Hungary

I&S Limited Kft

80,500 €

GDPR enforcement action by Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) on 2023-02-06.

Rank · Sector

of 100 in Accomodation and Hospitality

Rank · Hungary

#11

of 75

Rank · All fines

#523

of 3,050

Case details

Authority: Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)
Date: 2023-02-06
Controller / Processor: I&S Limited Kft
Sector: Accomodation and Hospitality
Quoted Articles: Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR, Art. 9 (2) GDPR, Art. 13 (1), (2) GDPR, Art. 24 GDPR, Art. 25 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Hungarian DPA has imposed a fine of EUR 80,500 on the spa operator, "I&S Limited Kft". During its investigation, the DPA found that the controller had installed video surveillance cameras in its premises, which permanently monitored guests and employees. The DPA found that the controller did not have a valid legal basis for such extensive video surveillance. The controller also failed to properly inform the data subjects about the processing of their personal data. Furthermore, the controller had processed data of customers for marketing purposes without a valid legal basis.

Open original source Links to the regulator's original publication or another source.