HungaryInfotörvény Definitions, Biometric and Special-Category Data
2011. evi CXII. torveny, point 3 and point 3b ("kulonleges adat" and "biometrikus adat")
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Obtain an explicit General Data Protection Regulation (GDPR) Article 9(2) legal basis before processing biometric data of a person in Hungary; the Infotorveny's own definition tracks GDPR Article 4(14) without narrowing or expanding it.
These lines are LexLint's reading of the law's text. Also read by: Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information) (guidance, recorded ); Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252
- Guidance link
- https://www.naih.hu/files/2019-01-28-NAIH-2019-1074-biometr.pdf
- Case citation
- Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber)
- Guidance body
- Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information)
- Open questions
- In which exceptional cases can an employee's consent be the legal basis for processing biometric data at work under Article 9(2)(a) of Regulation (EU) 2016/679, where the Authority accepts consent only if it can be refused freely and without consequences?
What it makes you log
Logging duty
The definitions of special-category and biometric data only classify data. They state no duty to create, keep or produce a log or record. Sections 25/E and 25/F, which require a processing record and an electronic log for law-enforcement, national-security and defence processing, sit outside the definitions this row cites.
- Kind
- None
- As of
What this law does
The Infotorveny's own definitions list biometric data alongside racial or ethnic origin, political opinion, religious belief, trade-union membership, genetic data, health data, and sex-life or orientation data as a special category, matching General Data Protection Regulation (GDPR) Article 9(1).
Its biometric definition is a near-verbatim restatement of GDPR Article 4(14): "biometrikus adat: egy természetes személy fizikai, fiziológiai vagy viselkedési jellemzőire vonatkozó olyan, sajátos technikai eljárásokkal nyert személyes adat, amely lehetővé teszi vagy megerősíti a természetes személy egyedi azonosítását, mint például az arckép vagy a daktiloszkópiai adat" (English: biometric data means personal data obtained through specific technical procedures relating to the physical, physiological, or behavioural characteristics of a natural person, which enables or confirms the unique identification of that natural person, such as the facial image or dactyloscopic fingerprint data), naming the same two examples as the GDPR.
Separately, Section 11(1) of the Labour Code (Act I of 2012) lets an employer process an employee's biometric data to identify the employee only where that is necessary to prevent unauthorized access to a thing or data that would endanger the life, bodily integrity or health of the employee or others, or cause serious or mass, irreversible harm to a significant interest protected by law.
Section 11(2) names as such an interest the protection of classified data of at least the Confidential level, firearms, ammunition and explosives, toxic or dangerous chemical or biological materials, nuclear materials, and property of especially high value under the Criminal Code.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .