[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGPPAFgQegKyrYzlX9sM_Y6-YDDrI9UwazrNQnZFCWg8":3},{"article":4,"iocs":42},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":26},"e31b67be-6a53-4899-8591-adeaecfccb06","NAIH (Hungary) - NAIH-11443-3\u002F2026","naih-hungary-naih-11443-3-2026-31d25e","Created page with \"{{DPAdecisionBOX |Jurisdiction=Hungary |DPA-BG-Color=background-color:#7f0037; |DPAlogo=LogoHU.jpg |DPA_Abbrevation=NAIH |DPA_With_Country=NAIH (Hungary) |Case_Number_Name=NAIH-11443-3\u002F2026 |ECLI= |Original_Source_Name_1=NAIH |Original_Source_Link_1=https:\u002F\u002Fnaih.hu\u002Fhatarozatok-vegzesek |Original_Source_Language_1=Hungarian |Original_Source_Language__Code_1=HU |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code...\" Show changes","Hungary's National Data Protection and Freedom of Information Authority (NAIH) has fined an online store HUF 2,000,000 (approximately €5,500) for failing to provide customers with clear, transparent, and intelligible information about their personal data processing. The investigation, which began in April 2025, found violations related to cookies, registration, billing, and data transfers. The company's privacy notice, unchanged since 2018, was deemed confusing, incomplete, and lacking specific details on legal bases and data storage periods.","NAIH fines an online store HUF 2,000,000 for GDPR violations regarding data processing information.","Help NAIH (Hungary) - NAIH-11443-3\u002F2026: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 13:23, 23 July 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators89 edits Tag: submission [1.0]Newer edit → (No difference) Revision as of 13:23, 23 July 2026 NAIH - NAIH-11443-3\u002F2026 Authority: NAIH (Hungary) Jurisdiction: Hungary Relevant Law: Article 12(1) GDPR Article 13(1)(c) GDPR Article 13(1)(d) GDPR Article 13(1)(f) GDPR Article 13(2)(a) GDPR Type: Investigation Outcome: Violation Found Started: 11.04.2025 Decided: 22.07.2026 Published: 23.07.2026 Fine: 2,000,000 HUF Parties: n\u002Fa National Case Number\u002FName: NAIH-11443-3\u002F2026 European Case Law Identifier: n\u002Fa Appeal: Unknown Original Language(s): Hungarian Original Source: NAIH (in HU) Initial Contributor: av The DPA fined an online store HUF 2,000,000 (€5,500) for a failure to provide customers concise, transparent, and intelligible information about the processing of their personal data as required under Articles 13(1)(c), (d), (f), and 13(2)(a) GDPR. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The supervisory authority initiated an investigation into the GDPR compliance of an online store (the controller) processing the data of its customers (the data subjects) in April 2025. The processing activities in question included, inter alia, cookies, registration, billing, shipping, consumer complaint, and processing of orders. The privacy notice of the company operating the online store had been in force unchanged from May 2018 to May 2025, and the period under investigation extended from 1 January 2020 to 27 June 2025. Holding The DPA held that the controller had violated Articles 12(1), 13(1)(c), (d) and (f), and 13(2)(a) GDPR and issued the controller a fine of HUF 2,000,000 (€5,500). In addition, the DPA ordered the controller to bring its data processing operations into compliance with the GDPR and to amend the content of its privacy notice. First, the DPA found an infringement of Article 12(1) GDPR: the structure of the privacy notice was confusing and difficult to follow. The privacy notice also contained incomplete, incorrect, and unnecessary information as well as repetitive details. Based on this, the DPA concluded that the controller had failed to provide data subjects with information regarding the processing of personal data that was sufficiently concise, transparent, intelligible and easily accessible. Second, the DPA held that the controller had also violated Article 13(1)(c), (d) and (f) GDPR by failing to specify a legal basis for certain processing operations such as the use of cookies, not specifying its legitimate interests when relying on Article 6(1)(f) GDPR as a legal basis, and not providing detailed information regarding the safeguards ensuring the lawfulness of data transfers to the United States. Finally, the DPA found a violation of Article 13(2)(a) GDPR as the controller had also failed to provide the data subjects information on the period for which the personal data processed would be stored. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details. ........................................................................................................................................................................................................................................................................................ 