in front of the public concerned. Because of this, they have to be moretolerant with respect to expressions of opinion, which affect or qualify them, or attack them in theirperson while discussing public affairs. {3145/2018 (V. 7.) Constitutional Court Decision Justification[48]}
The Complainants emphasized that they have always wished to separate their private life from theirlife as entrepreneurs, and although the foundation of an undertaking is voluntary, this in itself does
not mean that the owners and senior officers of the undertaking would become public actors and thefact in itself that somebody is rich is not necessarily a sufficient condition for restricting privacy, thatis just one component of being influential.
At the same time, the circumstance that […] became market leader in several countries as aconsequence of state subsidies and state or other public funding cannot be disregarded in the caseof the Complainants. The Complainants had to reckon with the fact that in the case of a successfulcompany generating great wealth, they would become active shapers of the world of business as asegment of public life, accepting the concomitant evaluations and criticisms for which they have tohave greater tolerance.

32

In the present case, it can be established that of the elements of content of the disclosures understudy, the names of the Complainants, their positions as managing directors and owners must be
regarded as data accessible on public interest grounds because of the following:-

Pursuant to Section 10(2) of the Company Transparency Act, the existing and erased dataof the list of companies are fully accessible to the public. Thus, the data in the company
documents, including the personal data, which the data subjects provide in the course ofregistration in the Trade Registry, in accordance with the purpose of the Trade Registry in
the knowledge of full disclosure are accessible to anyone. The existing and erased data of
the list of companies and the personal data in the company documents are data accessible
on public interest grounds, qualifying both as personal data and as data accessible on public
interest grounds.

-

Section 24(1) of the Company Transparency Act and - in the case of limited liability
companies, such as […] – Section 27(3) of the Company Transparency Act provide for the
mandatory content of the list of companies. The legal regulations referred to stipulate thatthe list of companies contain, among others for every company, the name of the senior officerof the company, and the name of the person authorised to represent the company, thepositions of those authorised to represent the company, and in the case of limited liability
companies, the names of the members and in the case of jointly owned business quotas, thenames of the shareholders.

-According to the preamble of the Company Transparency Act, the accessibility of data in thelist of companies also serves purposes in the public interest and the legislator deemed that
this interest overrides the interests of data subjects.

It should also be mentioned that the information disclosed in relation to […] in the publications canon the one hand be found in the reports and the website of […], and on the other hand, […] has
carried out various expansions and capacity developments using state subsidies, which is data
accessible on public interest grounds pursuant to Section 5(1)-(2) of the State Assets Act, andSection 27(3) of the Privacy Act.
III.3. The lawfulness of data processing
The subject matter of this case is not a general analysis of economic journalism for data protection
and, although the Authority makes general statements also on account of the nature andcircumstances of the case, it should be underlined that the Authority examined the data processing
acts related to the specific publications issued by the Obligee (“products”) in this procedure.
Pursuant to the provisions of the General Data Protection Regulation, a number of requirements
must be met if data processing is to be lawful.
Article 5 of the General Data Protection Regulation contains the main principles, which must be
taken into account when processing personal data and asserted throughout data processing. These
principles include, inter alia, the principles of lawfulness, fair procedure and transparency, purpose
limitation, data minimisation, accuracy and storage limitation [Article 5(1)(a)-(e)]. It follows from theprinciple of accountability [Article 5(2)] that the controller is responsible for compliance with theprinciples of data protection, and in addition, the controller must be able to demonstrate compliancewith them. Accordingly, the controller must be able to demonstrate the purpose for which heprocesses personal data and also why the processing of personal data is absolutely necessary forthis data processing purpose; moreover the controller must take all reasonable measures in orderto immediately erase or rectify personal data that are inaccurate for the purposes of processing, andthe controller has to document and keep records of the processing, so that its lawfulness can beverified subsequently.

33

The controller must have the legal grounds aligned with Article 6 of the General Data Protection
Regulation for lawful processing and must be able to demonstrate that he has processed personal
data based on the consent of the data subject, or in accordance with a legal regulation, or that theprocessing was necessary for the enforcement of the legitimate interests of the controller or a third
party, and that the processing restricted the right of the data subject in proportion to the protectionof their personal data.
There is no doubt that the names and the data related to the financial position of the Complainantsqualify as their personal data, but in view of their activities related to the company they hold, theirdata in the Trade Registry are data accessible on public interest grounds, together with the company
data according Section 10(1) of the Company Transparency Act.
Naturally, the quality of the data in question as company data does not mean that the data in theTrade Registry could be used in any circle: they can be used while respecting the principle of purpose
limitation based on the appropriate legal grounds and to guarantee the right to informational selfdetermination, while appropriately ensuring the rights of the data subject.
According to the statement of the Obligee, the purpose of processing was to exercise the rights
arising from the freedom of the press and fulfilment of the mission of the press to provide information
in a democratic society. Another purpose of the Obligee was to provide information to the Hungarianbusiness community about the owners behind the largest Hungarian-owned companies, contributing
to the transparency and traceability of business life. In addition, the Obligee regards thereinforcement of Hungarian entrepreneurial culture as its tasks through reporting about the activities
of successful Hungarian entrepreneurs and the compilation of the annual rich list serves this purposein part.
The Obligee linked […] to the “[…] family” in the publications. According to the position taken by the
Authority, it follows from the context of the publications that the word “family” should be interpreted
as a synonym to family undertaking, and although there is no legal definition of a family undertaking
in Hungary, according to interpretation by the profession, business organisations, whose majority
control is concentrated in the hands of a family or families, family members with common lineage,
so that control is enforced through the strategic and/or operative activities and decisions of at least
two owners and/or senior officer family members, qualify as family undertakings or businessorganisations under the control of a family, irrespective of their size and profits.
Of the Complainants only […] was named in the case of Processing 2, and albeit in the case ofProcessing 1 it was stated that […] generations of the family have an interest in the businessactivities, the publications did not name any other family members whether specifically or byindirectly referring to them. Based on information in the Trade Registry, it is unambiguous which
members of the […] family belong to this circle of persons.
Consequently, the position of the Complainants, according to which the “[…] family” would beinaccurate personal data, because it refers to every family member, including minor children, isincorrect. Neither the printed, nor the on-line version of the lists contains any direct or indirectreference to minor children, hence the Obligee does not process any data related to the minor
members of the family, and such data cannot be found in the list of companies either. It follows thatthe minor members of the […] family cannot be regarded as data subjects of Processing 1 andProcessing 2.
It should also be taken into account that the Forbes magazine is a press product containing articles
and compilations on economic and business subject matter, thus according to the position of the
Authority, disclosure and dissemination of data and information stemming from registries accessible
to anyone and from the public disclosures and reports of the companies themselves does not infringe
the principle of purpose limitation.

