Hungarian Authority Unlawfully Discloses Family Address in Summons, Breaching GDPR
A Hungarian guardianship authority violated GDPR by including a parent's and two minor children's residential address in a summons sent to an estranged grandparent, without a lawful basis for sharing that data. The core failure was the absence of a data minimization review — staff included personal address details that were not necessary for the stated purpose of client identification. This exposes a systemic gap in how public authorities handle sensitive personal data in administrative documents, potentially endangering vulnerable individuals. The ruling highlights that even routine administrative actions must be evaluated for GDPR compliance, particularly when minors and vulnerable parties are involved.
Tactical Insight
Immediate actions
- Review all document templates (summons, notices, correspondence) to remove personal data fields that are not strictly necessary for the document's purpose.
- Train frontline staff on GDPR's data minimization principle and require sign-off before any document containing sensitive personal data is issued to third parties.
Policy & Process improvements
- Establish a formal Data Protection Impact Assessment (DPIA) process for administrative document workflows that involve sharing personal data with external parties.
- Implement a pre-send checklist requiring staff to confirm the legal basis for each category of personal data included in outgoing documents.
- Create and maintain a data sharing register that documents what personal data is shared, with whom, and under which legal basis.
Oversight & Accountability
- Appoint or empower a Data Protection Officer (DPO) to conduct periodic audits of administrative communication templates across all departments.
- Enforce role-based access controls so that only personnel with a verified need-to-know can access and include residential address data in official correspondence.