HungaryInfotörvény (Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information)
2011. evi CXII. torveny az informacios onrendelkezesi jogrol es az informacioszabadsagrol
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Hungary; the Infotorveny supplements the GDPR with mainly procedural rules rather than a substantive addition to that basis.
These lines are LexLint's reading of the law's text. Also read by: Case C-621/22 Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens, judgment of (Ninth Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0621
- Case citation
- Case C-621/22 Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens, judgment of (Ninth Chamber)
- Open questions
- Which commercial interests of a controller can be 'legitimate interests' under Article 6(1)(f) of Regulation (EU) 2016/679, and when is a disclosure of personal data for consideration 'strictly necessary' for one, as Case C-621/22 requires?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Decision basis, Data lineage
Log retention
The records and the electronic log are kept for ten years after the processed data is deleted.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 10
Logging duty
Sections 25/E and 25/F bind controllers and processors that process personal data for law-enforcement, national-security or defence purposes, which Section 2(3) places under the Act itself; for processing the GDPR governs, Section 2(2) does not carry them over and GDPR Article 30 applies directly. Section 25/E requires a written or electronic record of processing, data protection incidents and measures on access requests, to be made available to the Authority on request. Section 25/F requires an electronic log of each electronic processing operation, holding the scope of the personal data concerned, the purpose and reason, the exact time, who performed it and, on a transfer, the recipient. The Authority, and persons and bodies authorized by law to verify lawfulness, may ask for access to the log. The records and the log are kept for ten years after the processed data is deleted.
- Kind
- Explicit
- As of
- Provision
- Information Act (Infotv.), Sections 25/E and 25/F
- Trigger
- personal_data_processing
What this law does
Hungary's data-protection act predates the General Data Protection Regulation (GDPR) by roughly six years and, unusually, originally combined data protection and freedom-of-information law in one statute; the freedom-of-information half was never split into a separate act and remains bundled alongside the data-protection half. The National Assembly adopted the Act on and it was promulgated on .
Under Section 73(1) it enters into force the day after promulgation, with exceptions in paragraphs (2) and (3); paragraph (2) puts most substantive sections, including the sections numbered 1 through 37, in force on , which is the date recorded here.
Rather than repeal the Infotorveny when the GDPR became directly applicable, Hungary amended it: Act XXXVIII of 2018, on amending the Infotorveny in connection with the EU data-protection reform and amending related laws, restated several of its sections, and Act XXXIV of 2019 later amended it again, so it now operates as a supplementary, mainly procedural statute alongside the Regulation.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .