Enforcement · Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Digi Távközlési Szolgáltató Kft. ('Digi') (electronic communication service provider): Insufficient technical and organisational measures to ensure information security

€288,000 Fine
Digi Távközlési Szolgáltató Kft. ('Digi') (electronic communication service provider)
HUNGARY
Art. 5 GDPR Art. 32 GDPR
Encryption Security Retention Period Storage Limitation Telecommunications IP Address
Jun 12, 2020 Source

How it connects

Related across sources

Guidance Guidelines 9/2022 on personal data breach notification under GDPR EDPB Case Law Judgment of the Court (Fifth Chamber) of 24 February 2022.#SIA 'SS' v Valsts ieņēmumu dienests.#Request for a preliminary ruling from the Administratīvā apgabaltiesa.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 2 – Scope – Article 4 – Concept of ‘processing’ – Article 5 – Principles relating to processing – Purpose limitation – Data minimisation – Article 6 – Lawfulness of processing – Proc Court of Justice of the European Union Guidance Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation EDPB Guidance Statement 5/2024 on the Recommendations of the High-Level Group on Access to Data for Effective Law Enforcement EDPB Guidance EDPB Annual Report 2022 EDPB News CJEU: PNR Directive Valid if Limited to the “Strictly Necessary” eucrim

Full text

The company had infringed the principles of purpose limitation and storage restriction because its database contained a large amount of customer data which were no longer relevant for the actual purpose of collection and for which no retention period had been set. Furthermore, the NAIH pointed out that the defendant had not taken proportionate measures to reduce the risks in the area of data management and data security, arguing, inter alia, that it had not used encryption mechanisms.

Industry: Media, Telecoms and Broadcasting

Original document at the source www.naih.hu

Similar Content