Act CXIX of 1995

on the Use of Name and Address Information Serving the Purposes of Research and Direct Marketing

Parliament - based on the principle that according to the Constitution the Republic of Hungary extends the right to the protection of personal data, as well as the right to conduct scientific research, freedom of opinion and the conditions of a market economy; in consideration of Act LXIII of 1992 on the Protection of Personal Data and the Publicity of Information of Public Interest, Treaty No 108 of the European Council on the protection relating to the automatic handling of private and personal data, and the Recommendations of the European Council - passed the following Act on the use of name and address information serving the purposes of research and direct marketing:

I.

General Provisions

Section 1.

(1) The scope of this Act shall include the natural and legal persons, and the organisations without legal entity, requesting or using name and address information for the purpose of establishing contact for scientific research, public opinion survey, market research and direct marketing reasons.

(2) The scope of this Act shall not be extended to research activities conducted in accordance with Act LXVI of 1995 on the Protection of Public Documents, Public Archives and Private Archive Materials.

Section 2.

(1) In the scope of this Act:

1. Scientific research: an activity with the objective to increase knowledge of the world, its meaning and of the correlation of its manifestations, for which name and address information or direct contact with private individuals is necessary in order to explore the objective correlation of the surveyed social, economic and natural circumstances.

2. Public opinion survey: studying the opinion of individuals and groups of people (hereinafter referred to as subject parties) and the motives behind their judgement.

3. Market research: studying the consumer habits of subject parties.

4. Direct marketing: the aggregate term for information activities and secondary services executed by direct approach for the purpose of offering products or services to subject parties, as well as for conveying commercial advertisements, and providing information to consumers and business partners in order to promote sales.

5. Direct marketing list (hereinafter referred to as marketing list): a collection of name and address information for establishing and maintaining contact with subject parties and with business partners for the purposes of direct marketing. In addition to the name and address information, such list may only contain information on the fields of interest of clients and sponsors.

6. Prohibitive list: records of name and address information on subject parties who did not consent to their personal data being used for any of the direct marketing purposes as defined in this Act, or who have prohibited further use of such data for said purposes.

7. Scientific researcher: the natural person with a degree or title in science, being involved in scientific activities in his particular field or branch of science; as well as the person involved in scientific research according to a certificate received from an organisation pursuing scientific projects or from a foundation sponsor.

8. Public opinion survey, market research or direct marketing organisation: the natural and legal person or the organisation without legal entity entitled to perform the activities as defined in Points 2 to 4.

9. Data processing: the execution of technical tasks relating to data use, but without actual decision making.

10. Anonymity: a technical procedure to permanently exclude the possibility of re-establishing any connection between the subject party and the data.

(2) For matters not regulated in this Act and for the interpretation of terms on the use of personal data, the regulations of Act LXIII of 1992 on the Protection of Personal Data and the Publicity of Information of Public Interest (hereinafter referred to as DPA) must be observed.

General Rules on Obtaining Names and Addresses

Section 3.

(1) The scientific researcher, public opinion survey, market research and direct marketing organisations - or the organisations employed by the aforementioned to receive and process data - for the purpose of establishing contact, may gather, and use, name and address information from the following sources:

a) the data of subject party with whom the data using organisation has previously been in contact (business partner, sponsor);

b) information from any legitimate collection of data compiled for the purpose of publication, name and address listing and publication - such as phone books or statistical name listing -, provided that subject parties were informed at the time of the data gathering and were given confirmation of the possibility of such data being used for purposes other than originally intended, and of their right to prohibit it;

c) receiving data from other persons or organisations involved in the same line of business, if the subject party was not opposed to, or did not prohibit said data from being surrendered after being informed in advance;

d) by requesting data from the register under the scope of Act LXVI of 1992 on Keeping Records on Personal Data and Address of Citizens (hereinafter referred to as RA) by the conditions specified in RA, provided the citizen did not prohibit his data from being published [subsection (1) of Section 2 of RA].

(2) When selecting a model necessary for commencing scientific research, a public opinion survey or market research project, or when compiling a direct marketing list, facts which may clearly lead to specific information cannot be used for selection purposes.

Section 4.

(1) Name and address information from the registry on citizens' personal data may be requested according to the following:

a) by any aspects as defined in Paragraphs a)-e) and g)-h) of subsection (1) of Section 11 of RA for scientific research purposes for establishing contact,

b) by any aspects as defined in paragraphs c)-d), h) and k) of subsection (1) of Section 11 of RA for the selection of a model for a public opinion survey and market research projects, and

c) by the aspect as defined in paragraphs c)-d), h) and k) of subsection (1) of Section 11 of RA for the purpose of compiling a marketing list.

