Act CXIX of 1995
on the Use of Name and Address Information Serving the Purposes of
Research and Direct Marketing
Parliament - based on the principle that
according to the Constitution the Republic of Hungary extends the right to the
protection of personal data, as well as the right to conduct scientific
research, freedom of opinion and the conditions of a market economy; in
consideration of Act LXIII of 1992 on the Protection of Personal Data and the
Publicity of Information of Public Interest, Treaty No 108 of the European
Council on the protection relating to the automatic handling of private and
personal data, and the Recommendations of the European Council - passed the
following Act on the use of name and address information serving the purposes
of research and direct marketing:
I.
General Provisions
Section 1.
(1) The scope of this Act shall include the
natural and legal persons, and the organisations without legal entity,
requesting or using name and address information for the purpose of
establishing contact for scientific research, public opinion survey, market
research and direct marketing reasons.
(2) The scope of this Act shall not be extended
to research activities conducted in accordance with Act LXVI of 1995 on the
Protection of Public Documents, Public Archives and Private Archive Materials.
Section 2.
(1) In the scope of this Act:
1. Scientific
research: an activity with the objective to increase knowledge of the
world, its meaning and of the correlation of its manifestations, for which name
and address information or direct contact with private individuals is necessary
in order to explore the objective correlation of the surveyed social, economic
and natural circumstances.
2. Public
opinion survey: studying the opinion of individuals and groups of people
(hereinafter referred to as subject parties) and the motives behind their
judgement.
3. Market
research: studying the consumer habits of subject parties.
4. Direct
marketing: the aggregate term for information activities and secondary
services executed by direct approach for the purpose of offering products or
services to subject parties, as well as for conveying commercial
advertisements, and providing information to consumers and business partners in
order to promote sales.
5. Direct
marketing list (hereinafter referred to as marketing list): a collection of
name and address information for establishing and maintaining contact with
subject parties and with business partners for the purposes of direct
marketing. In addition to the name and address information, such list may only
contain information on the fields of interest of clients and sponsors.
6. Prohibitive
list: records of name and address information on subject parties who did
not consent to their personal data being used for any of the direct marketing
purposes as defined in this Act, or who have prohibited further use of such
data for said purposes.
7. Scientific
researcher: the natural person with a degree or title in science, being
involved in scientific activities in his particular field or branch of science;
as well as the person involved in scientific research according to a
certificate received from an organisation pursuing scientific projects or from
a foundation sponsor.
8. Public
opinion survey, market research or direct marketing organisation: the
natural and legal person or the organisation without legal entity entitled to
perform the activities as defined in Points 2 to 4.
9. Data
processing: the execution of technical tasks relating to data use, but
without actual decision making.
10. Anonymity:
a technical procedure to permanently exclude the possibility of re-establishing
any connection between the subject party and the data.
(2) For matters not regulated in this Act and
for the interpretation of terms on the use of personal data, the regulations of
Act LXIII of 1992 on the Protection of Personal Data and the Publicity of
Information of Public Interest (hereinafter referred to as DPA) must be
observed.
General Rules on Obtaining Names and Addresses
Section 3.
(1) The scientific researcher, public opinion
survey, market research and direct marketing organisations - or the
organisations employed by the aforementioned to receive and process data - for
the purpose of establishing contact, may gather, and use, name and address
information from the following sources:
a) the data of subject party with whom the data
using organisation has previously been in contact (business partner, sponsor);
b) information from any legitimate collection of
data compiled for the purpose of publication, name and address listing and
publication - such as phone books or statistical name listing -, provided that
subject parties were informed at the time of the data gathering and were given
confirmation of the possibility of such data being used for purposes other than
originally intended, and of their right to prohibit it;
c) receiving data from other persons or
organisations involved in the same line of business, if the subject party was
not opposed to, or did not prohibit said data from being surrendered after
being informed in advance;
d) by requesting data from the register under the
scope of Act LXVI of 1992 on Keeping Records on Personal Data and Address of
Citizens (hereinafter referred to as RA) by the conditions specified in RA,
provided the citizen did not prohibit his data from being published [subsection
(1) of Section 2 of RA].
(2) When selecting a model necessary for
commencing scientific research, a public opinion survey or market research
project, or when compiling a direct marketing list, facts which may clearly
lead to specific information cannot be used for selection purposes.
Section 4.
(1) Name and address information from the
registry on citizens' personal data may be requested according to the
following:
a) by any aspects as defined in Paragraphs a)-e) and g)-h) of subsection (1) of Section 11 of RA for scientific
research purposes for establishing contact,
b) by any aspects as defined in paragraphs c)-d), h) and k) of subsection
(1) of Section 11 of RA for the selection of a model for a public opinion
survey and market research projects, and
c) by the aspect as defined in paragraphs c)-d), h) and k) of subsection
(1) of Section 11 of RA for the purpose of compiling a marketing list.
