On 6 July 2015, the Hungarian Parliament adopted several amendments (‘Amendments’) to Act CXII 2011 on the Right of Informational Self-Determination and the Freedom of Information (‘Data Protection Act’). The Amendments, currently only available in Hungarian, are designed to develop the data protection and right-to-access public information rules within Hungary, and fix problems the Hungarian authorities have experienced since the Data Protection Act came into force in 2012.

Three main changes will be introduced by the Amendments. The Amendments:

  1. Recognise Binding Corporate Rules (‘BCRs’), and offer an option that would allow Hungarian companies to undertake intra-group transfers outside the EEA, and allow companies already using BCRs to extend them to include Hungary. Hungary, however, is not part of the mutual recognition process, which allows other European authorities to accept transfers where the lead data protection authority acknowledges that an organisation’s BCRs meet the necessary requirements.  As a result, the Hungarian data protection authority (‘DPA’) must review and approve the BCRs before they are able to be relied upon in Hungary.
  2. Require all companies to maintain an internal register which records all data breaches that occur, including those involving a data processor, and how the breach was dealt with by the organisation.
  3. Provide the DPA with greater enforcement powers to control and regulate data breaches. The maximum amount of fines that can be imposed has been doubled to 20 million forints (approx. £45,500), and the DPA will be able to establish infringement even if compliance was achieved before the end of the investigation. The DPA has also been granted further powers to publish any enforcement decision it makes.

A lack of data protection regulation previously has led to a competitive disadvantage for Hungary so these Amendments, expected to come into force later this year, have been welcomed by privacy professionals as they represent another step forward for Hungary’s data protection regime.