HungaryElectronic Commerce Act Section 13/A, Personal Data of Recipients of Information Society Services
2001. évi CVIII. törvény az elektronikus kereskedelmi szolgáltatások valamint az információs társadalommal összefüggő szolgáltatások egyes kérdéseiről (Ekertv.), 13/A. §
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Consent, Data subject rights
As of .
What it requires
- Process a service recipient's personal data only for the contract and billing purposes in Section 13/A paragraphs 1 and 2 or because the data are technically indispensable to providing the service (Electronic Commerce Act Section 13/A, paragraph 3).
- Use data about the use of the service for any other purpose, such as targeted advertising or market research, only after defining the purpose in advance and obtaining the recipient's consent (Section 13/A, paragraph 4).
- Let the recipient prohibit that other processing before and during use of the service, and do not link the data to the recipient's identifying data or pass them to a third party without the recipient's consent (Section 13/A, paragraphs 5 and 6).
- Delete data processed for the contract, billing and technical purposes after the contract ends or is not concluded and after billing, and delete data processed for the other purpose once that purpose ends or the recipient so decides (Section 13/A, paragraph 7).
- Do not make a service that is not available from another provider conditional on consent to processing for other purposes (Section 13/A, paragraph 8).
- Let the recipient learn, before and during use of the service, which kinds of data you process for which purposes (Section 13/A, paragraph 9).
What this law does
A provider of an information society service may process personal data that are technically indispensable for providing the service. The provider may use data about the use of the service for any other purpose, such as targeted advertising or market research, only with a purpose defined in advance and the recipient's consent. The recipient must be able to prohibit that other processing before and during use of the service.
Data processed for the other purpose may not be linked to the recipient's identifying data, or passed to a third party, without the recipient's consent. The provider must delete data processed for the contract, billing and technical purposes after the contract ends or is not concluded and after billing, and data processed for the other purpose once that purpose ends or the recipient so decides.
The service may not be made conditional on consent to processing for other purposes where it is not available from another provider. The provider must let the recipient learn, before and during use, which kinds of data it processes for which purposes.
When LexLint raises it
When your app profile says your app deploys a chatbot, generates content with AI, sends automated outreach, trains models or tracks devices.