(2) If requesting data as defined in subsection
(1), the applicant must also reliably verify his entitlement to conduct such
activity indicated in such application.
(3) Data managers falling under the scope of
this Act must ensure that the name and address information remains both
up-to-date and accurate by keeping contact with the subject party or by regular
confirmation of such data from the personal data and address register. During
the making of such confirmation, the personal data and address registration
organs must also inform the applicant if, according to subsection (1) of
Section 2 of RA, the subject party has in the meantime prohibited his data from
being published. If the data user has surrendered the data to other
organisations prior to the confirmation, said data user must inform such
organisations of the prohibition.
(4) Data received from the personal data and
address registry on basis of Subsection (1), shall only be used, or
surrendered, within a period of six months from the time of reception, or the
last confirmation.
Data Protection and Data Security
Section 5.
(1) In the use of data for scientific research,
public opinion surveys, market research and direct marketing purposes - in
accordance with the provisions of RA and this Act - the right of the subject
party to the protection of his personal data shall have to be provided.
Particularly in regard to the following:
a) at the time of establishing contact, the
subject party is to be informed in writing of the source of information on him
used by the contacting person; on the objective, method and duration of using
the data, on the use of a mediator (agent) during data use, and on any future
intent to surrender such data; on the name and address of the organisation or
person entitled to use, and on the fact that supplying data is voluntary and that
the subject party has the right to request that his data should not be used for
the designated purpose or portions of such purpose;
b) the subject party must be ensured the right to
deny any further co-operation without explanation, and is to be informed of
such right in writing;
c) the use of the subject party's name and address
information for the purposes as defined in this Act is to be terminated, if so
requested by the subject party, or if said subject party does not consent to
the use of his data;
d) the subject party's name and address
information may only be surrendered with his written consent, with the
exception of surrendering data as defined in Paragraph c) of subsection (1) of Section 3, of data processing by
consignment, and data conformation specified in this Act [subsection (3) of
Section 4].
(2) When surrendering data, both sides must keep
records on the opposite party and the relevant data surrendered in order to
make such suitable for inspection. Such records are to be kept on file for five
years from the date of surrender. When processing data on consignment, the
employer shall be considered as the responsible party for data use.
(3) The use of personal data for specific
objectives must be terminated, if
a) the objective for which the data was requested
has been attained, unless the subject party has given his consent to further
use of data for a new objective;
b) the subject party has declared that he does not
wish to co-operate with the contact organisation.
(4) Termination of data use shall be interpreted
as the destruction or making anonymous of said data, while in respect to direct
marketing - if such termination is based on Paragraph b) of subsection (3) - deleting from the marketing list and
simultaneously including such data on the prohibitive list as prescribed in
Section 21.
(5) If the use of data is to be terminated at
any stage on request of subject party, subject party shall not be held
responsible for such termination.
Section 6.
(1) Scientific researchers, the public opinion
survey, market research and direct marketing organisations must provide
security on data by applying adequate technical and organisational measures.
Such measures must incorporate - with the exception of scientific researchers -
the implementation of internal data protection and data security regulations,
for which the professional representative organisations of the organisations
involved in the activities under the scope of this Act shall provide assistance
by self-regulatory activities.
(2) Data users and the persons (employees,
consignee) participating in the use of such data must be informed of the
measures as defined in subsection (1) and the mandatory observation of such
measures.
(3) Data users, prior to commencing their
activities, are obliged to the use of all data - unless the data is being used
for scientific research purposes and not published [paragraph h) of section 30 of DPA] - to the
commissioner of data protection as prescribed in subsection (1) of Section 28
of DPA.
II.
Data Use for Purposes of Scientific Research
Section 7.
(1) Scientific researchers, prior to commencing
the research projects under the scope of this Act, must prepare a plan of data
use. Such plan is to be modified if the purpose of the data use is changed
during the research process. The plan of research oriented data use must
include:
a) the entitlement to conduct research,
b) the objective of the research,
c) the source and sphere of personal data to be
used,
d) the process of data use,
e) guarantees for practical enforcement of the
subject party's rights, and
f) the technical and organisational measures taken
for data protection.
(2) The plan of research oriented data use must
be kept on file in order to provide proof of the legitimacy of the data use and
for inspection until the use of the data is terminated.
(3) In the case of institutional scientific
research projects, the rights and obligations of the scientific researcher
shall fall on and are to be observed by the organisation carrying out the
research activity.
Receiving and Surrendering Data
Section 8.
(1) In order to use the name and address
information obtained according to Section 3 for scientific research purposes
and to obtain additional information, the consent of the heir of the deceased
party is required, if the subject party passed away within 30 years of taking
or obtaining such data. If the heir cannot be located, or obtaining his consent
would mean disproportionate difficulties, such consent may be granted by a
relative of the deceased.
(2) Data needed for establishing contact with
the person effected by the scientific research may be received as prescribed in
subsection (1) of Section 3. After such contact is established, the name and
address information of the subject party may only be used for maintaining
regular contact with said party, and upon completion of the research project
the use of said data is to be terminated.
Section 9.
(1) If fulfilling the information obligation as
defined in subsection (1) of Section 5 should jeopardise the research objective
from being realised, the subject party is to be fully informed of his data
being used and of his rights after the completion of data collection.
(2) Should the subject party prohibit the use of
his name and address information at the time of being informed as specified in
subsection (1) or at a later point in the research, such data are to be
destroyed upon the request of the subject party who must be notified of the
same.
(3) The information obligation as defined in
subsection (1) the obligation to obtain consent may only be lifted, if the
objective of the research project is in the interests of social or public
health, education or environmental protection purposes and the notification or
obtaining of approval, would require disproportionately extensive amounts of
time, costs and labour due to the large number of subject parties. The data
applicant shall be responsible for the legitimacy of lifting the obligation to
notify or obtain approval.
Section 10.
In regard to disabled persons or those with
restricted abilities, notification must be given to the legal guardian, who
also exercises the subject party's right of declaration.
Section 11.
Non-resident scientific researchers, if wishing
to use data falling under the scope of this Act, or resident scientific
researchers acting under the direction of a foreign party, are obliged to
notify the subject party of the same in writing. Only data under the protection
of anonymity may be forwarded abroad, unless the subject party has consented in
writing to have such data surrendered.
III.
Use of Data for Public Opinion Survey and Market Research Purposes
Section 12.
(1) Prior to commencing public opinion survey or
market research projects (hereinafter jointly referred to as public opinion
survey) public opinion survey and market research organisations (hereinafter
jointly referred to as public opinion survey organisation) must prepare a plan
of data use in order to follow up on the data use process. Such plan must
include the information as defined in subsection (1) of Section 7.
(2) For commencing public opinion survey
projects, name and address information may only be obtained from the sources as
defined in subsection (1) of Section 3.
Section 13.
(1) Public opinion survey organisations may only
use the available name and address information obtained in accordance with
Section 12 for reasons other than establishing contact with the written consent
of the subject party.
(2) If contact has been established between the
public opinion survey organisation and the subject party, the name and address
information must immediately be detached, and stored separately, from other
public opinion survey data after the establishment of contact, and the identity
of the subject party effected by the public opinion survey must remain private.
Name and address information may only be used for re-establishing contact, with
the subject party's written consent to that extent or for maintaining regular
contact. Subject party's name and address information, other personal data and
any information provided by such subject party may only be processed, or
stored, comprehensively with the express written consent of the subject party.
(3) In order to process name and address
information, stored separately as prescribed in subsection (2), technical methods
must be implemented to exclude the possibility of establishing any connection
between the answers and name and address information of the subject party.
(4) Use of the name and address information as
defined in subsection (2) must be terminated immediately by acting in
observation of subsection (4) of Section 5 - if so requested by the subject
party, or, in the absence of such request, simultaneously with the termination
of the public opinion survey project or when regular contact is no longer maintained.
Section 14.
(1) In all stages of processing the answers
obtained during a public opinion survey project the complete anonymity of the
subject party is to be upheld, as well as the voluntary nature of answering.
(2) In the report produced as a result of a
public opinion survey project, data, based on which the subject party could be
identified, must not be included.
(3) During a public opinion survey project,
based on the subject party's personal data or opinion, no measures or
conclusions may be taken or decisions passed in connection with or pertaining
to his person.
Section 15.
Public opinion survey organisations are obliged
to educate all persons acting on its behalf on the subject party's rights of
privacy and on the protection of personal data as well as on the legal
consequences of violating data protection requirements. Public opinion survey
organisations shall be responsible for the protection of personal data.
Section 16.
(1) Foreign public opinion survey organisations
or persons, if wishing to use data falling under the scope of this Act, or
domestic public opinion survey organisations or persons acting among the
direction of a foreign party, are obliged to notify the subject party of the
same in writing. Only such processed data may be forwarded abroad, from which
the subject party cannot be identified, unless the subject party has consented
in writing to have such data surrendered.
(2) Data gathered for market research purposes
may not be surrendered for direct marketing purposes.