34

It should also be underlined that the estimation of assets stemming from economic activities and of
the value of a business organisation using a specific method is unambiguously subject to thefreedom of expression. The Obligee collected data from various public sources to make theestimates and then evaluated these data based on a specific methodology.
In the case of Processing 1, the following methodological description can be found in both the printed
and the on-line versions:“We considered the undertakings where the owners and the senior managers are blood relatives
as family undertakings (that is, companies owned by spouses were not taken into account, if
other relatives were not members of the management team). The companies were evaluatedbased on the American Forbes methodology. Wherever possible, we calculated on an EBITDA
basis, as this is best suited to demonstrate the cash generating capabilities of the companies.
We used industry multipliers and the liabilities of the company were deducted from the value
obtained this way and we added the cash.
In all cases, we worked from information accessible to the public; wherever possible, we usedconsolidated data, where they were not available, we ourselves consolidated results based onaccessible information. The collections of Bisnode PartnerControl helped us in our work, while
the staff members of Concorde MB Partners advised us on company evaluation.”In the case of Processing 2, the following methodological description can be found in the printed andthe on-line versions:“Company evaluation was based on the methodology of our American parent. Wherever
possible, we calculated on an EBITDA basis, and took the Trade Registry data into account. In
accordance with international company evaluation practice, we applied industry multipliers.
Here, we used the list of Aswath Damodaran, professor at New York University as our point of
departure, but together with experts in company evaluation and our sister papers in theregion we tailored the multipliers to the region, and to the Hungarian market, where this wasnecessary. We added the cash available to the company to the value obtained in this way anddeducted credits (in the case of the larger holdings, we always based our calculations on the
consolidated report).
In the case of real estate, asset management or financial undertakings, we studied the assets
accumulated in the companies (the value of real property, assets and investments) and took all
the liabilities into account in accordance with the methodology of the American Forbes.
We deducted taxes from dividends, and wherever we could, we assessed the financing
requirements of the other interests of the billionaires and deducted those too from the dividends,
and we included a part of the dividends of past years. We always worked from data accessible
to the public.
We always based our calculations on most recent accessible data for most – non-public companies, this means the annual reports submitted for the business year from 1 January 2018
to 31 December 2018, In the case of shares, we made calculations with the most recent data.
The asset estimation was closed on 10 December 2019.
Bisnode PartnerControl assisted us in collecting the data. M&A experts of consulting firms
helped us in the evaluation of the companies.
A methodology description similar to the above can be found in all the similar publications of Forbes(both in the printed and the on-line versions). In addition, based on the statements and the
documents sent to the Authority, it can be established that the Obligee sent the asset or value
estimates produced on the basis of the methodology to the Complainants in every case at the timeof compiling the relevant lists, but before issuing the publications, and in each case they requested
them to provide feedback and if necessary, a rectification of the data. (Correspondence between the
Complainants and the Obligee were presented in detail under Section III.4. in relation to the rightsof the data subject.)35

It follows from this that the statement of the Complainants that they did not know what logic theForbes journalists used to analyse the data is not true.
Without indicating it specifically, the Obligee essentially referred to Article 6(1)(e) of the General
Data Protection Regulation as the legal ground of data processing and specifically indicated Article
6(1)(f) of the General Data Protection Regulation. The Obligee justified this by stating its position,
namely that the activity carried out by the Obligee, i.e. economic journalism and within this, theregular collection of information about the richest persons who also have the largest (or greater than
average) influence on society based on data accessible to the public and the evaluation,interpretation and archiving of the data and information are activities serving the public interest, andthat [...] has received substantial state subsidies, which in itself warrants the presentation of theowner behind the investments to the citizens (the readers).
Furthermore, the Obligee referred to Hungary’s Fundamental Law, which in addition to the right tothe protection of personal data also protects the transparency of data in the public interest, as wellas the freedom and diversity of the press as well as to Section 10 of the Freedom of the Press Act,
Article 85 of the General Data Protection Regulation and decisions brought by the Constitutional
Court in cases expressly related to data processing by the press and the exercise of the freedom of
the press, or the freedom of expression.
Hungary’s Fundamental Law names the right to the protection of personal data, the freedom of thepress and the freedom of expression among the fundamental rights, thus the enforcement of thefreedom of the press and the freedom of expression as constitutional fundamental rights must be
implemented together with the protection of the constitutional fundamental right linked to theprotection of personal data.
In its decision on issues of media law 165/2011. (XII. 20.) AB, the Constitutional Court summarised
its approach to the foundations of the freedom of speech and of the press, and beside the freedomof expression, it underlined the importance of forming democratic public opinion by the citizens. In
its decision, the Constitutional Court stated that “the freedom of expression equally serves thefulfilment of individual autonomy and the possibility of creating and maintaining democratic public
opinion on the part of the community. [...] The press is the institution of the freedom of speech. Thus,
freedom of the press, if it serves the free expression of speech, communication and opinion, its
protection is also has a dual definition: in addition to the subjective legal nature on the part of thecommunity it served the creation and maintenance of democratic public opinion. [...] By exercising
the right to the freedom of the press, the holder of the fundamental right is an active shaper of
democratic public opinion. In this capacity, the press controls the activities of the actors andinstitutions of public life and the process of decision-making and provides information on these to
the political community, the democratic public (the »watchdog« role).”In case C-73/07 referred to the court for a preliminary ruling in case Tietosuojavaltuutettu v.
Satakunnan Markkinapörssi Oy and Satamedia Oy, CJEU dealt with the notion of journalistic activity
pursuant to Article 9 of Directive 95/46/EC of the European Parliament and of the Council of 24
October 1995 on the protection of individuals with regard to the processing of personal data and on
the free movement of such data - which was replaced by Article 85 of the General Data Protection
Regulation - and in its judgment of 16 December 2008 declared the following:- “In order to take account of the importance of the right to freedom of expression in every
democratic society, it is necessary first to interpret notions relating to that freedom, such as
journalism broadly. Secondly, and in order to achieve a balance between the two
fundamental rights, the protection of the fundamental right to privacy requires that the
derogations and limitation in relation to the protection of data [...] must apply only insofar as
is strictly necessary.” [CJEU, C-73/07. case, Judgment paragraph 56.]

36

-

-

-

“The exemptions and derogations provided for in Article 9 of the Directive apply not only tomedia undertakings, but also to every person engaged in journalism.” [CJEU, C-73/07. case
Judgment paragraph 58.]
“The fact that the publication of data within the public domain is done for profit-making
purposes does not prima facie precludes such publication being considered as an activity
undertaken solely for journalistic purposes. [...] A degree of commercial success may evenbe essential to professional journalistic activity.” [CJEU, C-73/07. case, Judgment paragraph59.]“[...] Activities relating to data from documents, which are in the public domain under national
legislation may be classified as journalistic activities, if their object is the disclosure to the
public of information, opinion or ideas, irrespective of the medium which is used to transmit
them. They are not limited to media undertakings and may be undertaken for profit-making
purposes.” [CJEU, C-73/07. case, Judgment paragraph 61.]

CJEU repeated the statements in its judgment brought in case C-345/17 for a preliminary ruling in
the case Sergej Buivids v. Datu valsts inspekcija of 14 February 2019:- “The Court has already held that in order to take account of the importance of the right tofreedom of expression in every democratic society, it is necessary to interpret notions relating
to that freedom, such as journalism broadly (see to that effect: Judgment of 16 December
2008 Satakunnan Markkinapörssi and Satamedia, C-73/07, EU:C:2008:727, paragraph 56.)”[CJEU, C-345/17. case, Judgment paragraph 51.]
- “Thus, it is apparent from the legislative history of Directive 95/46/EC that the exemptions
and derogations provided for in Article 9 of the Directive apply not only to media undertakings,
but also to every person engaged in journalism (see to that effect: Judgment of 16 December
2008 Satakunnan Markkinapörssi and Satamedia, C-73/07, EU:C:2008:727, paragraph 58.)”[CJEU, C-345/17. case, Judgment paragraph 52.]
- “The case-law of the Court reveals that “journalistic activities” are the activities, whose
purpose is to make information, opinions or ideas accessible to the public, irrespective of themode of disclosure (see in that sense: Judgment of 16 December 2008 Satakunnan
Markkinapörssi and Satamedia, C-73/07, EU:C:2008:727, paragraph 61.)” [CJEU, C-345/17.
case, Judgment paragraph 53.]
Recital (153) of the General Data Protection Regulation also declares that in order to take accountof the importance of the right to freedom of expression in every democratic society, it is necessary
to interpret notions relating to that freedom, such as journalism broadly.
The processing of (personal) data stemming from databases in the public domain, thecommunications and reports of business organisations themselves, activities related to theevaluation of the collected data based on a specific methodology and newly generated data
stemming from value estimation are linked to the journalistic activity of the Obligee. The fact that the
publication of these data is (also) tied to the purpose of making a profit does not exclude thepossibility of regarding it as an activity pursued for the purposes of journalism.
The European Court of Human Rights (hereinafter: ECHR) has a wealth of experience in thedevelopment of specific measures applicable to the possibility of restricting expressions of opinion
made in the course of discussing public affairs. ECHR’s practice made it unambiguous that theincreased protection of opinion expressed in relation to public affairs is not limited to political
discussions taken stricto sensu and politicians. On the one hand, above and beyond debates of party
politics, the right to express an opinion guaranteed by the European Convention on Human Rights
protects also the freedom to discuss other issues related to the community with particular force(ECHR: Thorgeirson v. Iceland, application number: 13778/88, paragraph 64., 1992., decision in
merit and on satisfaction). On the other hand, ECHR invokes the argument of outstanding
significance of discussing public affairs not only in the cases when the disputed expression refers topoliticians or official persons, but also if the given issue of public interest (also) affects private
individuals. In the latter case, the threshold of tolerance of private individuals must also be raised

