Budapest Főváros Kormányhivatala XI. kerületi Hivatala
- Country
- Hungary
- Fine
- 10,000,000 HUF
- Date
- 2021-03-14
- Sector
- Government Office of the Capital's Xith district
- Articles
- Article 32(1)(a); GDPRArticle 32(1)(b) GDPRArticle 32(2) GDPRArticle 33(1) GDPRArticle 34(1) GDPR
Data breach resulting in a high risk to the rights and freedoms of natural persons
The Government Office transferred citizen health data without password protection to general practitioners who were not authorised to access such data, which constituted constitutes a personal data breach resulting in a high risk to the rights and freedoms of natural persons. The Hungarian DPA constituted that the emergency situation caused by the Covid-19 outbreak and the related public tasks of authorities do not exempt them from taking appropriate data security measures and from processing personal data lawfully in accordance with the GDPR.