The Hungarian Data Protection and Freedom of Information Agency (Hungary DPA) has just released its 2016 enforcement priorities, stating that it will focus on (i) data processing relating to anonymous job postings and (ii) compliance with data subject notice requirements.
Anonymous job postings are illegal because the applicant has no information about the identity of the data controller behind such a posting. In its practice, the Hungary DPA considers that the data subject rights of job applicants always prevail over the employer's interest in remaining anonymous.
On the issue of data subject notice requirements, the Hungary DPA will enforce its 9 October 2015 detailed recommendation (Recommendation). In it, the Hungary DPA listed the information which the data controller must give to a data subject about the processing of his/her personal data in order for such a notice to be valid. Last year, when it issued the Recommendation, the Hungary DPA asked data controllers to review and amend their data privacy notices in line with the Recommendation, so it is not surprising that the Hungary DPA has chosen Recommendation enforcement as a 2016 priority.
In 2013, the Hungary DPA’s examinations focused on data processing activities relative to websites, in particular the processing of minors' personal data in the course of their registration with a website and on data processing in regard to debt management and recovery. In 2014, the Hungary DPA focused on product presentation events and continued to focus on data processing relative to debt recovery. In 2015, the Hungary DPA’s enforcement priorities were the data processing activities of debt collection agencies, data processing for product presentation events ("roadshows"), and data processing for telemarketing purposes.
The new enforcement priorities signal that the Hungary DPA will become more active in reviewing privacy notices and enforcing requirements concerning information which must be provided to data subjects. As well, employment agencies and employers might expect that the Hungary DPA will conduct test job applications and registration to examine data controller’s compliance with data protection requirements.