37(ECHR: Bladet Tromsø and Stensaas v. Norway, application number: 21980/93, paragraph 1999.,
decision in merit and on satisfaction).
From the viewpoint of applying specific measures what has a decisive role is not in itself the statusof the person concerned, but whether or not the opinion is related to public affairs. Namely, what isof significance in relation to the free expression of opinion in relation to public affairs is not whether
the person affected by the given report is himself a professional public actor, but the issue on which
the speaker expressed his opinion and whether the communication at issue contributes to the publicdebate.
Although the role of the Complainants in business life, or the use of funds from the state or otherpublic funds, and the related fact-finding articles and reports may truly be linked to debates in public
life, the question arises whether this holds also in the case of the rich list published by the Obligee.
The “Markkinapörssi case” already referred to was also examined by ECHR {Satakunnan
Markkinapörssi Oy and Satamedia Oy v. Finland [Grand Chamber], 931/13. case, 27 June 2017.},in which decision the Court recalled the criteria of case-law, which must serve as guidelines for thenational authorities and ECHR itself, when considering the freedom of expression and the right torespecting privacy. When it is a matter of political speech or debate concerning a case in the public
interest, there is little possibility for restricting the right to learn and disclose information, “and this isa fundamental right in a democratic society”.
The derogation from the data protection rules for the purpose of journalism enables journalists tohave access to personal data, to collect and process them with a view to pursuing their journalistic
activities; however, ECHR pointed out that the fact in itself that some information is in the publicdomain does not necessarily excludes it from the protection granted by Article 8 of the European
Convention on Human Rights and the companies as professional actors of the media industry must
be aware that the exemption applicable only to journalistic activities cannot be unconditionallyapplied to the large-scale collection and disclosure of data. When weighing the rights protected by
Articles 8 and 10 of the European Convention on Human Rights against one another, ECHR pointed
out that free access to official documents (taxation information) could really facilitate the democratic
debate on issues in the public interest, but at the same time stated that the disclosure of raw data
without any analysis on a large scale was not in the public interest. The data on taxation could enablecurious members of the public to categorise individuals based on their economic situation and they
could satisfy the desire of the public for information concerning the private lives of others; this,however, cannot be regarded as facilitation of the debate on issues of public interest.
The practice of ECHR was transferred by CJEU in the “Buivids case” already referred to into EU law.
“In that connection it is apparent from that case-law that in order to balance the right to privacy andthe right to freedom of expression, the European Court of Human Rights has laid down a number of
relevant criteria, which must be taken into account, inter alia, contribution to a debate of public
interest, the degree of notoriety of the person affected, the subject of the news report, the priorconduct of the person concerned, the content, form and consequences of the publication and themanner and circumstances in which the information was obtained and its veracity (see to that effect:
Judgment of the ECHR of 27 June 2017, Satakunnan Markkinapörssi Oy and Satamedia Oy v.
Finland, CE:ECHR:2017:0627JUD000093113, 165. §). Similarly, the possibility for the controller toadopt measures to mitigate the extent of the interference with the right to privacy must be taken into
account.” [CJEU, C-345/17. case, Judgment paragraph 66.]
In its Decision IV/316/2018 declaring judgment Pfv.IV.20.884/2017/7 of the Curia null and void andin its Decision IV/316/2019 declaring judgment Pfv.IV.21.398/2017/4 of the Curia null and void, theConstitutional Court declared that (IV/1368/2018???). “as a result of the particular protection of theprivate and family life, home and relationship of the individual as set forth in Section VI. (1) of theFundamental Law, close relatives of public actors and non-public actors should also be given
particular protection. […] Curiosity and hunger for rumour of the public in itself does not justify

38

regarding an issue as being in the public interest. The right of a non-public actor to privacy can beconstitutionally restricted in the interest of the freedom of expression in a case of outstanding public
interest, also with respect to family relationships of the public actors, if informing the public is
absolutely necessary and the data made public is a specific part of the private life of the non-public
actor constituting an adequate part related to the case in the public interest.” {Constitutional Court
Decision IV/1368/2018, Justification [61]; Constitutional Court Decision IV/316/2019, Justification[54]}
Considering the above, the Authority has taken the position that absolutely no circumstanceindicates that the compilation of rich lists would be a “watchdog” type activity, and would relate tospecific debates in public life. These lists are regularly (annually) published, not related to specific
events, but to who became richer and to what extent over a given period, irrespective of the sourceof that wealth, as the lists are compiled on the basis of a specific methodology and not on the basisof who or which undertaking benefited from state subsidies, thus the compilations include persons
and undertakings that have not benefited from state subsidies. While economic journalism could
truly have a “mission”, the “rich list” as a product is not primarily related to direct debates in public
life, but satisfy “hunger for rumour”, this is not a case of fact-finding or investigative journalism(characterising the “watchdog” type of journalism), what we have here is that the Obligee estimates
the value of undertakings or in the case of persons, the magnitude of the assets stemming from theactivities of the undertaking based on information in the public domain according to its own
methodology and then ranks the undertakings and persons based on the estimated value or assets.
Reference to economic journalism as an activity in the public interest cannot be accepted as thelegal basis of data processing for either Processing 1 or Processing 2. The reason for this is that thelegal basis according to Article 6(1)(e) of the General Data Protection Regulation may be linked to aprocessing activity related to a public duty qualified as such by legal regulation. Although economic
journalism is an activity in the public interest, but it is not a public duty (in the terminology of theGeneral Data Protection Regulation: task carried out in the public interest) as the journalist cannot
be regarded as a person performing a public duty [cf. Section 459(1) point 12 of Act C of 2012 on
the Penal Code].
In the case of Processing 1 and Processing 2 or similar “rich lists”, the Obligee does not carry out apublic duty as these lists - on account of their nature and because it is not their goal - do not provide
a thorough view of any dubious or allegedly dubious transaction.
Journalistic activity is not included among the legal grounds according to Article 6(1)(e) by theGeneral Data Protection Regulation either. This is supported by the fact that Article 17(3)(b) exactly
follows the terms used in Article 6(1)(e) [or rather the EU legislator essentially combined the legal
grounds according to Article 6(1)(c) and (e), which are in any case close to one another in Article
17(3)(b)]. It is, however, not this point but Article 17(3)(a) that contains the possibility to waive theerasure of data in relation to the right of freedom of expression.
It follows from all this that Processing 1 and Processing 2, the similar “rich lists” and in general all
the data processing related to economic journalism not based on consent may be carried out on thelegal basis of legitimate interest according to Article 6(1)(f) of the General Data Protection
Regulation.
In its statements made in the course of the procedure, the Obligee referred also to the legal groundsof legitimate interest.
Pursuant to Recital (47) of the General Data Protection Regulation, if the legal basis of dataprocessing is legitimate interest, an assessment of interest must be carried out in advance todetermine, among others, legitimate interest, the impact on the data subject, whether dataprocessing is necessary and proportionate, and it has to be considered whether the legitimate
interest overrides the rights of the data subject.

