HungaryAct C of 2003 on Electronic Communications, Section 156, Personal Data Breach Notification by Electronic Communications Providers
2003. évi C. törvény (Eht.) 156. § (2)-(5)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- If you provide a publicly available electronic communications service in Hungary, notify the National Media and Infocommunications Authority without delay when you detect a breach of subscriber personal data, meaning accidental or unlawful handling or processing of the personal data you transmit, store or otherwise handle in providing the service (Eht. section 156, paragraphs 2 and 3).NIST Privacy FrameworkCM.AW-P7
- Keep a register of those breaches that records their essential circumstances and effects and the corrective measures you took, and make it cover every fact the Authority needs to check that you notified the person concerned as the Act requires (Eht. section 156, paragraph 4).NIST Privacy FrameworkPR.PO-P7
- Where a breach is likely to harm a subscriber's or another individual's personal data or privacy, also notify that person without undue delay, unless you satisfactorily show the Authority that you applied appropriate technical protection measures to the data affected (Eht. section 156, paragraph 5).NIST Privacy FrameworkCM.AW-P7
These lines are LexLint's reading of the law's text, as of . Also read by: Nemzeti Média- és Hírközlési Hatóság (NMHH) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://nmhh.hu/cikk/162039/Tajekoztato_a_szolgaltato_altal_kezelt_szemelyes_adatok_megsertesenek_Hatosag_fele_torteno_bejelenteserol
- Guidance body
- Nemzeti Média- és Hírközlési Hatóság (NMHH)
What it makes you log
Who may demand the log
Regulator
Logging duty
A provider keeps a register of every personal data breach recording its essential circumstances, its effects and the corrective measures taken, and the register must cover every fact the Authority needs to check compliance with paragraph 5. Paragraph 4 sets no field list and no retention period, and limits the register to the information needed for that purpose.
- Kind
- Explicit
- As of
- Provision
- Act C of 2003 on Electronic Communications (Eht.), Section 156(4)
- Trigger
- security_incident
What this law does
Section 156, paragraph 2 of the Act on Electronic Communications defines a breach of subscriber personal data as the accidental or unlawful handling or processing of personal data transmitted, stored or otherwise handled in connection with publicly available electronic communications services, in particular its destruction, loss, alteration, unauthorized disclosure or publication, or unauthorized access to it.
Paragraph 3 requires an electronic communications service provider that detects a personal data breach to notify the Authority without delay. The Act defines the Authority as the National Media and Infocommunications Authority (Nemzeti Média- és Hírközlési Hatóság). Paragraph 4 requires providers to keep a register of personal data breaches that records their essential circumstances, their effects and the corrective measures the provider took.
The register must cover every fact and circumstance that lets the Authority check whether the provider met its duty to notify the person concerned. Paragraph 5 requires the provider also to notify the subscriber or other individual without undue delay where the breach is likely to harm their personal data or privacy.
Paragraph 5 lifts that duty to notify the person where the provider satisfactorily shows the Authority that it applied appropriate technical protection measures to the data affected.
When LexLint raises it
When your app profile says your app provides telecom services.