Sanction RGPD Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) — Hungarian political party : 34 k€ (2019)
- Autorité de contrôle
- Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)
- Pays
- Hongrie
- Entreprise / secteur
- Hungarian political party
- Montant de l'amende
- 34 k€
- Date de la décision
- 5 avril 2019
- Fondement juridique
- Art. 33 (1), Art. 33 (5), Art. 34 (1)
- Manquement
- Manquement à la notification de violation de données
Résumé des faits
NAIH imposed a fine of HUF 11,000,000 (EUR 34,375) on an undisclosed Hungarian political party for failing to notify the NAIH and relevant individuals about a data breach, and failing to document the breach according to GDPR Article 33.5. As mandated by law, the fine was based on 4% of the party's annual turnover and 2.65 % of its anticipated turnover for the coming year. The breach was the result of a cyber attack by an anonymous hacker who accessed and disclosed information on the vulnerability of the organisation’s system – a database of more than 6,000 individuals – and the command used for the attack. The system was vulnerable to attack because of a redirection problem with the organisation's webpage. After the attacker published the command, even people with low IT knowledge were able to retrieve information from the database.
Décision officielle
Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)