39This means that data processing based on legitimate interest may be carried out only, if the controller
carries out the interest assessment test in advance and as a result of the test, the legitimate interestof the controller or a third party overrides the disadvantages that may be sustained by the data
subject in relation to the data processing.
The interest assessment test is a three-step process, in the course of which it is necessary to identify
the legitimate interest of the controller, the interest of the data subject constituting the counterpointof weighing, and the fundamental rights concerned, and finally, based on the weighing, it isnecessary to establish whether the personal data can be processed. Based on all this, the reference
to Article 6(1)(f) of the General Data Protection Regulation can be appropriate and thus the dataprocessing can be lawful, if the conclusion of the interest assessment test is that the legitimate
interest of the controller or of a third party overrides the legitimate interest of the data subject, hisright to the protection of personal data and the restriction of the rights of the data subject is
proportionate to the legitimate interest of the controller or a third party enforced through thisrestriction.
In the course of this interest assessment, the controller has to consider, inter alia, whether the data
subject is a public actor (if so, this reinforces the interest of the controller in data processing), andwhether the journalistic activity at issue is of an investigative nature (this would again reinforce theinterest in data processing), or it only serves the satisfaction of a hunger for rumour (in this case theinterest in protecting personal data is stronger). Also, the interest assessment is successful, if thegiven article is about subsidies paid from public funds and otherwise contains data accessible on
public interest grounds (e.g. company data).
Based on the principle of accountability, the interest assessment test has to be appropriately
documented and the data subjects have to be properly informed pursuant to the General Data
Protection Regulation about the legitimate interest of the controller, irrespective of whether the
personal data are collected from the data subjects [Article 13(1)(d)], or they were not obtained fromthem [Article 14(2)(b)].
In its statements made in the course of the procedure, the Obligee expounded its position andarguments for the existence of its own legitimate interests and those of a third party (the public) andfor restricting the rights and interests of the Complainants; this, however, does not meet therequirements related to interest assessment according to Recital (47) of the General Data Protection
Regulation. The Obligee carried out the interest assessment improperly, and - as detailed in Section
III.4 of the Decision - failed to provide appropriate preliminary information in relation to this to theComplainants and informed the Complainants of its position only in its responses sent to the legal
representative of the Complainants.
In relation to the interest assessment, it should be underlined that there is no way makegeneralizations as to what extent and from what point of view data processing may have a
detrimental impact on a data subject, because data subjects and their circumstances are different inevery case, hence this is a subjective value judgment, which means that the same data processing,which one data subject may regard as acceptable in a case can be regarded as detrimental byanother data subject in a different case.
The freedom of information and the right to informational self-determination must be enforced
respecting each other, thus it has to be considered whether the publicity of the data
disproportionately violates the right to privacy. In the present case, it can, however, be establishedthat the processing carried out by the Obligee and the content of the public communications basedon them were related not to the private or family lives of the Complainants, but to the activities of theundertaking they had interests in and to the economic results derived from that. It can be clearly
established that the data processed within this range and the communications had to deal withresults achieved by the Complainants in economic and business life and not to their family or private

40

lives.
In view of the fact that the compilations were based on the personal data of the Complainants
accessible to anyone on public interest grounds on the estimated amount of the assets arising from
economic activities and the estimated value of the undertaking, and beyond these, they did notcontain additional personal data, moreover, the content of the entries were based on the reports andpublic communications of [...], the processing does not exceed the necessary and proportionate
extent and the archiving of the lists is compatible with the original purpose of processing, theAuthority established that the Obligee did not infringe the principles of purpose limitation, data
minimisation, accuracy and limited storage according to Article 5(1)(b), (c), (d) and (e) of the General
Data Protection Regulation with regard to either Processing 1 or Processing 2.
Based on the principle of accountability, controllers have to carry out data processing operations
throughout the entire process of processing, so as to be able to demonstrate compliance with thedata protection rules. The principle of accountability is enforced not only generally, interpreted at thelevel of the process, but also in relation to every specific data processing activity, the processing of
the personal data of any specific data subject.
According to the Authority, the legitimate interest indicated by the Obligee is acceptable for both
Processing 1 and Processing 2, however, the Obligee by not carrying out the interest assessment
appropriately, and by failing to inform the Complainants of the legitimate interest of the public and of
the result of comparing these interests with those of the Complainants in advance, infringed Article
6(1)(f) of the General Data Protection Regulation, as well as the principle of accountability according
to Article 5(2) with regard to both Processing 1 and Processing 2.
III.4. The rights of the data subjects and the restrictions of exercising these rights
In relation to data subjects rights, the Complainants requested the Authority in their petition toestablish the fact of unlawful processing with regard to both Processing 1 and Processing 2 on the
grounds of infringement of Article 13(2)(f), Article 14(2)(g), Article 14(1)-(2), Article 15(1)(h), andArticle 21(1) of the General Data Protection Regulation, and to order the restriction of the personal
data pursuant to Article 18(1)(a) and (d) and then the erasure of the personal data in accordancewith Article 17(1)(c).
Naturally, the duality detailed above - according to which certain personal data are also company
data accessible on public interest grounds - cannot mean that because of this circumstance the data
subject would fully lose their right to self-determination with regard to these data and that theaccessibility of the personal data to the public would be concomitant with fully losing the right toprivacy without restriction.
Article 12 of the General Data Protection Regulation sets forth the obligations of the controller related
to measures concerning the exercise of the rights of the data subjects (including the right to being
informed, to object and to erase).
Based on the statements and the available documents, the following correspondence took place
between the Complainants (or rather their legal representative) and the Obligee (or rather its
journalists) during the period under study.
-

The journalist employed by the Obligee contacted the undertaking linked to the Complainants
by way of an e-mail on 16 August 2019 concerning Processing 1; a short description of themethodology used to produce the compilation was attached to this letter as follows:“Company evaluation was based on the methodology of our American parent. Wherever
possible, we calculated on an EBITDA basis, and took the Trade Registry data into
account. In accordance with international company evaluation practice, we applied
industry multipliers. Here we used the list of Aswath Damodaran, a professor at New

41

York University, as our point of departure, but together with Hungarian experts incompany evaluation and our sister papers in the region we tailored the multipliers to theregion, and to the Hungarian market, where this was necessary. We added the cash
available to the company to the value obtained in this way and deducted credits. Ourdetailed calculation is attached in an excel file.”
In addition to the methodological description, another attachment to the e-mail was also sentin the form of an excel table, containing the calculation (estimate) based on the data of […].
Based on the above, it can be established that in contrast to their allegation, theComplainants were notified of the fact that Obligee intended to include […] in the Forbes list
containing the most valuable family undertakings not on 26 August 2019, but on 16 August
2019. Following the journalist’s e-mail, the following correspondence took place between […]and the Obligee in the period between 22-26 August 2019.
• On 22 August 2019 - in response to an e-mail not known to the Authority - Obligee
informed the person taking action as a representative of […] (and the Complainants)that the list for each entity will include the company name and the family name, andthe entry will include the owners shown in the company registration just as at the time
when […] was last included in this list.
• On 26 August 2019 […] requested the Obligee to waive the reference to […] and […]family in relation to Processing 1, similarly to previous years, and not to use thephrase “[…] family” in any compilation.
• In its response sent on 26 August 2019 the Obligee provided the information that inearlier years […] was not included in the Forbes family undertakings lists because
based on the data of the given year and our estimates made on their basis they were
not among the 25 largest companies in their opinion. Three years ago, the family andthe company were included in the list for that year, because according to thecalculations made at the time, they were among the 25 largest companies. […] wasshown in other Forbes lists in preceding years, for instance in the ranking of the 100
largest Hungarian owned private companies, then mention of the family was waived
because that was not warranted.
-

In their letter of 30 august 2019, the Complainants turned to the Obligee with a request to
exercise their rights as data subjects extending to the right of receiving information inadvance in accordance with Article 14, the right to access according Article 15, the right torectification according to Article 16 (with regard to the phrase “[…] family”), and the right toobject according to Article 21 of the General Data Protection Regulation. In the request aimed
at exercising the right to object, the Complainants did not explain the reasons for objectingwith sufficient detail, all they indicated was that in their view, there was no compelling lawful
reason on the basis of which the Obligee would be entitled to process their personal data.

