[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiDu62CZ_q2mbOwwkoMXGAiLyOalhtiMheWJHezYKUHU":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":65},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"154d701a-267c-4934-b051-935094aa5185","NAIH (Hungary) - NAIH-450-7-2026","naih-hungary-naih-450-7-2026-53a85f","← Older revision Revision as of 16:40, 4 August 2026 Line 107: Line 107: Second, the DPA determined that the controller had failed to provide concise, transparent, and intelligible information regarding the purposes and the legal basis for each processing activity and therefore infringed [[Article 12 GDPR|Article 12(1) GDPR]]. Second, the DPA determined that the controller had failed to provide concise, transparent, and intelligible information regarding the purposes and the legal basis for each processing activity and therefore infringed [[Article 12 GDPR|Article 12(1) GDPR]]. Finally, the DPA found infringements of Articles 13(1) and 13(2) GDPR – the controller had not provided the data subjects all information necessary when personal data is collected from data subjects. In particular, the controller had failed to adequately distinguish the purposes and the legal bases for each processing operation, recipients of personal data, and retention periods. The controller’s website also contained contradictory information on whether or not personal data was transferred to the United States. Finally, the DPA found infringements of [[Article 13 GDPR|Articles 13(1)]] and [[Article 13 GDPR|13(2) GDPR]] – the controller had not provided the data subjects all information necessary when personal data is collected from data subjects. In particular, the controller had failed to adequately distinguish the purposes and the legal bases for each processing operation, recipients of personal data, and retention periods. The controller’s website also contained contradictory information on whether or not personal data was transferred to the United States. == Comment == == Comment ==","Hungary's National Data Protection Authority (NAIH) has fined an online store operator HUF 15,000,000 (approximately €41,500) for multiple GDPR violations. The investigation, spanning from January 2020 to November 2025, found that the controller failed to provide clear, transparent, and intelligible information regarding data processing purposes, legal bases, and retention periods. Additionally, contradictory information on the website regarding data transfers to the United States was identified.","Hungary's NAIH fines an online store operator HUF 15M for GDPR violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=NAIH_(Hungary)_-_NAIH-450-7-2026&diff=52612&oldid=52611","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F85\u002FLogoHU.jpg","2026-08-04T16:40:50+00:00","2026-08-04T18:00:16.868375+00:00",7,[17],{"name":18,"type":19},"NAIH","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":64},[47],{"slug":48,"name":49,"problem":50,"products":51},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[52,58],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":53,"product_name":54,"url":56,"description":57},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":59,"product_name":60,"url":62,"description":63},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":66,"title":67,"body":68,"framework_refs":69,"framework_notes":80},"hungarian-online-store-fined-41500-for-gdpr-transparency-failures","Hungarian Online Store Fined €41,500 for GDPR Transparency Failures","An online store operator in Hungary was fined HUF 15,000,000 (~€41,500) after a multi-year NAIH investigation revealed systemic failures in GDPR transparency obligations. The controller failed to clearly communicate data processing purposes, legal bases, and retention periods to users — foundational requirements under GDPR Articles 13 and 14. Contradictory information about U.S. data transfers further compounded the violations, suggesting a lack of internal governance over privacy documentation. This case demonstrates that privacy notices are not a one-time exercise; they require ongoing review and accuracy to remain legally compliant. Regulators are increasingly scrutinizing the quality and consistency of privacy disclosures, not just whether they exist.",[70,71,72,73,74,75,76,77,78,79],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 14 – Information to be provided where personal data have not been obtained from the data subject","GDPR Article 44-49 – Transfers of personal data to third countries","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","NIST SP 800-53 PT-5 (Privacy Notice)","NIST Privacy Framework PR.PO-P1 (Policies, processes, and procedures for managing data)","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management (Clause 7.3 – Obligations to PII Principals)","ITIL Service Design – Information Security Management (Privacy Policy Governance)",{}]