The European Data Protection Board (EDPB) published on March 12, 2024, the outcome of the decision by the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), as issued on December 22, 2023, in which it imposed a fine of HUF 5,000,000 (approx. $13,860) to an airplane company for violations of the General Data Protection Regulation (GDPR), following a complaint of a data subject with the Polish data protection authority (UODO).

Background to the decision

The EDPB outlined that the data subject requested the airplane company to erase all their personal data in the online interface provided by the airplane company on October 23, 2018. According to the facts of the decision, the data controller proceeded to erase the data on November 23, 2018, but failed to inform the data subject prior to March 6, 2019. The data subject filed a complaint with the UODO. However, it was previously confirmed that the NAIH was the lead supervisory authority, and the case was therefore transferred to the NAIH.

Findings of the NAIH

The NAIH found that the airplane company infringed Article 5(1)(a) of the GDPR as the data subject was not presented with information on what additional data was processed, the purpose, the legal basis, and the length of time personal data was processed by the airplane company in relation to the data subject following the erasure of their account and the related personal data. In addition, the NAIH determined that the controller had violated Article 12(3) of the GDPR for the failure to inform the data subject of the action taken based on the request within the time limit. Finally, the NAIH also confirmed the violation of Articles 6(1) and 17(1)(a) of the GDPR.

Outcomes

Following the conclusions above, the NAIH ordered the airplane company to pay a fine of HUF 5,000,000 (approx. $13,860), and to erase the personal data processed regarding the exercise of the data subject's rights.

You can read the press release here.