-

In its answer to the request to exercise data subject’s rights, the Obligee• indicated the purpose of processing (informing the public, exercising the right to thefreedom of the press), the categories of personal data (names of the owners, theirmothers’ name, names of senior officers) and the sources of the personal data andthe data related to the results of […] (data accessible in the company database,reports downloaded from the website e-beszamolo.im.gov.hu and earlier statements
and public communications of […]);• provided information on the fact that although they do consult external experts, butthey only reconcile the industry multipliers with them, the external experts see thespecific estimates made only in exceptional cases and personal reconciliation isneeded, but the Obligee does not hand over data in the course of personalreconciliations, only the company name, the balance sheet data used for theestimates, the multiplier and the end result of the estimate are shared with them, sucha reconciliation, however, never took place in the case of […] or any other holdingsof the […] family;

42

•

•

•

specified the staff members participating in producing the list, who process the data,
underlining that the intern indicated among the authors of the list did not have accessto the database created when preparing the list, thus he could not see the data of […]and he carried out his work on the basis of the internship contract supplemented witha confidentiality clause;
in relation to the period of processing, provided information on the fact that theaccessible company data were used to check the criteria of a family undertaking;these, however, were not recorded by the Obligee, the data needed for making theestimates were used to produce the list, and they were erased once the work wascompleted;finally, Obligee also indicated that the magazine displayed the name of […] and of thefamily exercising control (without separately mentioning any family member) and theestimated company value; the same data were shown in the Forbes.hu website wherean abstract of the list was published.

-

In November 2019 (according to the statement of the Complainants: on 6 November,according to the statement of the Obligee: on 14 November - the exact date is not known to
the Authority), Obligee contacted the Complainants (as to who exactly is not revealed fromthe statements and documents received by the Authority) in relation to Processing 2 by email to which a short description of the methodology used for producing the compilation was
attaches as follows:“Company evaluation was based on the methodology of our American parent. Wherever
possible, we calculated on an EBITDA basis, and took the Trade Registry data into
account. In accordance with international company evaluation practice, we applied
industry multipliers. Here we used the list of Aswath Damodaran, a professor at New
York University, as our point of departure, but together with Hungarian experts incompany evaluation and our sister papers in the region we tailored the multipliers to theregion, and to the Hungarian market, where this was necessary. We added the cash
available to the company to the value obtained in this way and deducted credits. The
above methodology can best be used in the case of manufacturing companies. In thecase of financial service providers or property developers, we also act on the basis of
the guidance of our parent magazine: here our point of departure is the value
accumulated in the undertaking (largely assets) and deduct all the liabilities. Our detailed
calculation is attached in an excel file.”
In addition to the methodological description, another attachment to the e-mail was also sentin the form of an excel table, containing the calculation (estimate) based on business data.

-

In the cease and desist letter sent by their attorney on 15 November 2019 to the Obligee, theComplainants strongly objected to the data processing carried out by the Obligee affecting
the Complainants on the basis of Article 21 of the General Data Protection Regulation andprohibited their access to any personal data concerning them, to collect their data or carryout any other data processing activity, including publication. They also prohibited theirpresentation of the Complainants in the issue directly or indirectly, whether by name orreference to family, and called upon the Obligee to immediately erase the personal data of
the Complainants and refrain from any kind of data processing operation in relation to them.
Pursuant to Article 18(1)(a) and (d) of the General Data Protection Regulation, theComplainants also requested the restriction of processing and emphatically called upon the
Obligee to refrain from the disclosure of data concerning the Complainants until theclarification of the circumstances specified under Article 18(1)(a) and (d) of the General Data
Protection Regulation and as a result of their objection also beyond it. The Complainants also
called the attention of the Obligee to the fact that the conclusion drawn from the data in theTrade Registry concerning the financial position of the Complainants and their family was
inaccurate or false as the data concerning the financial situation of the Complainantssignificantly differ from the actual data, which is also verified by a notarial deed. In the request
aimed at exercising their right to object, the Complainants again failed to explain the reasons

43

for their objection with sufficient detail, all they indicated was that according to their position,
the data processing was severely detrimental with respect to the rights and legitimate interestof the Complainants.
-

In its response of 20 November 2019, the Obligee• indicated Article 6(1)(f) as the legal basis of data processing, justified by the fact thatan economic magazine such as Forbes has a legitimate interest in informing the
public about Hungarian entrepreneurs and also referred to the state subsidy used by[...] and its participation in the bond programme of the Magyar Nemzeti Bank;• with respect to the accuracy of personal data, Obligee requested a recommendation
for modifying the name;• in relation to the deviation from actual data, the Obligee noted that one of theobjectives of the e-mail sent earlier was to enable the Complainants to give an opinion
on the value estimate indicating that they would take any data and results aimed at
rectification into account when making the estimates, provided that it is professionallywarranted and acceptable; the Obligee also noted that the approximate estimates
made on the basis of their professional opinion were based on the indicators of thebusiness year closed on 31 December 2018, which were accessible to the public, andinformed the Complainants that if there was any business decision or any othercircumstance, which would influence their evaluation, the Obligee would consider
taking that into account, or reconcile this with the Complainants;• the Obligee indicated informing the public and exercising the right to the freedom of
the press as the purpose of compiling and publishing the list; according to the Obligee,
presenting the mode the companies (and their owners) securing contracts andreceiving subsidies from the state or other public funds use these funds is relevant
information for the Hungarian business community on the one hand, and constitutes
important information in the public interest for taxpayers on the other hand;• indicated the categories of personal data (names of the owners) and the sources ofthe personal data and the data related to the results of […] (data accessible in thecompany database, reports downloaded from the website e-beszamolo.im.gov.hu
and earlier statements and public communications of […]); the entry on […] did notdescribe in detail what other items of property are in the hands of the family;• provided information on the fact that although the Obligee consults external experts,
but they only reconcile the industry multipliers with them, the external experts see thespecific estimates made only in exceptional cases if personal reconciliation is held,
but the Obligee does not hand over data in the course of personal reconciliations,only the company name, the balance sheet data used for the estimates, the multiplierand the end result of the estimate are shared with them, such a reconciliation,
however, never took place in the case of […] or any other holdings of the […] family;• specified the employees participating in compiling the list and processing the data;• in relation to the duration of data processing, the Obligee provided the informationthat the data needed for the estimates are used until the list is compiled and areerased upon completion.

