Data management information for international observers

I. Data manager

National Election Office

Head office: 1054 Budapest, Alkotmány u. 3. VAT number: 15815563-1-41

E-mail: adat@nvi.hu

Website: www.valasztas.hu

Contact details of the Data Protection Officer of the Data Controller: dr. Edina Kéki Data Protection Officer, e-mail: keki.edina@nvi.hu

II. Scope of personal data processed:

Mandatory personal data of an international observer registered with the National Election Office (hereinafter referred to as "the person concerned"):

a) name of the person concerned

b) the delegator;

c) the place and date of birth of the person concerned.

Not mandatory personal data

a) contact details of the person concerned: e-mail address, telephone number

III. Purpose of data management:

The Data Controller fulfills its obligation under Article 4 (2) of Act XXXVI of 2013 on Electoral Procedure ("Act XXXVI of 2013")

IV. Legal basis for data management:

Law on electoral procedure § 4 (2)

With regard to the data to be provided, Article 6(1)(e) of the GDPR (processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller - Article 6(1)(e) of the GDPR) applies. Article 4(2)), for the processing of personal data for the purpose of contacting the data subject, the data subject's consent pursuant to Article 6(1)(a) for the processing of personal data which are not compulsory.

V. Duration of storage of the personal data processed:

The Data manager shall process the mandatory data required for registration until the working day following the ninetieth day after the voting day, and the non-mandatory (contact) data until the withdrawal of the data subject's consent.

The Data manager shall take appropriate measures to protect the processed mandatory and non- mandatory personal data against, in particular, accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, or accidental damage and inaccessibility resulting from changes in the technology used.

VI. Recipients of personal data:

The National Election Office as data controller and Idomsoft Zrt. as data processor.

VII. Transfers to third countries or international organisations:

As a data controller, the National Election Office does not transfer personal data to third countries or international organisations.

VIII. Information on the rights of the person concerned:

The person concerned shall have the following rights in relation to data processing, insofar as the nature and legal basis of the processing make it reasonable:

Right to be informed:

The person concerned has the right to know the relevant circumstances of the processing of his or her personal data, as detailed in Article 13 of the GDPR, which the controller facilitates by providing this information.

Right of access:

The right of access ensures that the data subject is informed whether or not his or her personal data are being processed by the controller, in which case he or she has the right to access the personal data processed by the controller and to be informed of the modalities of the processing listed in Article 15 of the GDPR.

Right to rectification:

The data subject may obtain from the controller without undue delay the rectification of inaccurate personal data concerning him/her, or have incomplete data personal data completed.

Right to data portability:

The person concerned shall have the right to obtain the personal data concerning him or her which he or she has provided to the controller, to transmit such data to another controller or to request the direct transfer of personal data between controllers.

Right to erasure (right to be forgotten):

The person concerned may request the data manager to cease processing his or her personal data, in which case the data manager shall render the personal data irretrievably unidentifiable, so that the link between the information and the person concerned can no longer be established.

The right to erasure may be exercised when the processing of personal data by the controller is no longer necessary, taking into account the principles of purpose limitation, data minimisation and limited storage.

The person concerned may also request the erasure of his or her personal data if:

a) the data management is illegitimate

b) personal data are collected in relation to information society services offered directly to children,

c) the person concerned withdraws his or her consent,

d) the person concerned objects to the processing of his or her personal data,

e) it is required by law.

Right to restriction of processing:

The person concerned may request the data manager to restrict processing if:

a) contests the accuracy of your personal data,

b) considers that the processing of his personal data is illegitimate and requests the restriction of the processing of his personal data instead of the erasure of his personal data,

c) the processing of personal data by the data manager is no longer necessary, but they are required by the data subject in order to pursue a legal claim,

d) the data subject objects to the processing of his or her personal data.

In such a case, the data manager must block the personal data, for example by temporarily transferring the personal data to another data manager, by terminating user access to the data or by temporarily removing the data, and no processing operation may be performed on the personal data. The restriction does not completely remove the controller's control over the personal data.

In case of restriction, personal data may be further processed only with the consent of the person concerned, for the purpose of pursuing legal claims or protecting the rights of others, or for important public interests. All recipients to whom or with whom the personal data have been disclosed must be informed of the restriction of processing. The controller shall inform the data subject in advance of the lifting of the restriction on processing.

Right to object:

The person concerned may object to the processing of his or her personal data at any time if:

a) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the National Election Office, or if it is necessary for the legitimate interests of the National Election Office or a third party,

b) if the personal data is processed for direct marketing purposes (not applicable to the present processing),

c) the personal data is processed for research or statistical purposes (not applicable to the present processing).

The data manager shall no longer process the personal data in the event of the person concerned’s objection and shall erase the personal data unless it can demonstrate compelling legitimate grounds overriding the interests, rights and freedoms of the person concerned, or relating to the establishment, exercise or defence of legal claims.

Right to legal redress:

The person concerned shall have the right to lodge a complaint against the data manager's processing of his or her personal data and to have recourse to the courts.

Right to lodge a complaint: the person concerned has the right to lodge a complaint if he or she considers that the processing of personal data concerning him or her infringes the provisions of the GDPR. Complaints can be submitted to the Authority for Data Protection and Freedom of Information as supervisory authority using one of the following contact details:

Location: 1055 Budapest, Falk Miksa utca 9-11.

Postal address: 1363 Budapest, Pf.: 9.

Telephone: +36 (30) 683-5969; +36 (30) 549-6838; +36 (1) 391 1400

Fax: +36 (1) 391-1410

E-mail: ugyfelszolgalat@naih.hu

Website: http://www.naih.hu

If the person concerned suffers damage in the exercise of his or her rights in relation to the processing of his or her personal data (e.g. he or she has not been able to exercise the above rights, has not been informed about the processing, etc.), he or she may bring a lawsuit. The data subject may also choose to bring the case against the National Election Office before the courts of the place of residence or domicile. In the lawsuit, the National Election Office, as the data controller, has the burden of proof that it has acted in accordance with the relevant domestic legislation and the EU law.

Right to withdraw consent to data management:

In case of processing based on Article 6(1)(a) of the GDPR, the person concerned may withdraw his or her consent at any time, it does not affect the lawfulness of the data processing carried out on the basis of consent before its withdrawal.

IX. Possible consequences of non-disclosure:

The National Election Office may refuse the international observer to register.

Annex: Declaration