Privacy Notice on the processing of data
1. Identity of the controller and place of processing
Name of the controller: National Media and Infocommunications Authority (hereinafter the “NMHH” or “controller”)
Registered office: H-1015 Budapest, Ostrom utca 23-25.
Tax number: 15775883-2-41
Contact details: sajto@nmhh.hu;
Telephone number: +36 1457 7945
Represented by: Dr. András Koltay, President
2. Contact details of the Data Protection Officer
Address: H-1015 Budapest, Ostrom utca 23-25.
E-mail address: info@nmhh.hu
The DPO will assist with any questions or comments related to the processing of data.
3. On the data processing operations carried out
(A) The NMHH regularly informs the public in connection with its official activities and the fulfilment of its responsibilities in the field of media and communications, as well as the performance of its other tasks to be carried out in the public interest, and organises professional events in this context.
(B) The NMHH also organises events, ceremonial activities and festivities beyond this.
| Type of processing | Purpose of processing | Legal basis of processing | Scope of the data processed | Source of data | Duration of data storage | Recipient |
|---|---|---|---|---|---|---|
| 3.1 Communication with invited speakers for the event | Communication with the speakers as part of the organisation of the presentations for the event |
In the case of events organised under section (A): The processing is based on Article 6(1)(e) of the GDPR, i.e. it is necessary for the performance of the NMHH’s tasks carried out in the public interest, in particular with regard to the provisions of Section 110(a) to (d)[1], Section 182(p)[2], Section 183(a) to (c), (h) and (q)[3] and Section 184(2)(c) [4] of Act CLXXXV of 2010 on Media Services and on the Mass Media (hereinafter the “Media Act”). In the case of events organised under section (B): The processing is based on Article 6(1)(f) of the GDPR, i.e. the NMHH’s legitimate interest in organising the event and thus being able to hold the event in question. |
The data subject’s name (surname and first name), e-mail address and position, and the name of the legal entity represented by the data subject. |
The personal data are obtained from the data subject or from public sources accessible to anyone. | The personal data of the data subject will be deleted within a maximum of 14 days after the event. | - |
| 3.2 Processing of data in connection with the sending of invitations to events | Raising awareness of the event, inviting people to attend, inviting them to register, and, through these, informing potential participants. |
In the case of events organised under section (A): The processing is based on Article 6(1)(e) of the GDPR, i.e. it is necessary for the performance of the NMHH’s tasks carried out in the public interest, in particular with regard to the provisions of Section 110(a) to (d), Section 182(p), Section 183(a) to (c), (h) and (q) and Section 184(2)(c) of the Media Act. In the case of events organised under section (B): The processing is based on Article 6(1)(f) of the GDPR, i.e. the NMHH’s legitimate interest in promoting its event, inviting people to attend, informing potential participants and thus being able to hold the event in question. |
The data subject’s name (surname and first name), e-mail address and position, and the name of the legal entity represented by the data subject. | The personal data are obtained from the data subject or from public sources accessible to anyone. | The personal data of the data subject will be deleted within a maximum of 14 days after the event. | - |
| 3.3 Processing of data during registration for the event-Registration and identification of the data subject, communication with the persons applying for the event, including the provision of information about the event, as well as admission to the event venue (identification) and assessment of the expected number of participants. | Registration and identification of the data subject, communication with the persons applying for the event, including the provision of information about the event, as well as admission to the event venue (identification) and assessment of the expected number of participants |
In the case of events organised under section (A): The processing is based on Article 6(1)(e) of the GDPR, i.e. it is necessary for the performance of the NMHH’s tasks carried out in the public interest, in particular with regard to the provisions of Section 110(a) to (d), Section 182(p), Section 183(a) to (c), (h) and (q) and Section 184(2)(c) of the Media Act. In the case of events organised under section (B): The processing is based on Article 6(1)(a) of the GDPR, i.e. the consent of the data subject, given in an explicit form by applying online (by e-mail or through another interface managed by the NMHH) or by registering on the spot for the event in question. |
The data subject’s name (surname and first name), e-mail address, telephone number and position, and the name of the legal entity represented by the data subject. | The data subject. | The personal data of the data subject will be deleted within a maximum of 14 days after the event. | - |
| 3.4 Processing of data in connection with the provision of a special diet | Assessing special dietary needs and ensuring they are catered for at the event. | The processing is based on Article 6(1)(a) of the GDPR, i.e. the consent of the data subject, subject to Article 9(2)(a) of the GDPR. | The data subject’s name (surname and first name) and details of their food allergy (food intolerance). | The data subject. | The personal data of the data subject will be deleted within a maximum of 14 days after the event. | - |
| 3.5 Processing of data in connection with the keeping of an attendance sheet at the event | Verification of the number and scope of participants in the event for accounting purposes and the controllability of the NMHH’s activities. |
In the case of events organised under section (A): The processing is based on Article 6(1)(e) of the GDPR, i.e. it is necessary for the performance of the NMHH’s tasks carried out in the public interest, in particular with regard to the provisions of Section 110(a) to (d), Section 182(p), Section 183(a) to (c), (h) and (q) and Section 184(2)(c) of the Media Act. In the case of events organised under section (B): The legitimate interest of the NMHH in the controllability of its activities pursuant to Article 6(1)(f) GDPR. |
