HungaryGDPR Articles 12-21 and Infotv. Sections 23 and 25, Data Subject Rights in Hungary
Regulation (EU) 2016/679, Arts. 12-21; 2011. évi CXII. törvény (Infotv.), §§ 23, 25
In force since .
A data subject rights rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Audit expectation
- none
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Hungary within one month of receipt.
- For five years after a person in Hungary dies, honor a request to access, rectify, erase, restrict or object to processing of their personal data from someone the deceased authorised, or, failing that, from a close relative, under Information Act (Infotv.) Section 25.
These lines are LexLint's reading of the law's text. Also read by: Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information) (guidance, recorded ); Case C-307/22 FT v DW, judgment of (First Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0307
- Guidance link
- https://www.naih.hu/erintetti-jogok
- Case citation
- Case C-307/22 FT v DW, judgment of (First Chamber)
- Guidance body
- Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information)
- Open questions
- Outside a doctor-patient relationship, when does Article 15(3) entitle a data subject to a full copy of the documents containing the personal data, rather than a faithful and intelligible reproduction of the data themselves?
What it makes you log
Who may demand the log
Court
Logging duty
In a court action over a rights violation, the controller or processor must prove that the processing complied with the rules, which it can do only from a record of what it did. Sections 23 and 25 name no log, no audit and no one entitled to ask for a record before an action is brought; only the court reaches it. GDPR Articles 12 to 21 set no record duty of their own.
- Kind
- Implicit
- As of
- Provision
- Information Act (Infotv.), Section 23(2)
- Trigger
- personal_data_processing
What this law does
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Hungary can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.
For processing the GDPR governs, Section 2(2) of the Information Act applies only a named set of its own provisions, so its domestic rights chapter does not reach it, but two sections of that chapter are named: Section 23 lets a person sue the controller, or a processor over its own activities, in court, with the burden on the controller to prove compliance and the court able to order the violation stopped and award damages; and Section 25 lets a person authorised by the deceased, or a close relative, exercise the rights of access, rectification, erasure, restriction and objection for five years after the person's death.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .