Case no.:NAIH-…………/2021.
NAIH/2020/3232.
Hamburg Commissioner for Data Protection and Freedom of Information
(Der Hamburgische Beauftragte für Datenschutz- und Informationsfreiheit)
To be delivered via IMI-System
Budapest, July ____, 2021
To Whom It May Concern,
A complaint has been lodged with the Data Protection Authority of Hamburg, in which an
anonymous complainant objected to the data processing of Ltd.
(hereinafter referred to as Ltd.). According to the complaint, the Ltd. disclosed the e -mai l address
of the complainant on the website of (hereinafter referred to as: website), whi ch
resulted for the complainant to receive a large number of unsolicited e-mails. Furthermore,
according to the complaint, the source code of the website contained e -mail addresses rel ati ng to
numerous other companies, and the complainant presumed that the consents of the mentioned
companies were missing as well. The complainant further stated that the Ltd. operated other
similar websites (the complaint lacked more precise information) on which numerous e-mail
addresses appeared.
In the procedure set out in Article 56 of the general data protection regulation (GDPR)1 for the
designation of lead and concerned supervisory authorities, under the number of IMI-114383 the
Data Protection Authority of Hamburg designated the Hungarian National Authority for Data
Protection and Freedom of Information (hereinafter referred to as "the Hungarian Authority") to be
the lead authority. In this procedure the Hungarian Authority agreed thereto, as according to the
publicly available domain registry, the registered user of the website on April 1, 2020 was the Ltd.
As according to the Hungarian official company register the Ltd. was indeed a commercial
business entity registered under the seat of , . , and
having regard to the registered seat (probably the main place of operation) the Hungarian
Authority’s presumption was that it shall act as lead Authority in accordance with Article 56. 1 of
the GDPR.
Thereafter, the Hungarian Authority commenced an investigation pursuant to Article 57. 1. (f) of the
GDPR and Section 38. 3 (a) of the Act CXII of 2011 on the right to informational self-determination and
on the freedom of information (hereinafter "the Act CXII of 2011").
During the investigation, the Authority viewed the website several times and saved the webpages
(for the first time on April 1, 2020), the website advised its visitors that it was in under maintenance
operation, however, simultaneously several e-mail addresses appeared on the website, and some
of those probably were of real natural persons. In addition thereto, the website provided the
information that these e-mail addresses were spam traps to spam bots (sending unsolicited
advertising messages or placing unsolicited advertisements), and warned the visitors as follows:
1
RE GULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT A ND OF T HE COUNCIL of 27 A pril 2016 on the protection of natural p e r so n s w i t h
regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General D ata Protection Regulation)
………………………………………………………………………………………………………
1055 Budapest Tel.: +36 1 391-1400 [email protected]
Falk Miksa utca 9-11. Fax: +36 1 391-1410 www.naih.hu
(„These are spam traps to spam bots. Do not send any e-mails to them otherwise your address will
be added to spam lists.”)
On May 13, 2020 the Authority contacted the Data Protection Authority of Hamburg in a mutual
assistance procedure referred to in Article 61 with a request registered under the case no. of IMI-125264
to upload the complaint to the IMI-system, and, if available, the English translation thereof. The
reason of the request – which the Hungarian Authority also communicated – was to clarify whether
the subject of the complaint was the data processing of the Ltd. in general or only with regard to
complainant’s own case. By referring to the fact that the website was under maintenance
operation, as mentioned above, the Hungarian Authority required the statement of the complainant
as to whether the complainant would maintain or, under a certain circumstance, wi thdraw hi s/her
complaint (as it could not be established as to in which timeframe was the content objected ). T he
deadline for complying with the request of the Hungarian Authority was June 13, 2020, however,
as the Authority of Hamburg did not react to this request, the Hungarian Authority sent a remi nder
on June 26, 2020 via e-mail to the address of . The Hamburg
Authority on July 16, 2020 informed the Hungarian Authority via the case register opened under
the registration no. of IMI-138412 that the Complainant did not wish to have his/her personal data
forwarded to Hungary (to the Hungarian Authority), and that the concerned Authority of Hamburg
was not in a position to decide whether the complainant is a directly concerned data subject, as the
complainant’s e-mail address did not appear among the e-mail addresses in the source code of the
website. However, as the source code contained more that 2900 .de extension e-mail addresses,
and some of those contained personal data as well (<first name>.<family name>@domain.de), the
opinion of the Authority of Hamburg was that such addresses needed to be eliminated from the
website as soon as possible. The Authority of Hamburg did not know as to what purpose could the
display of several thousand e-mail address serve.
Thereafter, the Hungarian Authority in order to assemble the bearings of the case sent an inquiry
to the Ltd. in which it asked
1. the Ltd. to present its operation in connection with the website;
2. whether the Ltd. had previously determined or at that time determined the content, the
contact details, and the personal data on the website, in particular the e-mail addresses, or
had previously defined or at that time defined the purposes of the processing of personal
data appearing thereon, in other words, could the Ltd. be identified as data controller in
connection with the website. If the answer was to be negative, the Hungarian Authority
requested the Ltd. to provide information on the identity of the data controller person/enti ty
and the postal or electronic contact details thereof;
3. as to what were the sources of the personal data accessible on the website; what were the
legal basis of the data processing pursuant to Article 6.1 of the GDPR; what was the
purpose of the data processing; and what was the time period of the processing of these
personal data;
4. as to how had previously or at that time informed the Ltd. the data subjects using the e-mail
addresses accessible on the website of their rights in compliance with Article 12 -14 of the
GDPR,
5. as to how had previously ensured or at the time ensured the Ltd. the data subjects’ rights
according to GDPR Chapter III in connection with the personal data accessible on the
website.
Apart from those above, the Hungarian Authority requested the Ltd. to inform the Hungarian
Authority of any fact or circumstance which might have merit in the case.
2
The answer of the Ltd. arrived on September 8, 2020 to the Hungarian Authority and i t answered
to the questions in their posed order as follows:
1. The Ltd. had no knowledge of the mentioned domain, the domain had never been
under its control. According to the statement of the Ltd., it had not registered by the
given domain service provider, but later, during the communication with the Authority, it
did, and based on the experience of the Ltd., there were not any control regardi ng the
identity of the domain registrant. As per the statement of the Ltd., its affiliate partners
also had not registered the website on behalf of the Ltd.
2-5. The Ltd. did not know of the content of the website, it did not process the e -mail
addresses forwarded by the Hungarian Authority (the Authority attached to its inquiry
the content available at the time of the inquiry).
Thereafter, the Hungarian Authority revisited the website, and as per its state on December 1,
2020, the previous content which was accessible during the procedure carried out pursuant to
Article 56. of the GDPR had been eliminated (saved pages thereof attached); according to the data
available on December 1, 2020 of the publicly accessible domain registry, the user of the websi te
was a natural person, , located in another town in Hungary, who, accordi ng
to the Hungarian official company register, was neither a member nor an executive officer of the
Ltd.
Based on the information available to the Hungarian Authority, the data controller cou ld not be
identified, therefore, the Authority’s opinion is that the competence of the Hungari an Authori ty to
act as lead supervisory authority cannot be established pursuant to Article 56.1 of the GDPR. As
the efforts of the Hungarian Authority to identify the data controller were of no avail, and as it
cannot carry out further investigation, and additionally, as the objected content is no longer
available, the Authority closes the case.
Sincerely,
Attila Péterfalvi, PhD.
President
Honorary Professor
3