# Claim management company: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)
- Date: 2019-06-03
- Original: https://www.enforcementtracker.com/ETid-253
- Canonical: https://overview.legal/posts/46368
- Topics: Legitimate Interest, Insurance, Controllers, Consent, Data Controller, Personal Data, Processing, International Transfer

## Summary

The complainants stated during the case that they concluded a credit agreement with the bank, which sold its claim against the complainants and transferred their respective data to a third-party company (controller). NAIH determined in the case that the controller can neither rely on the consent of the data subjects nor the performance of the credit contract as the legal basis of the data processing, since the data subjects concluded such contract with the bank, not with the controller. The appr

## Full text

The complainants stated during the case that they concluded a credit agreement with the bank, which sold its claim against the complainants and transferred their respective data to a third-party company (controller). NAIH determined in the case that the controller can neither rely on the consent of the data subjects nor the performance of the credit contract as the legal basis of the data processing, since the data subjects concluded such contract with the bank, not with the controller. The appropriate legal basis for processing could have been the legitimate interest of the controller.

GDPR Articles: Art. 5 GDPR, Art. 6 GDPR
Industry: Finance, Insurance and Consulting

---
Generated by overview.legal · https://overview.legal/posts/46368 · 2026-08-22