1055 Budapest Tel.: +36 1 391-1400 naih.hu\u002Fadatkezelesi-tajekoztatok Falk Miksa utca 9-11. KR ID: 429616918 ugyfelszolgalat@naih.hu Case number: NAIH-11443-3\u002F2026. NAIH-11591\u002F2025. Administrator: […] Subject: decision in ex officio data protection procedure D E R O C T I O N The National Data Protection and Freedom of Information Authority (hereinafter: Authority) makes the following decision in ex officio data protection procedure to examine compliance with Regulation (EU) 2016\u002F679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\u002F46\u002FEC (hereinafter: General Data Protection Regulation or GDPR) against […]. (registered office:[…], acting attorney:[…]), represented by […] (registered office:[…]; hereinafter: Company), due to the data processing of the […] website (hereinafter: Website, Website or Homepage), regarding the […] website (hereinafter: Website, Website or Homepage), in connection with the data protection procedure initiated by the National Data Protection and Freedom of Information Authority (hereinafter: Authority) for the purpose of examining compliance with Regulation (EU) 2016\u002F679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\u002F46\u002FEC (hereinafter: General Data Protection Regulation or GDPR): 1. The Authority finds that the Company negligently infringed - Article 12 of the General Data Protection Regulation. Article (1); - Article 13(1)(c), (d) and (f) of the General Data Protection Regulation; - Article 13(2)(a) of the General Data Protection Regulation. 2. The Authority, pursuant to Article 58(2)(d) of the General Data Protection Regulation, shall ex officio order the Company to bring its data processing operations into line with the provisions of the GDPR and to amend the content of its data processing information in accordance with the requirements set out in points (92)-(104) of this decision. 3. The Authority shall impose a data protection fine of HUF 2,000,000 on the Company for the infringements set out in point 1. * * * The Company must confirm in writing to the Authority the measures prescribed in point 2 within 30 days of the date of this decision becoming final, together with the submission of supporting evidence. The data protection fine must be paid within 30 days of the date of this decision becoming final to the Authority’s centralized revenue collection account (10032000- 01040425-00000000 Centralized collection account IBAN: HU83 1003 2000 0104 0425 0000 0000). When transferring the amount, reference must be made to the NAIH-11443\u002F2026. BÍRS. number. If the Company fails to comply with the data protection fine payment obligation within the deadline, it shall pay a late payment surcharge to the above account number. The rate of the late payment surcharge is the statutory interest rate, which is the same as the central bank base interest rate valid on the first day of the calendar half-year affected by the delay. In the event of non-fulfilment of the obligations under point 2 and non-payment of the data protection fine and the late payment surcharge, the Authority shall order the enforcement of the decision. There is no administrative remedy against this decision, but it may be challenged in an administrative lawsuit by filing a claim with the Metropolitan Court within 30 days of its notification. The claim must be submitted to the Authority electronically1, which shall forward it to the court together with the case documents. The request for a hearing must be indicated in the claim. For those not entitled to full personal exemption from fees, the administrative lawsuit fee is HUF 30,000, and the lawsuit is subject to the right to record the subject matter of the fee. Legal representation is mandatory in the proceedings before the Metropolitan Court. J U N T I O N I A T I O N I. Procedure I.1. Official inspection (1) On 11.04.2025, the Authority decided to launch an inspection, within the framework of which it inspected the data processing of the webshop operating on the […] domain with an official inspection,","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=NAIH_(Hungary)_-_NAIH-11443-3\u002F2026&diff=52457&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F85\u002FLogoHU.jpg","2026-07-23T13:23:26+00:00","2026-07-23T14:00:28.401741+00:00",7,[18],{"name":19,"type":20},"NAIH","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":21,"icon":23,"name":24,"slug":25},null,"Policy","policy",[27,32,37],{"category":28},{"id":29,"icon":23,"name":30,"slug":31},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":33},{"id":34,"icon":23,"name":35,"slug":36},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":38},{"id":39,"icon":23,"name":40,"slug":41},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]