Articles 13-14 of the General Data Protection Regulation set forth a minimum of the data processing
circumstances of which the controller has to notify the data subjects, depending on the fact whether
the personal data were collected from the data subjects or obtained from others. In view of the factthat the Obligee collected the data used for compiling the lists not directly from the Complainants,
but used information available in various public databases, reports and the public communicationsof [...], the obligation of the Obligee to provide information in advance is governed by the provisionsof Article 14 of the General Data Protection Regulation. Consequently, Article 13 of the General Data
Protection Regulation – which specifies the minimum information the controller has to provide to the44data subjects if the personal data are collected from the data subjects - is not relevant in the current
case, hence its infringement alleged by the Complainants could not be established.
Of the publications studied in the course of the procedure (Processing 1 and Processing 2), it canbe stated that as they are periodically published on the one hand, and based on the methodology
used, the Obligee can exactly determine whom it wishes to present in the current list or publication(which means practically profiling), it is the obligation of the Obligee according to the General Data
Protection Regulation to provide information in advance to this relatively narrow range of persons
covering the circumstances of processing according to Article 14(1)-(2) of the General Data
Protection Regulation, paying particular attention to- the purpose and legal basis of processing,- the categories of personal data concerned,- in the case of processing based on Article 6(1)(f) of the General Data Protection Regulation,
the legitimate interest of the controller or a third party,- the rights due to the data subject (rectification, erasure, restriction of processing, objection),- the right of the data subject to lodge a complaint,- the source of the personal data and whether the data stem from sources accessible to the
public,- the significance of profiling and its possible consequences to the data subjects.
Although it can be established that the Obligee (through its journalists) always contacted theComplainants prior to the publication of the lists, and informed them that the Obligee wished toinclude them in the given list, and sent them a short description of the methodology applied, as wellas the excel table containing the value or asset estimates made on the basis of the methodology,
and enabled the Complainants to make observations and if necessary, to rectify the data, the Obligee
did not meet the requirement of providing information in advance appropriately because it failed toprovide information on the purpose and legal basis of data processing, the legitimate interest of thecontroller or a third party and the results of the interest assessment, the expected consequences of
profiling, all the rights due to the Complainants as data subjects and the Complainants’ right to lodge
a complaint.
As the information provided by the Obligee in advance to the Complainants was inadequate, theAuthority establishes that the Obligee infringed Article 14 of the General Data Protection Regulation.
Pursuant to Recital (60) of the General Data Protection Regulation, the principle of transparent andfair processing requires that the data subject receive information on the fact and purposes ofprocessing and all information necessary for ensuring fair and transparent processing, taking into
account the specific circumstances and context of processing the personal data.
Guideline WP 260 concerning transparency facilitating the application and interpretation of theGeneral Data Protection Regulation - which was adopted by the Data Protection Working Party
established on the basis of Article 29 of Directive 95/46/EC, the legal predecessor of the European
Data Protection Body (hereinafter: EDPB), which EDPB continued to uphold even after the entry into
force of the General Data Protection Regulation - sets forth in the Annex on the information to bemade available to data subjects pursuant to Articles 13 and 14 of the General Data Protection
Regulation that “[...] the information provided to data subjects must make it clear that upon request,
they can receive information on the interest assessment test. This is indispensable for efficienttransparency, if the data subjects have doubts concerning whether the interest assessment test wasfair or if they wish to lodge a complaint with the supervisory authority.”
As the Obligee met this requirement inadequately, the Authority establishes that the Obligee
infringed the principle of transparency according to Article 5(1)(a) of the General Data Protection
Regulation with regard to both Processing 1 and Processing 2.

45

A distinction must be made between the information provided in advance according to Articles 1314 and the information provided upon the request of the data subject pursuant to Article 15 of theGeneral Data Protection Regulation. While information according to Articles 13-14 is intended toprovide a general, comprehensive view of the processing of the personal data of the data subject,
the purpose of the right to access according to Article 15 is expressly to enable the data subject toreceive information specifically on the processing of his or her own personal data with a view toestablishing and checking the lawfulness of processing.
To enable the exercise of the right to access, the controller has to make the information available tothe data subject according to Article 15(1) of the General Data Protection Regulation. In its
responses to the requests of the Complainants made in order to exercise their right to access, theObligee indicated the purpose of processing, the categories of personal data, the source of the data,
the staff members participating in compiling the lists and also provided the information that the dataneeded for the estimation were erased once the given list was compiled. Furthermore, with regard
to Processing 2, the Obligee indicated the legal basis of processing [Article 6(1)(f) of the General
Data Protection Regulation]. It can be established that the responses of the Obligee to the requestsof the Complainants made in order to exercise their right to access do not fully comply with Article
15(1) of the General Data Protection Regulation because the Obligee failed to provide informationin its responses on the expected consequences of profiling and all the rights of data subjects due tothe Complainants or the right of the Complainants to lodge a complaint.
As the Obligee failed to provide the appropriate information in relation to the Complainants’ request
aimed at the exercise of their right to access, the Authority establishes that the Obligee infringed
Article 15 of the General Data Protection Regulation.
In the event that the processing is in the public interest, or it is done on the basis of the legitimate
interest of the controller or a third party, the data subjects may object to the processing of theirpersonal data based on Article 21 of the General Data Protection Regulation. In this case, thecontroller may not continue the processing of the personal data, except if the controller demonstrates
that processing is justified by legitimate reasons of compelling force, which override the interests,
rights and freedoms of the data subjects, or which relate to the establishment, exercise or defenceof legal claims.
Pursuant to Article 21(4) of the General Data Protection Regulation, the controller must direct theattention of the data subject explicitly to the right to object at the time of its first communication withthe data subject at the latest and this information has to be presented clearly and separately fromany other information.
In view of the fact that in the course of the first communication with the Complainants in relation to
Processing 1 and Processing 2, the Obligee failed to direct the attention of the Complainants to theright to object and this information was not presented clearly and separately from any otherinformation, the Obligee failed to meet its obligation according to Article 21(4) of the General Data
Protection Regulation.
This is significant because pursuant to Article 21(1) of the General Data Protection Regulation, theComplainant may object to the processing of his or her personal data based on Article 6(1)(e) and(f) of the General Data Protection Regulation, but he can exercise this right only if properly informed.
In this case, the result of the objection is not automatic, it depends on the process of assessing
interests, the controller has to demonstrate after such a request is received that the legitimate
interest of compelling force arising on the controller’s side override the rights and freedoms of thedata subject.
If the data subject objects to processing - for instance the publication of an article containing his
personal data - the controller may not continue the processing of the personal data, except if thecontroller demonstrates that processing is warranted by legitimate reasons of compelling force

46

overriding the interests, rights and freedoms of the data subject. The controller must carry out thisassessment taking into account the interests and rights of the data subject exercising his right toobject in each case.
The correspondence between the Complainants and the Obligee reveals that although theComplainants made use of their right to object with regard to both Processing 1 and Processing 2,
the specific reasons for this (namely the information related to the security situation of theComplainants and their families) were not indicated in their requests to exercise their rights as data
subjects dated 30 August 2019 and 15 November 2019; they made general references to theprovisions of the Civil Code and the Act on the Protection of Privacy instead and to their view that
the Complainants cannot be regarded as public actors. The position of the Complainants submitted
to the Authority, according to which the Forbes list of September 2019 directed the attention of
criminal circles to the family was therefore unknown to the Obligee, hence the Obligee was not, andcould not be, in possession of the information on the basis of which it could have carried out anindividual interest assessment with regard to the Complainants.
In relation to this, the Authority notes that although the examination of the allegation that theComplainants who had long since been active in business life, getting their company to the positionof market leader and their families would have attracted the attention of criminal circles as a resultof the release of the publications is not within the competence and powers of the Authority, but the
Authority shares the position of the Obligee according to which it is not verified that the action of thecriminals would be the (exclusive) consequence of the release of the publication.
In view of the above, the Authority establishes that the Obligee did not commit an infringement when
following the objection by the Complainants, it did not carry out an individual interest assessment.
Nevertheless, with regard to the objection, the circumstance brought up by the Complainants (butnot disclosed to the Obligee) may have relevance with regard to subsequent processing by the
Obligee, namely in relation to the consideration of “reason related to the situation” of the data subject,
and the contrasting “legitimate reason of compelling force”. In order, however, to enable the Obligee
to perform the second individual interest assessment following the objection in an appropriatemanner, it is expected and necessary that the Complainants explain in sufficient detail why and forwhat reason they object to the processing. It should be underlined that these data can be processed
and used exclusively for the evaluation of the request to exercise the right to object and performing
the individual interest assessment.
The answers of the Obligee to the requests of the Complainants to exercise their rights as data
subjects contain the Obligee’s position related to the data processing objected to by theComplainants, in which it refers, inter alia, to the processing being in the public interest and thesubsidies granted to [...] from state or other public funds.
Nevertheless, the Obligee in its answers to the Complainants did not specifically cover theComplainants’ request to exercise the right to object and to restrict processing, it neither notified
them about the decision related to this, nor informed them about the possibilities of legal remedy
available to them, namely that they can lodge a complaint with the Authority and they may also makeuse of their right to seek legal remedy in front of the court. Pursuant to the General Data Protection
Regulation, a mandatory element of content of any decision rejecting requests aimed at the exerciseof the rights of data subjects is the information on the possibilities of the enforcement of rights. The
circumstance that the Complainants turned to the Obligee through their legal representatives andthat the general privacy statement accessible in the Forbes website includes the modes of theenforcement of rights does not exempt the Obligee from providing the necessary information. Basedon all this, the Authority establishes that the Obligee infringed Article 12(1) and (4) of the General
Data Protection Regulation.
Pursuant to the General Data Protection Regulation, data subjects shall have the right to erasure (tobe forgotten), but the Regulation also specifies the exemptions when this right cannot be enforced.

