What kind of punishment can you expect if you handle your customers’ data incorrectly? What rules apply to universities? – Interview with Attila Péterfalvi.
I tried looking for your profile on markmyprofessor.com and couldn’t find yours or any other particular professor’s. What happened to this page?
I do not know. It’s true that I retired from the Public Service University at the end of the year – December 31, 2022 – but the website should still keep my data. I am currently an external lecturer at several universities. If it is possible to choose a subject taught by a university professor, the possibility of giving the students’ opinion about the lecturer should be made available on the above-mentioned page. The opinions expressed about the instructor can inform other students. The authority dealt with the question that if an instructor is no longer at the university, his/her subject cannot be chosen, the entire purpose of the course ceases to exist. I don’t think that the reason why I wouldn’t be on the site is because I retired, there could be some other problem on the website. I remember that there was a time when I was looking for something and it was very difficult to find it.
Observing the cases that you dealt with before, I find it strange that there were cases where there were names, and there were cases where they did not mention the names of those who were fined. What does it depend on?
From the point of view of fines, in the case of official proceedings, our Information Act contains a provision that regulates special procedural processes compared to public administrative procedures. As a kind of sanction, the authority may decide to name the data controller against whom the fine was imposed. If there is no such special provision, then by definition we must also make our decision public in an anonymized form.
Who got the biggest fine?
The biggest fine was issued to a bank whose name I will not mention now. We made the decision public anonymously, but the press found out which bank it was. This fine was due to non-GDPR compliant use of artificial intelligence. So we didn’t object to the use of artificial intelligence, just how they didn’t use it. HUF 250 million was the highest penalty imposed.
What risks do you see in the case of universities, what problems do they face?
I can’t really give you comparative data. What may arise in general is the publicity of theses, the way we identify the student in the exam, whether the student has access to his/her thesis, whether he/she can check the corrections, where cameras are installed etc. The authority’s position is that universities perform a public task, so from this point of view, it doesn’t matter whether they are foundation universities, church universities or state universities, their task is a public task. So their legal basis for data management is the performance of a public duty. Therefore, what is a legitimate consideration of interests at a company – the use of a camera or an access control system -, that is a public task at the university. This would mean that the legislator should regulate these things, but he did not do this. Universities must regulate these issues independently. Universities could – if someone were to unite them – adopt data management information that could be generally applied at all universities.
How does it feel to work at the headquarters of the most well-known secret service, which was taken over by the authorities?
We are more conveniently located. Since this was the headquarters of the Office of National Security, and then the Office of Constitutional Protection, the building has the features that are also important from our point of view. Due to our secret control authority, we also handle classified data, and there were available conditions – e.g. a mirror archive – which we also use, as well as other tools with which we write those classified decisions. It is easier to place them safely this way, not to mention the fact that the headquarters is in the city center, so close to the meeting places and the Parliament. But perhaps its greatest virtue is that it has its own parking space.
