Enforcement · Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Local bank: Insufficient fulfilment of data subjects rights

Customer of a local bank requested access to telephone conversation recordings as well as to CCTV recordings.

€2,000 Fine
Local bank
HUNGARY
Art. 12 GDPR Art. 15 GDPR Art. 18 GDPR
Personal Data Controllers Insurance Video Surveillance
May 31, 2019 Source naih.hu

Full text

Customer of a local bank requested access to telephone conversation recordings as well as to CCTV recordings. The bank provided the copies of the recordings of telephone conversations and also provided the chance of reviewing the recordings at bank but rejected to provide copies of the CCTV recordings since the recordings also contained third parties personal data. The NAIH decided in this case that the bank failed to fulfil data subjects rights since it did not respond in due time and also failed to provide copies of the requested recordings. According to the NAIH, the controller could not refer the protection of third party data since the CCTV recordings affected public space open for every customer and the bank also could have anonymised certain parts of the recordings.

Industry: Finance, Insurance and Consulting

How it connects

References

Related across sources

10 A 5144/23 VG Hannover: Controller appeals DPA reprimand over unlawful workplace video surveillance The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the… Administrative Court Hannover Aug 7, 2026 Controllers Supervisory Authorities Legitimate Interest
C-13/16 Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības SIA "Rīgas satiksme" In Case C-13/16, the Court of Justice of the European Union (Second Chamber) addressed a preliminary ruling from the Latvian Supreme Court in proceedings between the Riga Regional… CJEU ·Second Chamber May 4, 2017 Legitimate Interest Personal Data Controllers
CJEU Bara: national law cannot excuse controller's duty to inform data subjects of Right to be informed: National law that does not require the specific transfer involved in the case cannot constitute “prior information” under Article 10 of Directive 95/46… Oct 1, 2015 Controllers Personal Data Fairness & Transparency
C-422/24 Case C-422/24 - AB Storstockholms Lokaltrafik. A new page has been created with the following information: "" CJEU Jan 7, 2026 Personal Data Fairness & Transparency Controllers
1 As 183/2023-62 Health insurer must disclose aggregated patient treatment data under Free Access to OAKS Consulting s.r.o. (the company) provided consulting services concerning market access conditions for medicinal products and medical devices. Pursuant to the Czech Act on Free… Supreme Administrative Court Aug 4, 2026 Pseudonymization Anonymization Personal Data
C-708/18 TK v Asociaţia de Proprietari bloc M5A-ScaraA In Case C-708/18, the Court of Justice of the European Union (Third Chamber) issued a preliminary ruling on a reference from the Tribunalul București (Romania) in proceedings… CJEU ·Third Chamber Dec 11, 2019 Legitimate Interest Personal Data Consent
Related documents