47

This includes the cases when processing is necessary for the freedom of expression and theexercise of the right to be informed [Article 17(3)(a)], or when public interest justifies the need forprocessing [Article 17(3)(b)-(d)], or if processing is necessary for the establishment, enforcementand defence of legal claims [Article 17(3)(e)].
The processing of the data related to the Complainants and the undertaking in which theComplainants have interests (including disclosure) are among the exemptions in which case theright to erasure cannot be enforced (and the request to erase personal data can be rejected lawfully)
pursuant to Article 17(3)(a) of the General Data Protection Regulation in view of the fact that theprocessing of these data is necessary to ensure the freedom of expression and the right to be
informed.
In this case, therefore, Article 17(3)(a) of the General Data Protection Regulation creates the balance
between the right to erasure and the freedom of expression and the exercise of the right to be
informed, ensuring, inter alia, the freedom of the press and in the case of the on-line versions of thelists, the freedom of the internet.
In view of the above, the Authority rejects the part of the petition of the Complainants in which theComplainants request the Authority to order the restriction of processing, the erasure of the personal
data of the Complainants and to prohibit processing by the Obligee.

III.5. The request by the Obligee to suspend the procedure
In its statement made to the call of the Authority, the Obligee requested the Authority to suspend theprocedure with reference to Section 48(1)(a) of the Administrative Procedures Act (preliminary issue
within the competence of a court) in view of the fact that there was a court procedure in progress
between the Complainants and the Obligee on the grounds of the processing of the personal dataof the Complainants, in which procedure, the court will bring the decision on whether or not theprocessing carried out by the Obligee qualifies as lawful.
The Authority waived the suspension of the procedure because of the following:- Section 38(2)-(2a) provide express tasks and powers for the Authority to investigate thelawfulness of processing and to make the decision thereon; the court procedure does not
qualify as a preliminary issue, decision on which would be absolutely necessary for enabling
the Authority to make its decision objectively and correctly, without which the decision of the
Authority would be ungrounded.
- The Administrative Procedures Act makes it clear that generally, merely on the basis of its
provisions, suspension is not called for on the grounds that the Authority is aware of anotherprocedure in progress, which could have an impact on its procedure, unless a separate legal
regulation enables suspension. The preliminary issue is not the same as the decision ofanother body may have an “impact” on the interpretation of the law by the Authority.
- Pursuant to Article 79(1) of the General Data Protection Regulation, without prejudice to any
available administrative or non-judicial remedy, including the right to lodge a complaint witha supervisory authority pursuant to Article 77, each data subject shall have the right to aneffective judicial remedy where he or she considers that his or her rights under this regulation
have been infringed as a result of processing his or her personal data in non-compliance withthis Regulation.
- The Authority makes the decision on the eventual suspension of the procedure ex officio andnot upon the request of any client participating in the procedure.

III.6. The petition of the Complainants for an interim measure and levying a fine48

Based on Section 46(b) of the Administrative Procedures Act, the Authority rejects the request of theComplainants for an interim measure in view of the fact that [...] already adjudged the petition of theComplainants for the enforcement of the same right in a civil procedure running in parallel with theprocedure of the data protection authority.
The Authority rejects the Complainants’ request for levying a data protection fine because theapplication of this legal consequence does not directly affect the rights or legitimate interests of theComplainants, for them such a decision by the Authority does not generate rights or obligations; itfollows that with regard to the application of this legal consequence within the enforcement of public
interest, i.e. levying a fine, the Complainants do not qualify as clients pursuant to Section 10(1) of
the Administrative Procedures Act. Moreover, as it fails to comply with Section 35(1) of the
Administrative Procedures Act, in this respect no request can be submitted, thus this part of thepetition cannot be interpreted as a request.

III.7. Processing prior to 25 May 2018
The Complainants complained about the lawfulness of processing with regard to the period prior toProcessing 1. It was established in the course of the procedure that in the period prior to Processing
1, the Obligee included the “[…] family” in its compilation “Largest Hungarian family undertakings”
only on one occasion in the August 2015 issue of Forbes.
This part of the petition concerns processing, which took place prior to 25 May 2018 which is thestarting day of the applicability of the General Data Protection Regulation, hence the rules of theRegulation cannot be applied. In view of this, based on Section 47(1)(a) of the Administrative
Procedures Act, the Authority terminates the procedure because this part of the petition does notcomply with the conditions in Section 60(2) of the Privacy Act because the General Data Protection
Regulation was not yet applicable in the processing period objected to. Because of this, a petition
requesting the procedure of the Data Protection Authority cannot be submitted and the Authority
does not even initiate the launching of the investigative or administrative procedure.
The fact that the Obligee collected the data related to the business undertaking, in which theComplainants have interests from databases accessible to the public and from the public disclosuresand communications of [...] also in the period from August 2015 to September 2019 cannot be
regarded as unlawful processing.

III.8. Legal consequences
The Authority partially sustains the petition of the Complainants and pursuant to Article 58(2)(b) of
the General Data Protection Regulation condemns the Obligee because its activities related toProcessing 1 and Processing 2 infringed Article 5(1)(a), Article 5(2), Article 6(1)(f), Article 12(1) and(4), Article 14, Article 15 and Article 21(4) of the General Data Protection Regulation.
Pursuant to Article 58(2)(c) of the General Data Protection Regulation, the Authority orders the
Obligee to fully meet its obligation to inform the Complainants, including the supply of information on
the criteria taken into account in the course of interest assessment and on the results of the interest
assessment (retrospectively), within 15 days from the decision becoming final.
The Authority orders the Obligee pursuant to Article 58(2)(d) of the General Data Protection
Regulation to transform its practice related to providing information in advance in accordance withthe provisions of the legal regulation in force and this decision, and to perform interest assessmentin accordance with the legal regulations and the provisions of this decision, including a second
individual interest assessment following an objection in the event that in the course of future dataprocessing activities it intends to use legitimate interest as the legal basis.

49

The Authority rejected the request by the Complainants to levy a data protection fine as describedunder Section III.6, at the same time it examined ex officio whether it is warranted to levy a dataprotection fine on the Obligee on the grounds of the infringements established. Based on Article
83(2) of the General Data Protection Regulation and Section 75/A of the Privacy Act, as stated below,
the Authority considered all the relevant circumstances of the case ex officio and established that in
the case of the infringements exposed in the course of this procedure, a warning in itself is not a
proportionate and dissuasive sanction, hence the levying of a fine is warranted.
By levying the fine, the special preventive goal of the Authority is to encourage the Obligee to conduct
its processing activities consciously, to handle data subjects not as objects and/or impeding
circumstance, but as true holders of rights and provide the information and other conditions needed
for the exercise of their rights stemming from this and the control over the processing of theirpersonal data. In general, it is necessary to make it clear to all controllers in similar situations thatthe processing of personal data requires increased awareness, they must not negligently trust thatthe data subjects will suffer no detriment as a result of the effectively uncontrolled processing of theirpersonal data. Such a behaviour disregards the rights of the data subjects and as such cannot
remain unsanctioned.
The Authority considers the practice present in the Hungarian market exemplary, according to which
the various rich lists, publications listing the richest Hungarians do not always contain the name ofthe data subject and/or an entry on the data subject, and as a result for instance of the properly
grounded objection of the data subject publish only a letter instead of the full name, and only minimal
information instead of the entry presenting the activities of the data subject (e.g. the name of thegiven industry, and the magnitude of the wealth associated with the data subject).
Another goal of the Authority by levying the fine is to encourage the Obligee to review its dataprocessing practices related to its publications listing the richest Hungarians and the largest
Hungarian family undertakings. When determining the amount of the fine levied, the Authority - inaddition to the special preventive goal - also paid attention to the general preventive goal to beachieved with the fine, with which it wishes to achieve driving the processing practice by the Obligee
in the direction of full compliance, while restraining the Obligee from another infringement.
When determining the necessity for levying the fine, the Authority considered the aggravating andmitigating circumstances of the infringements as follows:
The Authority regarded the fact that- the infringements committed by the Obligee in relation to the principles and the exercise of
the data subject’s rights qualify as infringements punishable by the higher maximum amountfine (up to EUR 20,000,000 or in the case of an undertaking up to 4% of the total worldwide
annual turnover of the preceding financial year) according to Article 83(5)(a) and (b) of theGeneral Data Protection Regulation;- the Complainants attempted to move the Obligee towards appropriate processing, butultimately the intervention of the Authority was necessary [General Data Protection
Regulation Article 83(2)(a)];- taking all the circumstances of the case into account, the infringements establishedsubstantiate a deliberate and resolute attitude of the Obligee towards processing and theexercise of data subject’s rights, i.e. they qualify as deliberate in nature [General Data
Protection Regulation Article 83(2)(b)];- in spite of the deficiencies of the processing activities related to the publications notified by
the Complainants, a business transaction was carried out (the publication listing the richest
Hungarians was published in December 2019) and the mitigation of damage sustained by
the Complainants took place only as a result of [...], in their view [General Data Protection
Regulation Article 83(2)(c)];50-