IV
Using Data for Direct Marketing Purposes
Section 17.
(1) Direct marketing organisations may only
obtain name and address information for compiling the lists necessary for the
legitimate activities of such organisations from the sources as defined in
subsection (1) of Section 3, and may gather such information upon satisfying
the conditions prescribed by this Act.
(2) In respect to Paragraph a) of subsection (1) of Section 3, those, who by wilful action -
request information on products or services, or who answer a public
advertisement - and thus initiated contact themselves, during which they
surrendered their name and address information to the data user direct
marketing organisation, may be considered a partner or sponsor.
(3) In the case of non-commercial oriented
competitions or games, the data surrendered by those participating may only be
used for compiling marketing lists if the subject parties have been duly
notified of the intention to use their data for direct marketing purposes, and
said parties have consented to the same.
Section 18.
(1) Name and address information from a
marketing list may only be surrendered to third parties - with the exception as
defined in Paragraph c) of subsection
(1) of Section 3 - for direct marketing purposes or for other reasons, upon
receiving the subject party's written consent and if the name and activity of
the third party is known by the subject party.
(2) When surrendering data, the conditions for
using the marketing list shall be stipulated by the data receiver and the party
surrendering such data in a contract. Contracts concluded in the absence of the
conditions as defined in subsection (1) are null and void.
(3) Direct marketing lists may not be linked
with databases gathered for market research purposes.
Section 19.
Foreign direct marketing organisations, if
wishing to use data falling under the scope of this Act, or domestic direct
marketing organisations acting under the direction of a foreign party, must
notify the subject party of the same in writing. Name and address information
may only be surrendered to abroad for data processing purposes, if the subject
party has consented in writing to have such data surrendered, and only if data
protection requirements are also provided by the receiver of the data.
Surrendering data to abroad must be reported to the commissioner of data
protection in advance.
The Rights of Subject Parties
Section 20.
(1) Each subject party shall have the right
a) to withhold or prohibit his name and address
information included in marketing lists, from being used for direct marketing
or other concrete purposes to be established as part of direct marketing, to
withhold and prohibit such information from being surrendered to third parties;
b) to request that the use of his personal data in
connection with all marketing lists - as well as those for specific purposes -
be terminated, including data surrendered to third parties. The data user must
notify the subject party of the fulfilment of his request.
(2) Upon the request of the subject party, the direct
marketing organisation using data is obliged to notify the subject party in
writing about the data being used, and to have such data corrected. In the case
of data surrendered within six months, correction or deletion of data
surrendered to a third party shall be initiated, upon the request of the
subject party, by the organisation surrendering such data.
(3) Direct marketing organisations using data in
accordance with the provisions of this Act are obliged to adequately inform all
persons of their particulars (name/company name, address/branch office) whose
name and address information is included in the marketing list, or is about to
be included.
Prohibitive List
Section 21.
(1) Direct marketing organisations must keep
records (prohibitive lists) on the name and address information of subject
parties who have withdrawn their co-operation, or who have requested that the
use of their data for the designated purpose be terminated, or who have not
consented to the same, as well as on those who have exercised the right to
prohibit data with the body of personal data and address registration after
receiving such data.
(2) The purpose of the prohibitive list is to
prevent the data of subject parties included in such lists from being gathered
repeatedly, being surrendered to third parties, or being included in new lists.
Post may not be sent to subject parties included in the prohibitive list,
unless such prohibition applies only to specific purposes.
(3) Direct marketing organisations may jointly
employ a third organisation to manage the prohibitive list, however such
organisation may only be involved in data processing within context of
subsection (2).
(4) Data users may only use data included in the
prohibitive list to the extent necessary for fulfilling the provisions of
subsection (2), furthermore, such data cannot be linked with other databases,
nor surrendered and may not be used for other purposes. Said data users are
also obliged to provide subject parties with the conditions for exercising
their rights as defined in paragraph b)
of subsection (1) of Section 19.
V
Interim and Closing Provisions
Section 22.
(1) Data users not falling under the scope of
Section 1 of this Act - unless subject party has previously consented to the
use of data - are obliged to regularly, but no later than at the time of next
use, review all data at their disposal, including
a) to request the written approval of the subject
party for further use of his data for scientific research projects;
b) in the case of public opinion survey, market
research and direct marketing purposes, to request confirmation from the
personal data and address register, then notify the subject party within one
year of his data being used in accordance with Section 5 of this Act.
(2) Data users shall destroy all data in their
possession which was not reviewed as defined in subsection (1) within one year
of this Act coming into force, or provide anonymity for such data.
Section 23.
(1) This Act shall come into force on the 15th
day of its publication.
(2)