Hungarian Online Store Fined €41,500 for GDPR Transparency Failures
Written by AI from the linked story. Not reviewed by an editor. How this works
An online store operator in Hungary was fined HUF 15,000,000 (~€41,500) after a multi-year NAIH investigation revealed systemic failures in GDPR transparency obligations. The controller failed to clearly communicate data processing purposes, legal bases, and retention periods to users — foundational requirements under GDPR Articles 13 and 14. Contradictory information about U.S. data transfers further compounded the violations, suggesting a lack of internal governance over privacy documentation. This case demonstrates that privacy notices are not a one-time exercise; they require ongoing review and accuracy to remain legally compliant. Regulators are increasingly scrutinizing the quality and consistency of privacy disclosures, not just whether they exist.
Tactical Insight
Immediate actions
- Conduct a full audit of all public-facing privacy notices to ensure they accurately reflect current data processing activities, legal bases, and retention schedules.
- Identify and correct any contradictory or outdated statements regarding international data transfers, particularly to the United States.
Long-term improvements
- Establish a formal Privacy Notice Management process with scheduled reviews (at least annually and upon any material change to processing activities).
- Appoint a Data Protection Officer (DPO) or designated privacy lead responsible for maintaining accuracy and consistency across all data protection disclosures.
- Implement a Records of Processing Activities (RoPA) register that serves as the authoritative source for all privacy notice content.
Detection & Governance measures
- Integrate privacy notice accuracy checks into internal audit cycles and third-party privacy assessments.
- Set up a cross-functional review process involving legal, IT, and marketing teams before publishing or updating any data processing information.