University of Szeged

Summary

The Hungarian DPA has imposed a fine of EUR 5,570 on the University of Szeged. The controller operates student housing. To determine which students would receive a place, the university processed the personal data of applicants, including health data, to determine their social circumstances, which had to be taken into account in the decision-making process according to local law. However, the controller processed the data in an excessive manner. Rather than collecting only the necessary information, the controller often collected entire supporting documents containing information not necessary for the decision. In particular, with regard to special category data, the controller collected documents containing far more sensitive information than was necessary for the purpose. Additionally, the university failed to provide adequate privacy information.