(2) If requesting data as defined in subsection (1), the applicant must also reliably verify his entitlement to conduct such activity indicated in such application.

(3) Data managers falling under the scope of this Act must ensure that the name and address information remains both up-to-date and accurate by keeping contact with the subject party or by regular confirmation of such data from the personal data and address register. During the making of such confirmation, the personal data and address registration organs must also inform the applicant if, according to subsection (1) of Section 2 of RA, the subject party has in the meantime prohibited his data from being published. If the data user has surrendered the data to other organisations prior to the confirmation, said data user must inform such organisations of the prohibition.

(4) Data received from the personal data and address registry on basis of Subsection (1), shall only be used, or surrendered, within a period of six months from the time of reception, or the last confirmation.

Data Protection and Data Security

Section 5.

(1) In the use of data for scientific research, public opinion surveys, market research and direct marketing purposes - in accordance with the provisions of RA and this Act - the right of the subject party to the protection of his personal data shall have to be provided. Particularly in regard to the following:

a) at the time of establishing contact, the subject party is to be informed in writing of the source of information on him used by the contacting person; on the objective, method and duration of using the data, on the use of a mediator (agent) during data use, and on any future intent to surrender such data; on the name and address of the organisation or person entitled to use, and on the fact that supplying data is voluntary and that the subject party has the right to request that his data should not be used for the designated purpose or portions of such purpose;

b) the subject party must be ensured the right to deny any further co-operation without explanation, and is to be informed of such right in writing;

c) the use of the subject party's name and address information for the purposes as defined in this Act is to be terminated, if so requested by the subject party, or if said subject party does not consent to the use of his data;

d) the subject party's name and address information may only be surrendered with his written consent, with the exception of surrendering data as defined in Paragraph c) of subsection (1) of Section 3, of data processing by consignment, and data conformation specified in this Act [subsection (3) of Section 4].

(2) When surrendering data, both sides must keep records on the opposite party and the relevant data surrendered in order to make such suitable for inspection. Such records are to be kept on file for five years from the date of surrender. When processing data on consignment, the employer shall be considered as the responsible party for data use.

(3) The use of personal data for specific objectives must be terminated, if

a) the objective for which the data was requested has been attained, unless the subject party has given his consent to further use of data for a new objective;

b) the subject party has declared that he does not wish to co-operate with the contact organisation.

(4) Termination of data use shall be interpreted as the destruction or making anonymous of said data, while in respect to direct marketing - if such termination is based on Paragraph b) of subsection (3) - deleting from the marketing list and simultaneously including such data on the prohibitive list as prescribed in Section 21.

(5) If the use of data is to be terminated at any stage on request of subject party, subject party shall not be held responsible for such termination.

Section 6.

(1) Scientific researchers, the public opinion survey, market research and direct marketing organisations must provide security on data by applying adequate technical and organisational measures. Such measures must incorporate - with the exception of scientific researchers - the implementation of internal data protection and data security regulations, for which the professional representative organisations of the organisations involved in the activities under the scope of this Act shall provide assistance by self-regulatory activities.

(2) Data users and the persons (employees, consignee) participating in the use of such data must be informed of the measures as defined in subsection (1) and the mandatory observation of such measures.

(3) Data users, prior to commencing their activities, are obliged to the use of all data - unless the data is being used for scientific research purposes and not published [paragraph h) of section 30 of DPA] - to the commissioner of data protection as prescribed in subsection (1) of Section 28 of DPA.

II.

Data Use for Purposes of Scientific Research

Section 7.

(1) Scientific researchers, prior to commencing the research projects under the scope of this Act, must prepare a plan of data use. Such plan is to be modified if the purpose of the data use is changed during the research process. The plan of research oriented data use must include:

a) the entitlement to conduct research,

b) the objective of the research,

c) the source and sphere of personal data to be used,

d) the process of data use,

e) guarantees for practical enforcement of the subject party's rights, and

f) the technical and organisational measures taken for data protection.

(2) The plan of research oriented data use must be kept on file in order to provide proof of the legitimacy of the data use and for inspection until the use of the data is terminated.

(3) In the case of institutional scientific research projects, the rights and obligations of the scientific researcher shall fall on and are to be observed by the organisation carrying out the research activity.

Receiving and Surrendering Data

Section 8.

