[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgdf3K3wb9P8JzT6vv9sABrnw2C8_vE9UhlYCAaadwEM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"8ff8fc6e-43f6-4658-97c1-46ef7f196a9b","hungarian-online-store-fined-41500-for-gdpr-transparency-failures","154d701a-267c-4934-b051-935094aa5185","Hungarian Online Store Fined €41,500 for GDPR Transparency Failures","An online store operator in Hungary was fined HUF 15,000,000 (~€41,500) after a multi-year NAIH investigation revealed systemic failures in GDPR transparency obligations. The controller failed to clearly communicate data processing purposes, legal bases, and retention periods to users — foundational requirements under GDPR Articles 13 and 14. Contradictory information about U.S. data transfers further compounded the violations, suggesting a lack of internal governance over privacy documentation. This case demonstrates that privacy notices are not a one-time exercise; they require ongoing review and accuracy to remain legally compliant. Regulators are increasingly scrutinizing the quality and consistency of privacy disclosures, not just whether they exist.","**Immediate actions:**\n- Conduct a full audit of all public-facing privacy notices to ensure they accurately reflect current data processing activities, legal bases, and retention schedules.\n- Identify and correct any contradictory or outdated statements regarding international data transfers, particularly to the United States.\n\n**Long-term improvements:**\n- Establish a formal Privacy Notice Management process with scheduled reviews (at least annually and upon any material change to processing activities).\n- Appoint a Data Protection Officer (DPO) or designated privacy lead responsible for maintaining accuracy and consistency across all data protection disclosures.\n- Implement a Records of Processing Activities (RoPA) register that serves as the authoritative source for all privacy notice content.\n\n**Detection & Governance measures:**\n- Integrate privacy notice accuracy checks into internal audit cycles and third-party privacy assessments.\n- Set up a cross-functional review process involving legal, IT, and marketing teams before publishing or updating any data processing information.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 14 – Information to be provided where personal data have not been obtained from the data subject","GDPR Article 44-49 – Transfers of personal data to third countries","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","NIST SP 800-53 PT-5 (Privacy Notice)","NIST Privacy Framework PR.PO-P1 (Policies, processes, and procedures for managing data)","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management (Clause 7.3 – Obligations to PII Principals)","ITIL Service Design – Information Security Management (Privacy Policy Governance)",{},"published","2026-08-04T18:20:39.475676+00:00","2026-08-04T18:20:39.397+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=NAIH_(Hungary)_-_NAIH-450-7-2026&diff=52612&oldid=52611","naih-hungary-naih-450-7-2026-53a85f","NAIH (Hungary) - NAIH-450-7-2026",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[45],{"slug":46,"name":47,"problem":48},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]