[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOFFmJWo4ui5opqzI6REx1iwvJ7MjfrggPrISY-9TrMs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"ec5decb2-af55-44ac-9689-224aafdda3b5","cjeu-rules-hungarys-criminal-records-law-breaches-gdpr-article-10","b7c9d919-6086-4010-bcac-98c2477bf6c5","CJEU Rules Hungary's Criminal Records Law Breaches GDPR Article 10","Hungary amended its criminal records legislation to allow any adult relative or guardian of a minor to request and disseminate sensitive data about individuals convicted of sexual offences against children, without adequate safeguards, proportionality controls, or precision. The Court of Justice of the European Union found this violated GDPR Article 10, which imposes strict conditions on the processing of criminal conviction and offence data, reserving it only for official authority or specifically authorised bodies with appropriate protections. The ruling underscores that even well-intentioned child-protection measures must be narrowly scoped and legally grounded to avoid enabling disproportionate exposure of sensitive personal data. This matters because overly broad access regimes create systemic privacy risks, potential for misuse of sensitive data, and undermine individuals' fundamental rights under the EU Charter.","**Immediate actions:**\n- Conduct a legal review of any existing policies or laws that grant third-party access to criminal conviction data to ensure they meet GDPR Article 10 requirements.\n- Restrict access to criminal records and sensitive conviction data to designated official authorities or specifically authorised bodies only.\n\n**Policy & Design improvements:**\n- Apply data minimisation and proportionality principles at the legislative or policy design stage, ensuring access is limited to what is strictly necessary for the stated purpose.\n- Require Data Protection Impact Assessments (DPIAs) before enacting or amending any legislation that enables processing of special-category or criminal offence data.\n- Embed independent Data Protection Authority (DPA) consultation into the legislative drafting process for laws touching on sensitive personal data.\n\n**Monitoring & Accountability measures:**\n- Establish audit trails and logging mechanisms for all requests and disclosures of criminal conviction data to detect misuse or disproportionate access.\n- Schedule periodic compliance reviews of national laws against current GDPR obligations to identify regulatory drift before enforcement action is taken.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 10 – Processing of personal data relating to criminal convictions and offences","GDPR Article 5(1)(b)(c)(e) – Principles of purpose limitation, data minimisation, and storage limitation","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","EU Charter of Fundamental Rights Article 8 – Protection of personal data","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 RA-3 – Risk Assessment","CIS Control 3 – Data Protection","CIS Control 6 – Access Control Management","ITIL – Risk Management and Compliance Review practices",{},"published","2026-07-24T14:20:23.237133+00:00","2026-07-24T14:20:22.907+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C%E2%80%91769\u002F22_-_European_Commission_v_Hungary&diff=52487&oldid=51443","cjeu-c-769-22-european-commission-v-hungary-528487","CJEU - C‑769\u002F22 - European Commission v Hungary",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]