The data subject’s name (surname and first name) and position, the name of the legal entity represented by the data subject, and, where applicable, the data subject’s signature. | The data subject. |
In the case of events organised under section (A): The personal data of the data subject will be deleted within a maximum of 14 days after the event. In the case of other events, i.e. events not organised as part of performance of its tasks carried out in the public interest: The personal data of the data subject will be deleted within a maximum of 14 days after the event. |
- |
| 3.6 Processing of data in connection with the production, publication and use of recordings made at events [5] | The purpose of the recordings is to document the NMHH’s events and to retain them in the NMHH’s internal archives. Some of the recordings will also be published on the NMHH’s own website, and used to produce a written summary news item or entry as part of the report on the event. |
In the case of events organised under section (A): In the case of crowd recordings, the processing is based on Article 6(1)(e) of the GDPR, i.e. it is necessary for the performance of the NMHH’s task carried out in the public interest, in particular with regard to the provisions of Section 110(a) to (d), Section 182(p), Section 183(a) to (c), (h) and (q) and Section 184(2)(c) of the Media Act. In the case of recordings that are not crowd recordings, the processing is based on Article 6(1)(a) of the GDPR, i.e. on the consent of the data subject. In the case of events organised under section (B):In the case of crowd recordings, the processing is based on Article 6(1)(f) of the GDPR, i.e. the NMHH’s legitimate interest in recording and documenting its events, proving that the events took place, publicising them as widely as possible and thus presenting its activities. In the case of recordings that are not crowd recordings, the processing is based on Article 6(1)(a) of the GDPR, i.e. on the consent of the data subject. |
The data subject’s image or voice and, where applicable, their name (surname and first name). | The data subject. | In the case of events organised under section (A): In the case of crowd recordings: the NMHH will retain the processed data for archiving purposes in the public interest, as archival value, pursuant to Article 5(1)(e) and Article 89(1) of the GDPR. In the case of recordings that are not crowd recordings: the NMHH will process the data until the data subject’s consent is withdrawn.In the case of events organised under section (B): In the case of crowd recordings: the NMHH will retain the recordings that are historically significant, of public interest and therefore worthy of being retained for posterity for archiving purposes in the public interest, as archival value, pursuant to Article 5(1)(e) and Article 89(1) of the GDPR. Other recordings will be retained by the NMHH for up to 5 years after the event. In the case of recordings that are not crowd recordings: the NMHH will process the data until the data subject’s consent is withdrawn. | The hosting provider of the NMHH’s website and KreaFilm Kft (company registration number: 07-09-030955; registered office: H-2451 Ercsi, Búzavirág utca 6/7.), the company contracted to make image and sound recordings at the event, will be used as processors. |
| 3.7 Processing of data in connection with the management of the press list or reaching the professional public [6] | To facilitate the provision of information on professional events, happenings and news related to the performance of the NMHH’s tasks carried out in the public interest and of public and press attention, to increase the efficiency of public information, and, to this end, to maintain professional contacts with employees and representatives of the press and the professional public. | The processing is based on Article 6(1)(e) of the GDPR, i.e. it is necessary for the performance of the NMHH’s tasks carried out in the public interest, in particular with regard to the provisions of Section 32 of the Privacy Act[7]. In addition to the performance of tasks carried out in the public interest, the processing is based on Article 6(1)(f) of the GDPR, i.e. the NMHH’s legitimate interest in facilitating the provision of information on events and activities of press attention and in communicating with data subjects for this purpose. | The data subject’s name (surname and first name), e-mail address, telephone number and position, and the name of the newspaper or newsroom represented by the data subject. | The personal data are obtained from public sources accessible to anyone or from the data subject. | Until the data subject objects. | - |
[1.] Media Act, Section 110 The Authority shall, with regard to the communications sector, as provided for in a separate Act, a) comment on requests and proposals for legislative proposals and amendments to legislation falling within its competence; b) assess and continuously analyse the functioning of the communications and related information technology market; c) continuously assess the situation of the communications market and prepare comparative analyses thereof; d) conduct market analysis.
[2.] Pursuant to Section 182(p) of the Media Act, the Media Council shall conduct a media market sector inquiry in accordance with Section 132 of the Media Act.
[3.] Media Act, Section 183(1) When acting in a capacity other than that of a public authority, the Media Council shall, in accordance with Section 132: a) draw up a recommendation on the classification of media content for the protection of minors; b) draw up a recommendation on the requirements for an effective technical solution to allow access to media content only for viewers or listeners over eighteen years of age; c) have the right to publish its recommendation on ensuring the conformity of product placement and the relevant call with the provisions of this Act; h) draw up positions and proposals on certain media policy issues; q) compile a list of events of major importance to society.
