In one of its most significant decisions relating to data protection, published in November 2021, the Hungarian Supreme Court declared that the data protection authority (DPA) is not entitled to impose a fine in data protection procedures if the DPA substantially exceeds the statutory time limit applicable to its own procedures.
In the case at hand, the DPA initiated proceedings against the claimant (the data processor) on 19 November 2018 and issued its final decision on 15 July 2020. In its decision, the DPA established an infringement, ordered the claimant to take certain actions and imposed a fine of 5,000,000 forints (approximately €14,000).
It is worth noting that:
- at the time of the procedure, the statutory time limit for data protection procedures was 120 calendar days, which means that the DPA was supposed to finish its procedure within this time limit; and
- the Act on General Public Administration Procedures (a national law applicable to authority proceedings in general) stipulates that authorities are not allowed to impose penalties if they have exceeded twice the duration of the administrative time limit applicable to their procedures. In such cases, they may establish infringements and order the parties to comply with the laws or terminate the infringement, but they may not impose material penalties (such as fines).
Considering that, in the case at hand, the authority had substantially exceeded the relevant time limit (the decision was rendered in 604 days instead of 120), the imposition of the fine was debated, and it was also questioned whether such national provision could be applicable instead of the provisions of the EU General Data Protection Regulation (GDPR).
The claimant challenged the DPA's decision and sought the annulment of the fine, or alternatively the amendment of the decision by substantially reducing the fine. The claimant referred to the violation of the principle of legality (to complete the procedure within a reasonable time) and the right to an effective procedure, as well as of preambles 129 and 148, and articles 58(4) and 83(8) of the EU GDPR, which prescribe that national authorities must comply with the procedural guarantees laid down by national and EU law. Furthermore, the claimant referred to the aforementioned rule in the Act on General Public Administration Procedures. The rule prohibits the imposition of fines if authorities exceed twice the time limit applicable for the relevant procedure.
Both the regional court (at first instance) and the Supreme Court (at second instance) found the applicant's legal arguments to be correct and partially annulled the DPA's decision relating to the fine. The courts considered that by failing to finish the procedure on time, the DPA had infringed the claimant's right to legal certainty, which is supposed to be guaranteed in administrative procedures by time limits (among others).
The courts also considered that limiting the DPA's right to impose fines as per national procedural law does not contradict the provisions of the EU GDPR or EU law. The courts agreed that the EU GDPR itself stipulates that supervisory authorities' powers must be subject to appropriate procedural safeguards in accordance with EU and member state law.
Aside from this particular case, it is true that the completion of data protection procedures often takes a long time. To address this issue, the latest amendments of Hungarian data protection laws have increased the time limit for DPA procedures from 120 to 150 days and excluded some time periods (eg, the time in which parties provide requested information to the DPA) from the limit.
Though these amendments point in the direction of prolongation, rather than acceleration, of the procedures, the above precedent-setting decision of the Supreme Court will hopefully inspire the authorities to complete procedures within the time limits specified by law. At the same time, the legislative changes also aim to limit companies' possibilities to prolong data protection procedures in an attempt to avoid fines.
For further information on this topic please contact Dániel Gera or Ákos Kovács at Schoenherr Hungary by telephone (+36 1 8700 700) or email ([email protected] or [email protected]). The Schoenherr website can be accessed at www.schoenherr.eu.