Obligee has outstanding responsibility for the lawfulness of processing and providing
transparent information on processing because of the global name recognition andacknowledgement of Forbes and its role played in the media market [General Data Protection
Regulation Article 83(2)(d)] as aggravating circumstances.

The Authority considered that the Obligee did not process personal data in the special category asa mitigating circumstance. The personal data of the Complainants in the Trade Registry are data
accessible on public interest grounds and are also company data, while the data presented in relation
to the asset or value estimates are to be regarded as conclusions drawn from the evaluation of thedata based on a specific methodology as part of the exercise of the right to the freedom of expression[General Data Protection Regulation Article 83(2)(g)].
The Authority also took into account that the Obligee cooperated with the Authority in the course of
the procedure, but as it did not go beyond compliance with legal obligations, this behaviour was notevaluated as an express mitigating circumstance [General Data Protection Regulation Article
83(2)(f)].
The Authority also took into account that although infringements related to the processing of personal
data were not established against the Obligee earlier, it also condemned the Obligee in its decision
NAIH/2020/838/2 brought in the procedure of the Authority launched under case number
NAIH/2019/7972 against the Obligee simultaneously with this decision, partially because of theinfringements established in this decision and it ordered the Obligee to carry out similar measuresand also levied a fine against it [General Data Protection Regulation Article 83(2)(e) and (i)].
In levying the fine, the Authority also reviewed the additional criteria included Article 83(2) of theGeneral Data Protection Regulation, but did not take them into account because according to its
consideration, they were not relevant to this case.
The Obligee’s annual report on the business year 1 January 2019 - 31 December 2019 was not yet
available at the time of this decision, thus the Authority took the business years 2018 and 2017 into
account when determining the fine:- Based on the report of the Obligee closing its general business year 1 January 2018 – 31
December 2018 accessible to the public, the Obligee had net sales totalling
HUF 727,702,000 (seven hundred twenty-seven million seven hundred and two thousand
forints) and closed the year with a pre-tax profit of HUF 115,194,000 (one hundred and fifteen
million one hundred and ninety-four thousand forints) after taking revenues and expenditures
into account.
- Based on the report of the Obligee closing its general business year 1 January 2017 – 31
December 2017 accessible to the public, the Obligee had net sales totalling
HUF 681,029,000 (six hundred eighty-one million twenty-nine thousand forints) and closed
the year with a pre-tax profit of HUF 156,095,000 (one hundred and fifty-six million ninetyfive thousand forints) after taking revenues and expenditures into account.
The amount of the fine does not reach 4% of the total worldwide annual turnover whether based on
net sales revenue or pre-tax profits. Based on the above, the amount of the fine levied is
proportionate to the severity of the infringement.

IV. Procedural rules
Section 38(2) and (2a) of the Privacy Act determines the powers of the Authority; its competence
covers the entire territory of the country.

51

Pursuant to Section 37(2) of the Administrative Procedures Act, the procedure is launched on the
day following the receipt of the petition by the Authority taking action. Pursuant to Section 50(1) of
the Administrative Procedures Act, unless otherwise provided by law, the period open foradministering the case begins on the day of launching the procedure.
Pursuant to Section 112(1), Section 114(1) and Section 116(1) of the Administrative Procedures Act,
legal remedy can be sought against the decision through administrative litigation.
The right to independent legal remedy against the warrant under Section II of the operative part isbased on Sections 112, 114(1), 116(1) and 116(4)(d) of the Administrative Procedures Act.
***
Pursuant to Section 6:48(1) of the Civil Code, in the event of a cash debt the Obligee shall pay a
penalty for delay from the first day of the delay at a rate corresponding to the base rate quoted by
the central bank on the first day of the calendar half year affected by the delay.
The rules of administrative litigation are set forth in Act I of 2017 on Procedures in Administrative
Litigation (hereinafter: Administrative Litigation Procedures Act). Pursuant to Section 12(1) of the
Administrative Litigation Procedures Act, an administrative litigation against the decision of the
Authority is within the jurisdiction of a tribunal and pursuant to Section 13(3)(a)(aa) the Fővárosi
Törvényszék (Budapest Tribunal) has exclusive competence for the litigation. Pursuant to Section
27(1)(b) of the Administrative Litigation Procedures Act, legal representation is mandatory in lawsuits
subject to the jurisdiction of a tribunal. Pursuant to Section 39(6) of the Administrative Litigation
Procedures Act, the submission of the petition does not have a delaying effect on the entry into forceof the decision.
Pursuant to 29(1) of the Administrative Litigation Procedures Act and - in view of this - Section 9(1)(b)of Act CCXII of 2015 on the General Rules for Electronic Administration and Fiduciary Services(hereinafter: e-administration Act), applicable according to Section 604 of the Civil Procedures Act,the legal representative of the client must communicate electronically.
Section 39(1) of the Administrative Litigation Procedures Act specifies the time and place ofsubmitting a petition against the decision of the Authority. Information on the possibility of a request
for holding a hearing is based on Section 77(1)-(2) of the Administrative Litigation Procedures Act.
Section 45/A(1) of Act XCIII of 1990 on Levies (hereinafter: Levies Act) determines the magnitudeof the levy on administrative litigations. Section 59(1) and Section 62(1)(h) exempts the party
initiating the procedure from paying the levy in advance.
Pursuant to Section 135(1)(a) of the Administrative Procedures Act, Obligee shall pay a penalty fordelay at a rate corresponding to the legal rate if he fails to meet its payment obligations when due.
If the Obligee fails to verify meeting of a prescribed obligation, the Authority shall deem that the
obligation was not complied with when due. Pursuant to Section 132 of the Administrative
Procedures Act, if the Obligee fails to meet its obligations incorporated in the final decision of the
Authority, it can be enforced. Pursuant to Section 82(1) of the Administrative Procedures Act, thedecision of the Authority becomes final upon its communication. Pursuant to Section 133 of the
Administrative Procedures Act, enforcement is ordered by the Authority adopting the decision, unlessotherwise provided by law or government decree. Pursuant to Section 134 of the Administrative
Procedures Act, enforcement is carried out by the state tax authority, unless otherwise provided bylaw, government decree or in the case of a municipal authority, the decree of the municipality.
Pursuant to Section 61(7) of the Privacy Act, the Authority carries out the enforcement of the decision
with respect to the performance of a specific act, specific behaviour, tolerance or ceasing as
incorporated in the decision of the Authority.
Budapest, 23 July 2020

52

Dr. Attila Péterfalvi
President
Honorary university professor