Sun, Jun
67 New Articles

The Court of Justice Clarified the Power of the National Data Protection Authority

The Court of Justice Clarified the Power of the National Data Protection Authority

  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Based on a Hungarian case, on 14 March 2024 the Court of Justice ruled that the supervisory authority of a Member State, to ensure that the GDPR is fully enforced, may order the erasure of unlawfully processed data even if prior request by the data subject has not been submitted. Such erasure may cover data collected from the affected person and data originating from another source.

The basis of the ruling is the decision of the municipality of Újpest (District IV of Budapest), which in 2020 decided to provide financial support to persons affected by COVID-19 pandemic. The municipality had asked the Hungarian State Treasury and the government office of District IV of Budapest to provide it with the personal data needed to verify the eligibility requirements for receiving the aid. The Hungarian data protection authority was informed of this practice and found that the authorities had jointly breached the rules of the GDPR and imposed related fines, as the Újpest municipality had failed to inform the data subjects, within one month provided for that purpose, of the actual use of their data, the purpose thereof and of their rights in relation to data protection. As a sanction, it also called the municipality to erase the data of eligible persons who had not applied for the support. The municipality then challenged that decision before the Budapest Regional Court. In its opinion, the national authority does not have the power to order the erasure of personal data in the absence of a prior request made to that effect by the data subject, as Article 17 of the GDPR explicitly defines the right of erasure as the right of the data subject.

Based on the above, the Hungarian court has suspended the procedure and asked for the interpretation of the GDPR from the Court of Justice, which stated that the data protection authority of a Member State, based on Article 58 of the GDPR, may take the necessary measures to fulfil its responsibility to ensure the enforcement of the GDPR. If the authority finds that the treatment of data does not comply with the GDPR, it must remedy the infringement, even without a prior request from the data subject, as if a related request would be required, it would mean that the controller, where no request is made, could continue to process them unlawfully. Based on the above, the authority may, even in the absence of a prior request made by the data subject, order the erasure of unlawfully processed data, regardless of whether those data originate directly from the data subject or another source.

As the Court of Justice does not decide the dispute itself, the procedure shall continue before the Hungarian court, with regard to the preliminary ruling.

By Borbala Maglai, Attorney at Law, KCG Partners Law Firm

Hungary Knowledge Partner

Nagy és Trócsányi was founded in 1991, turned into limited professional partnership (in Hungarian: ügyvédi iroda) in 1992, with the aim of offering sophisticated legal services. The firm continues to seek excellence in a comprehensive and modern practice, which spans international commercial and business law. 

The firm’s lawyers provide clients with advice and representation in an active, thoughtful and ethical manner, with a real understanding of clients‘ business needs and the markets in which they operate.

The firm is one of the largest home-grown independent law firms in Hungary. Currently Nagy és Trócsányi has 26 lawyers out of which there are 8 active partners. All partners are equity partners.

Nagy és Trócsányi is a legal entity and registered with the Budapest Bar Association. All lawyers of the Budapest office are either members of, or registered as clerks with, the Budapest Bar Association. Several of the firm’s lawyers are admitted attorneys or registered as legal consultants in New York.

The firm advises a broad range of clients, including numerous multinational corporations. 

Our activity focuses on the following practice areas: M&A, company law, litigation and dispute resolution, real estate law, banking and finance, project financing, insolvency and restructuring, venture capital investment, taxation, competition, utilities, energy, media and telecommunication.

Nagy és Trócsányi is the exclusive member firm in Hungary for Lex Mundi – the world’s leading network of independent law firms with in-depth experience in 100+countries worldwide.

The firm advises a broad range of clients, including numerous multinational corporations. Among our key clients are: OTP Bank, Sberbank, Erste Bank, Scania, KS ORKA, Mannvit, DAF Trucks, Booking.com, Museum of Fine Arts of Budapest, Hungarian Post Pte Ltd, Hiventures, Strabag, CPI Hungary, Givaudan, Marks & Spencer, CBA.

Firm's website.

Our Latest Issue