Data Protection Authority Imposes Highest Post-GDPR Fine

The Hungarian National Authority for Data Protection and Freedom of Information (the "Authority" or "NAIH") recently imposed a fine of HUF 100m (approx. EUR 285,000) on one of the biggest electronic communication service providers Digi Távközlési Szolgáltató Kft. ("Digi"). This is the highest data protection fine imposed in Hungary since the entry into force of the GDPR and the highest ever fine levied in Hungary for a violation of data protection regulations.

An ethical hacker discovered a vulnerability affecting Digi's website, based on which it was possible to access a "test database" that contained a significant amount of personal and sensitive data of Digi's subscribers (e.g. name, data and place of birth, email address and password, bank account number, willingness to pay). The ethical hacker informed Digi of this vulnerability and Digi took corrective action and submitted a breach notification to the Authority within 72 hours as prescribed by the GDPR.