(1) In order to use the name and address information obtained according to Section 3 for scientific research purposes and to obtain additional information, the consent of the heir of the deceased party is required, if the subject party passed away within 30 years of taking or obtaining such data. If the heir cannot be located, or obtaining his consent would mean disproportionate difficulties, such consent may be granted by a relative of the deceased.

(2) Data needed for establishing contact with the person effected by the scientific research may be received as prescribed in subsection (1) of Section 3. After such contact is established, the name and address information of the subject party may only be used for maintaining regular contact with said party, and upon completion of the research project the use of said data is to be terminated.

Section 9.

(1) If fulfilling the information obligation as defined in subsection (1) of Section 5 should jeopardise the research objective from being realised, the subject party is to be fully informed of his data being used and of his rights after the completion of data collection.

(2) Should the subject party prohibit the use of his name and address information at the time of being informed as specified in subsection (1) or at a later point in the research, such data are to be destroyed upon the request of the subject party who must be notified of the same.

(3) The information obligation as defined in subsection (1) the obligation to obtain consent may only be lifted, if the objective of the research project is in the interests of social or public health, education or environmental protection purposes and the notification or obtaining of approval, would require disproportionately extensive amounts of time, costs and labour due to the large number of subject parties. The data applicant shall be responsible for the legitimacy of lifting the obligation to notify or obtain approval.

Section 10.

In regard to disabled persons or those with restricted abilities, notification must be given to the legal guardian, who also exercises the subject party's right of declaration.

Section 11.

Non-resident scientific researchers, if wishing to use data falling under the scope of this Act, or resident scientific researchers acting under the direction of a foreign party, are obliged to notify the subject party of the same in writing. Only data under the protection of anonymity may be forwarded abroad, unless the subject party has consented in writing to have such data surrendered.

III.

Use of Data for Public Opinion Survey and Market Research Purposes

Section 12.

(1) Prior to commencing public opinion survey or market research projects (hereinafter jointly referred to as public opinion survey) public opinion survey and market research organisations (hereinafter jointly referred to as public opinion survey organisation) must prepare a plan of data use in order to follow up on the data use process. Such plan must include the information as defined in subsection (1) of Section 7.

(2) For commencing public opinion survey projects, name and address information may only be obtained from the sources as defined in subsection (1) of Section 3.

Section 13.

(1) Public opinion survey organisations may only use the available name and address information obtained in accordance with Section 12 for reasons other than establishing contact with the written consent of the subject party.

(2) If contact has been established between the public opinion survey organisation and the subject party, the name and address information must immediately be detached, and stored separately, from other public opinion survey data after the establishment of contact, and the identity of the subject party effected by the public opinion survey must remain private. Name and address information may only be used for re-establishing contact, with the subject party's written consent to that extent or for maintaining regular contact. Subject party's name and address information, other personal data and any information provided by such subject party may only be processed, or stored, comprehensively with the express written consent of the subject party.

(3) In order to process name and address information, stored separately as prescribed in subsection (2), technical methods must be implemented to exclude the possibility of establishing any connection between the answers and name and address information of the subject party.

(4) Use of the name and address information as defined in subsection (2) must be terminated immediately by acting in observation of subsection (4) of Section 5 - if so requested by the subject party, or, in the absence of such request, simultaneously with the termination of the public opinion survey project or when regular contact is no longer maintained.

Section 14.

(1) In all stages of processing the answers obtained during a public opinion survey project the complete anonymity of the subject party is to be upheld, as well as the voluntary nature of answering.

(2) In the report produced as a result of a public opinion survey project, data, based on which the subject party could be identified, must not be included.

(3) During a public opinion survey project, based on the subject party's personal data or opinion, no measures or conclusions may be taken or decisions passed in connection with or pertaining to his person.

Section 15.

Public opinion survey organisations are obliged to educate all persons acting on its behalf on the subject party's rights of privacy and on the protection of personal data as well as on the legal consequences of violating data protection requirements. Public opinion survey organisations shall be responsible for the protection of personal data.

Section 16.

(1) Foreign public opinion survey organisations or persons, if wishing to use data falling under the scope of this Act, or domestic public opinion survey organisations or persons acting among the direction of a foreign party, are obliged to notify the subject party of the same in writing. Only such processed data may be forwarded abroad, from which the subject party cannot be identified, unless the subject party has consented in writing to have such data surrendered.

(2) Data gathered for market research purposes may not be surrendered for direct marketing purposes.

