Blog » GDPR PENALTY FORECAST – OUR PRESENTATION AT BELGABIZ
GDPR PENALTY FORECAST – OUR PRESENTATION AT BELGABIZ
23 April 2018
How often did the Hungarian Data Protection Authority impose penalties in the last five years? What was the average amount of penalties? Will be there any change after 25th May 2018, when the GDPR comes into force? We addressed these questions in our presentation made at BELGABIZ.
We were invited by BELGABIZ, the Business Club of Belgian and Hungarian enterprises in Hungary, to make a presentation on GDPR, since the D-Day is getting closer.
The managing partner of our law firm, dr.Richard Schmidt LL.M, EU law specialist, has chosen a topic that concerns mostly Hungarian businesses: how much they have to pay in case of a non-compliance with GDPR?
Richard answered the above question on the basis of last 5 years’ statistics of Hungarian Data Protection Authority, by comparing the current and future legal background.
Penalty as No. 1. Sanction
Under the current national data protection law, in case of non-compliance the Hungarian Data Protection Authority has 7 (seven) kind of sanctions. Among these only 1 (one) is the pecuniary penalty, while the other 6 (six) are non-pecuniary measures.
Even if penalty is only one out of seven sanctions, the statistics of the last five years of the authority clearly show that penalties were applied in the vast majority of cases.
The decrease in 2016 is due to the judgment of the Supreme Court, interpreting the Hungarian law on small and medium size enterprises (SMEs).
By its landmark decision, the highest Hungarian judicial forum ruled that in case an SME infringes privacy laws, no pecuniary penalty can be imposed for the first time. Yet, one year after, in 2017, the authority has already used this type of sanction twice more, than in 2016.
Average amount of penalties
According to the law in effect, the maximum amount of the penalty for data breaches can be HUF 20 Million.
The statistics show that the average amount was around 1 Million HUF in 2013, but after that year there was a strong increasing trend, up to cca. HUF 5 Million, which is the average amount of penalty imposed for non-compliance with data protection laws at the moment.
Changes after GDPR
When GDPR enters into force, the following major changes will take place.
First, the landmark decision of the Supreme Court, protecting SMEs will be no more applicable, because it was based on the interpretation of national law. The GDPR, being a European source of law, will overwrite the national provisions.
So, the data protection authority will be able to fine SMEs, even in case of a first fault.
Second, the upper limit of pecuniary penalties will be raised from 20 Million HUF to 20 Million EUR, or to 4% of annual turnover of the non-compliant organisation, which means that the ceiling will be at least 300 times higher than before.
Based on the above, we can provide you with the following “penalty forecasts”:
1. Given that the GDPR will be applied by the Hungarian Data Protection Authority, whose No.1. sanction was the penalty in the last five years, we presume that pecuniary penalties will remain the most often used sanctions after the GDPR enters into force.
2. It is not hard to predict that a 300 times’ increase regarding the ceiling of the penalty will lead to an overall increase in the amount of penalties imposed in case of non-compliance with the GDPR.
We hope that these two reasons are convincing enough for everybody to take GDPR compliance seriously, and continue the preparation for the new data protection rules!
CAN A JUDICIAL ERROR CREATE HUNGARIAN JURISDICTION DESPITE A PLACE OF PERFORMANCE ABROAD?
Can a defendant, domiciled abroad, be sued in Hungary under the Brussels I Regulation in the event of defective performance of an international sales contract if the place of performance is abroad? Can the jurisdiction of a Hungarian court be established based on the fact that the lower court expressly established its jurisdiction at the beginning of the litigation? How is the EXW clause to be interpreted within the meaning of the Brussels I Regulation? In our article, we analyse the recent decision of the Supreme Court of Hungary.Read more »
CAN YOU REQUEST ‘COVID-19 VACCINATED’ CERTIFICATION FROM YOUR EMPLOYEE IN HUNGARY?
In the recent weeks, a number of questions have been arisen whether the employer may know the data contained by the „immunity card”, which aim is to certify immunity to coronavirus. Is the employer entitled to request information from the employee regarding the immunity card or store the information concerning its employee? In this article we answer the above questions on the basis of the information („Information”) of Hungarian National Authority for Data Protection and Freedom of Information.Read more »
DO YOU HAVE TO TERMINATE THE REPLACEMENT EMPLOYEES’ CONTRACT IN HUNGARY?
In the event of a longer leave of a worker, it is common for employers to hire a replacement worker with fixed term contract to make up for the missing workforce. When the replaced worker returns, a labour dispute may arise. In the legal case presented in our article, the Supreme Court examined how the employment relationship of the replacement employee terminates at the end of the replacement. From our article you can learn about the decision of the Supreme Court and what to look for as an employer to make the closing of the replacement smooth. (In our article, we examine the court decision published under No. BH 2021.2.51)Read more »