Processes biometric data, in Hungary

2011. evi CXII. torveny, point 3 and point 3b ("kulonleges adat" and "biometrikus adat") · Read the law's page

• Obtain an explicit GDPR Article 9(2) legal basis before processing biometric data of a person in Hungary; the Infotorveny's own definition tracks GDPR Article 4(14) without narrowing or expanding it.

Regulation (EU) 2024/1689, Arts. 5, 50 — directly applicable in Hungary as EU Member State

• Do not place on the market, put into service, or use an AI system for social scoring.
• Do not use real-time remote biometric identification in publicly accessible spaces for law enforcement, except within narrow exceptions.when it serves a public body
• Do not place on the market, put into service, or use an AI system that exploits individuals' vulnerabilities.
• Tell users when they are interacting with an AI chatbot or voice agent.
• Mark generated images, video, audio and text output in machine-readable form as artificially generated.

2025. évi XCII. törvény a magánjogi tárgyú törvények módosításáról · Read the law's page

• These rules are enacted but do not apply yet: they apply to products placed on the market or put into service after 9 December 2026, and sections 6:550 to 6:559 of the Civil Code now in force keep governing earlier products (Sec. 95(6) of Act XCII of 2025; Sec. 55/A of Act CLXXVII of 2013).
• If you develop, make or have made a product, software included, or present yourself as its manufacturer by your name, trade mark or other distinguishing sign, you answer for damage a defect in it causes (Secs. 6:550(1)(a), 6:552 and 6:554(2)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control: a defect that arises after you put the product into circulation because of software, an update or upgrade, or a missing update needed to maintain safety is not excused (Sec. 6:557(5)).
• Treat safety-relevant cybersecurity requirements and any recall as part of what decides whether your product is defective (Sec. 6:555(2)(f) and (g)).
• Allow for what the product learns or acquires after it is placed on the market, because the effect of that ability is weighed in deciding whether it is defective (Sec. 6:555(2)(c)).
• Keep evidence you could produce if a court orders you to make it available: failing to do so presumes the product defective (Sec. 6:556(1)(a)).
• If you are outside the EU, the importer, your authorized representative or, failing them, the fulfilment service provider answers for the product in your place (Sec. 6:550(1)(c)).
• If you distribute a product or run an online platform that lets consumers contract with traders, identify the liable business established in the EU, or your own supplier, within one month of the injured person's request, or you answer for the damage (Sec. 6:550(5) and (6)).
• If you substantially modify a product outside the manufacturer's control and then distribute it or put it into service, you answer as its manufacturer (Sec. 6:550(4)).
• If you build a software component into a product, you have no recourse against a micro or small enterprise that made the software where you waived recourse in the contract (Sec. 6:551).
• Do not rely on a contract term to limit or exclude liability to the injured person, because it is void (Sec. 6:559).
• Free and open-source software developed or made available in the course of a non-commercial activity is outside the chapter (Sec. 6:559/B(2)(b)).