IV

Using Data for Direct Marketing Purposes

Section 17.

(1) Direct marketing organisations may only obtain name and address information for compiling the lists necessary for the legitimate activities of such organisations from the sources as defined in subsection (1) of Section 3, and may gather such information upon satisfying the conditions prescribed by this Act.

(2) In respect to Paragraph a) of subsection (1) of Section 3, those, who by wilful action - request information on products or services, or who answer a public advertisement - and thus initiated contact themselves, during which they surrendered their name and address information to the data user direct marketing organisation, may be considered a partner or sponsor.

(3) In the case of non-commercial oriented competitions or games, the data surrendered by those participating may only be used for compiling marketing lists if the subject parties have been duly notified of the intention to use their data for direct marketing purposes, and said parties have consented to the same.

Section 18.

(1) Name and address information from a marketing list may only be surrendered to third parties - with the exception as defined in Paragraph c) of subsection (1) of Section 3 - for direct marketing purposes or for other reasons, upon receiving the subject party's written consent and if the name and activity of the third party is known by the subject party.

(2) When surrendering data, the conditions for using the marketing list shall be stipulated by the data receiver and the party surrendering such data in a contract. Contracts concluded in the absence of the conditions as defined in subsection (1) are null and void.

(3) Direct marketing lists may not be linked with databases gathered for market research purposes.

Section 19.

Foreign direct marketing organisations, if wishing to use data falling under the scope of this Act, or domestic direct marketing organisations acting under the direction of a foreign party, must notify the subject party of the same in writing. Name and address information may only be surrendered to abroad for data processing purposes, if the subject party has consented in writing to have such data surrendered, and only if data protection requirements are also provided by the receiver of the data. Surrendering data to abroad must be reported to the commissioner of data protection in advance.

The Rights of Subject Parties

Section 20.

(1) Each subject party shall have the right

a) to withhold or prohibit his name and address information included in marketing lists, from being used for direct marketing or other concrete purposes to be established as part of direct marketing, to withhold and prohibit such information from being surrendered to third parties;

b) to request that the use of his personal data in connection with all marketing lists - as well as those for specific purposes - be terminated, including data surrendered to third parties. The data user must notify the subject party of the fulfilment of his request.

(2) Upon the request of the subject party, the direct marketing organisation using data is obliged to notify the subject party in writing about the data being used, and to have such data corrected. In the case of data surrendered within six months, correction or deletion of data surrendered to a third party shall be initiated, upon the request of the subject party, by the organisation surrendering such data.

(3) Direct marketing organisations using data in accordance with the provisions of this Act are obliged to adequately inform all persons of their particulars (name/company name, address/branch office) whose name and address information is included in the marketing list, or is about to be included.

Prohibitive List

Section 21.

(1) Direct marketing organisations must keep records (prohibitive lists) on the name and address information of subject parties who have withdrawn their co-operation, or who have requested that the use of their data for the designated purpose be terminated, or who have not consented to the same, as well as on those who have exercised the right to prohibit data with the body of personal data and address registration after receiving such data.

(2) The purpose of the prohibitive list is to prevent the data of subject parties included in such lists from being gathered repeatedly, being surrendered to third parties, or being included in new lists. Post may not be sent to subject parties included in the prohibitive list, unless such prohibition applies only to specific purposes.

(3) Direct marketing organisations may jointly employ a third organisation to manage the prohibitive list, however such organisation may only be involved in data processing within context of subsection (2).

(4) Data users may only use data included in the prohibitive list to the extent necessary for fulfilling the provisions of subsection (2), furthermore, such data cannot be linked with other databases, nor surrendered and may not be used for other purposes. Said data users are also obliged to provide subject parties with the conditions for exercising their rights as defined in paragraph b) of subsection (1) of Section 19.

V

Interim and Closing Provisions

Section 22.

(1) Data users not falling under the scope of Section 1 of this Act - unless subject party has previously consented to the use of data - are obliged to regularly, but no later than at the time of next use, review all data at their disposal, including

a) to request the written approval of the subject party for further use of his data for scientific research projects;

b) in the case of public opinion survey, market research and direct marketing purposes, to request confirmation from the personal data and address register, then notify the subject party within one year of his data being used in accordance with Section 5 of this Act.

(2) Data users shall destroy all data in their possession which was not reviewed as defined in subsection (1) within one year of this Act coming into force, or provide anonymity for such data.

Section 23.

(1) This Act shall come into force on the 15th day of its publication.

(2)