This summary is not exhaustive and only contains the most significant modifications. The analysis goes beyond the scope of this newsletter and in case of request, we gladly provide you further information on essential content.
Following the entry into force of the GDPR last year, the amendment and harmonisation of several Hungarian laws became necessary, which was carried out by the legislator by adopting recently the Act XXXIV of 2019 on the legislative amendments required in order to implement the data protection reform of the European Union. The amendments entered into force on 26th April 2019. Out of the numerous detailed rules, the amendment of Act CXXXIII of 2005 on the protection of persons and property, and the activities of private detectives (hereinafter referred as: the “Act”’) is the most relevant in the view of the commercial entities.
1. THE RETENTION PERIOD OF THE RECORDINGS OF THE SET ELECTRONIC OBSERVATION SYSTEM
The Act regulated the retention period of the image and/or sound recordings produced by the applied electronic systems. According to the repealed regulation, the general retention period was 3 workdays, afterwards the recording had to be deleted (under certain circumstances, exceptionally the retention period could be 30 or 60 days).
From 26th of April 2019, the legislator excluded the detailed rules concerning the recordings by the electronic observation system. Instead of this, it declares that the reason and period of the recognition of the image and sound recordings during the operation of the electronic observation system, as well as the persons who acquired knowledge of it, shall be registered.
Bases on this, the Act does not include a limit for the retention period of the recording, because the records shall be retained only for the minimum period of time which is strictly necessary. For example, the recording of the territory of a depository could only be retained until the end of the inventory period. The documentation of these reasoning and the determination of the retention period is essential, considering the principle of accountability of the GDPR.
2. THE RULES RELATED TO THE APPROVAL TO THE APPLICATION TO THE SET ELECTRONIC OBSERVATION SYSTEM
The repealed regulations concerning the application of the electronic observation system included that the recording can only be made with the consent of the persons located at the controlled area. Implicit behaviour (e.g. entering into such area) was qualified as consent, if proper caution of the observation was placed (a sign of the surveillance). In addition, the Act established in detail which areas can be controlled by electronic observation systems.
With the amendment of the Act, the requirement of consent has been excluded, and regarding the method of the application, the Act only includes the following:
- the company shall only apply camera surveillance at private areas;
- camera surveillance is prohibited in all areas where the observation can violate human dignity, in particular in the following areas:
- in changing rooms,
- in fitting rooms,
- in bathrooms,
- in restrooms.
Because of the new rules of the Act, the conditions, from a data protection point of view, of the application of the electronic observation system will be determined by the GDPR, the regulations were excluded from the Act. We would like to highlight that in case of using an electronic surveillance system, it might be necessary to determine individually, which camera records which area, for how long the recording shall be retained, what the reason is behind the use, etc., in order to comply with the rules of the GDPR.
Based on the above, it might be appropriate to review the internal control standard concerning the camera surveillance.
This summary intends to raise awareness and does not constitute legal advice.
If you might have any question or need further information, please do not hesitate to contact us.