Blog
Blog » A RECORD GDPR FINE OF HUF 100 MILLION – THE PRICE OF THE PROCRASTINATION
A RECORD GDPR FINE OF HUF 100 MILLION – THE PRICE OF THE PROCRASTINATION
17 June 2020
The Data Protection Authority imposed the highest fine ever in Hungary against Digi Távközlési és Szolgáltató Kft. because of the infringement of the GDPR. Let’s see what led to the record fine of HUF 100 Million.
1. Facts
DIGI learnt from an ethical hacker that on his webpage www.digi.hu certain test databases are available which contain the personal data of his clients and subscribers to his newsletter. The ethical hacker used a security loophole on the webpage in order to access to client data.
DIGI notified the Data Protection Authority about the data breach within 72 hours who started an investigation based on the notification.
However the decision published by the Data Protection Authority does not contain exact figures, it is certain that DIGI stored the personal data of a large number of data subjects and because of their detailedness the data records would enable identity theft or fraud.
2. Insufficient data security measurements
Based on the investigation the Data Protection Authority established that the data breach happened because DIGI did not implement data security measures to ensure a level of security appropriate to the risks.
On the one hand, the security loophole used by the ethical hacker has been known for 9 years and a bug fix was already available but DIGI did not install it because it was not the part of the official update-package.
On the other hand, DIGI did not use encryption in relation to the personal data contained by the test data although encryption as a necessary data security measure is specifically mentioned by the GDPR.
3. Infringement of data protection principles
As we speak, plane crashes usually happen because of more mistakes and that was also the case regarding DIGI’s data breach.
Besides the inappropriate data security measures, a basic problem was that the test databases should have been deleted a long time ago. Indeed, DIGI created the test databases for his client data to be available temporarily until he fixes the mistake in his systems which hinders the availability of the client data.
Since DIGI has not deleted the test database after the correction o the mistake that is to say after the personal data were no longer necessary for the purpose of the data processing, DIGI infringed the principles of “purpose limitation” and “storage limitation”.
4. Circumstances which influenced the amount of the fine
When imposing the record fine the Data protection Authority considered as aggravating circumstances among other the fact that the data breach was the consequence of data security loophole for which a free bug fix was available a long time ago and that the absence of the encryption increased the risk of a data breach. The Data Protection Authority has also taken into account that the data breach concerned several personal data of a large number of data subjects compared to the number of the population of Hungary.
The Data Protection Authority considered as a mitigating factor that he has not yet established any infringements regarding DIGI and that DIGI acknowledged that he should have already deleted the test databases.
The fact that DIGI notified the Data Protection Authority within the 72 hours’ deadline and that DIGI cooperated during the investigation was not taken into account as a mitigating factor since these are the legal obligations of any controller.
5. Lesson learnt
The most basic lesson of the case is that you should delete the obsolete data and databases right after the purpose of processing has disappeared.
Further it is important to pay attention to the data security measures. The kind of data protection measurements which shall be applicable is influenced by a lot of factors for example the quantity or the sensitivity of the processed personal data and the available resources.
Nevertheless, it is clear that in case a data security measure is necessary and the technical feasibility exists, the Data Protection Authority will not be tolerant if a data breach happens because the controller has not implemented those security measurements.
-
Hungary: Steps Towards Differentiating Between Domestic and International Procedural Public Policy
Drawing a well-defined line of demarcation between domestic and international public policy when enforcing foreign arbitral awards sends a clear pro-arbitration message from national courts in any jurisdiction. Does Hungarian case law come close to this level of sophistication? This post analyses this question in the context of procedural public policy, and it does so based on two recent appellate court decisions rendered in the context of enforcement of arbitral awards in accordance with the New York Convention.
Read more » -
EU ISSUED NEW GDPR STANDARD CONTRACTUAL CLAUSES – WHEN AND HOW TO USE THEM?
During summer 2021, the European Commission published two new "standard contractual clauses" on data protection regulation, which can be applied on the one hand, to the legal relationship between data controllers and data processors covered by the GDPR , and to the transfers of personal data to third countries, on the other. In this article, we answer the questions: what these SCCs regulate, how do they differ from the previous SCCs and how can your company use the new SCCs?
Read more » -
CAN THE NON-COMPETITION AGREEMENT BE VALID WITHOUT A PRECISE COMPENSATION IN HUNGARY?
The non-compete agreement may provide protection of the legitimate economic interests of the employer even after the termination of employment relationship. However, the Hungarian Labour Code lays down strict requirements for the agreement. In our article we analyse a recent decision of the Supreme Court about the importance of the precise determination of the compensation, so you as an employer can conclude a valid non-compete agreement.
Read more »