Enforcement · Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Hungarian political party: Insufficient fulfilment of data breach notification obligations

€34,375 Fine
Hungarian political party
HUNGARY
Art. 33 GDPR Art. 34 GDPR
Data Breaches Notification Obligation Notified Body Reporting and Notification Obligations Article 19 GDPR - Notification of Rectification, Erasure or Restriction IP Address Public Authority Education Public Sector
Apr 5, 2019 Source

How it connects

Related across sources

Guidance Guidelines 10/2020 on restrictions under Article 23 GDPR EDPB Guidance Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them EDPB Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Literature GDPR Implementation Series ∙ Malta: An Overview of the GDPR Implementation European Data Protection Law Review Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review Literature GDPR Implementation Series ∙ Portugal: A Brief Overview of the GDPR Implementation European Data Protection Law Review

Full text

NAIH imposed a fine of HUF 11,000,000 (EUR 34,375) on an undisclosed Hungarian political party for failing to notify the NAIH and relevant individuals about a data breach, and failing to document the breach according to GDPR Article 33.5. As mandated by law, the fine was based on 4% of the party's annual turnover and 2.65 % of its anticipated turnover for the coming year. The breach was the result of a cyber attack by an anonymous hacker who accessed and disclosed information on the vulnerability of the organisation’s system – a database of more than 6,000 individuals – and the command used for the attack. The system was vulnerable to attack because of a redirection problem with the organisation's webpage. After the attacker published the command, even people with low IT knowledge were able to retrieve information from the database.

Industry: Public Sector and Education

Original document at the source www.cms-lawnow.com

Similar Content