[4.] Pursuant to Section 184(2)(c) of the Media Act, the Office when acting in a capacity other than that of a public authority, shall perform market analysis, assessment and other inquiries by the programme monitoring and analysis service.
[5.] The NMHH may make image and sound recordings of the participants at its events, which recordings may be published on its own Internet sites, and may use them to prepare written summary news and entries.
The recordings may be made and published as crowd recordings, or as recordings in which only some of the data subjects or only the data subject appears.
[6.] In accordance with the provisions of its Rules of Organisation and Operation, the NMHH cooperates with the media organs and other participants of the professional public, within the framework of which it proactively organises and manages publications about the organisation, maintains active contacts with journalists and other representatives of the professional public, and organises and holds press conferences. The NMHH keeps a record of press contacts for communication purposes.
[7.] Privacy Act, Article 32 Organs performing public duties shall promote and ensure that the general public is promptly provided with accurate information on matters within their scope of duties, in particular on the budgets of the State and local governments and their implementation, the management of assets controlled by the State and local governments, the proper use of public funds and contracts concluded in connection therewith, as well as on special and exclusive rights granted to market operators, private organisations or individuals.
4. The main rights of the data subject in relation to processing
The data subject may, in connection with the processing, at any time:
- request information on the processing,
- request access to data processed concerning him or her,
- request the rectification of inaccurate data or completion of incomplete data,
- object to the processing of his or her data,
- request the restriction of processing.
On the basis of a request for information, the data subject has the right to know, unless it is restricted by a legitimate interest, whether his or her personal data are being processed by the controller and has the right to obtain information about the processing of data concerning him or her, in particular
- the purposes for which the controller processes them,
- what gives the controller the right to process the data (legal basis),
- from when and for how long the controller will process his or her data (duration),
- what data are processed by the controller and a copy of the data processed shall be made available to the data subject,
- the recipients of the personal data and the categories of recipients,
- transfer to a third country or international organisation,
- his or her rights as a data subject in relation to the processing,
- about his or her legal remedies.
The controller shall respond to requests for information and access within one month at the latest. The controller may charge a reasonable fee, based on administrative costs, for additional copies of personal data concerning the data subject that are requested.
In the case of a request for rectification (change) of data, the data subject must substantiate the accuracy of the data to be changed and must also certify that he or she is the person who is entitled to request the change of data. This is the only way for the controller to assess whether the new data is real and, if so, whether the old data can be changed.
If it is not clear whether the data processed is correct or accurate, the controller will not rectify the data, but will only mark it, i.e. the controller will indicate that it has been objected to by the data subject, but it may not be incorrect. The controller shall, without undue delay, rectify inaccurate personal data or supplement the data concerned by the request, after confirming the authenticity of the request. The controller shall notify the data subject of the rectification or marking.
In case of a request for erasure or blocking of data, the data subject may request the erasure of his or her data, which means that the controller shall have the obligation to erase the data concerning the data subject without undue delay if:
- the personal data have been unlawfully processed;
- the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
- the personal data are no longer necessary for the purposes for which they were processed;
- the controller is under a legal obligation to erase the data and has not yet done so.
The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:
- the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
- the data subject has objected to the processing pending the verification whether the legitimate grounds of the controller override those of the data subject.
The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Article 6(1)(e) or (f). The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where data are processed under Article 6(1)(a) of the GDPR, i.e. on the data subject’s consent, the data subject shall have the right to withdraw his or her consent at any time by sending a written request to info@nmhh.hu. In this case, the personal data provided or submitted on consent will be erased. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State. The controller shall inform the data subject before the restriction of processing is lifted.
Where the data subject considers that the processing infringes the provisions of the GDPR or Act CXII of 2011 on the Right to Information Self-Determination and Freedom of Information, or if he or she considers that the way in which the controller is processing his or her personal data is prejudicial, we recommend that the data subject should, in the first instance, contact the controller directly with a complaint. Your complaint will always be investigated.
If, despite your complaint, you still complain about the way the controller is processing your data, or you wish to contact the authority directly, you may lodge a complaint with the National Authority for Data Protection and Freedom of Information (address: H-1055 Budapest, Falk Miksa utca 9-11.; postal address: H-1363 Budapest, Pf. 9.; e-mail: ugyfelszolgalat@naih.hu, website: www.naih.hu).
You have the possibility to bring an action before the court to protect your data, which will rule on the case out of turn. In this case, you are free to decide whether to bring an action before the regional court of your place of domicile (permanent address) or residence (temporary address) (https://birosag.hu/torvenyszekek).
You can search the court of your place of domicile or residence at https://birosag.hu/ugyfelkapcsolati-portal/birosag-kereso.