Personal data can be processed for advertising and marketing purposes in accordance with the Data Protection Legislation, provided that these purposes are made clear in the Privacy Notice and in any other medium required for communicating the processing purposes.
Collection of personal data that is related to a data subject solely for reasons of direct marketing is allowed only if the data subject has given his explicit consent.
The data subject has the right to ask the controller not to start processing, or if processing has started, to stop the processing of personal data related to him or her for the purposes of direct marketing and to be informed in advance before personal data are disclosed for first time for such purpose.
Direct marketing Before 25 May 2018, Hungary clearly operated an “opt-in” regime for direct marketing communications. Currently, the rules of the GDPR apply, meaning that in certain cases, the data controller may send direct marketing messages on an “opt-out” basis. However, the Advertising Act has still not been amended to guarantee harmonisation with the GDPR, causing uncertainty in this matter.
With regard to the above, under the current rules of the Advertising Act, data controllers may send advertisements to private individual end-users in Hungary by email or similar electronic channels only with the express prior consent of the addressee.
Consents for individual marketing activities must contain the name, place and date of birth (if the marketing can be targeted only for people above a certain age), and the list of the consumer’s personal data which are processed in relation to the marketing.
Consent must also state that it is provided voluntarily, on the basis of adequate information provided to the consumer.
In all cases, end-users must be expressly informed in all individual marketing communications of the opportunity to freely opt-out of the communications and be given the relevant contact details (e.g. postal and email address) where they can do so. This statement is usually inserted in the footer of marketing communications.
If the consent is provided in a contract or in general terms, it must be provided separately from the main text – e.g. via the acceptance of a separate consent box. It cannot be a precondition to the contracting or receipt of a service, such as an online shop.
If the advertiser offers added value, provided that the addressee consents to receiving direct marketing messages, no separate consent box may be needed – e.g. if the addressee is given the opportunity to participate in a game or use free email services.
The sending of a direct mail message is lawful and can be based on the legitimate interest of the sender in general if the private individual addressee is an employee of a legal entity, the advertiser obtained the contact details lawfully (e.g. via the company's website or public sources), and the advertisement is targeted to a company (i.e. B2B marketing messages).
Direct marketing consents for benefits. According to NAIH, when organisations provide some benefit for subscribing to a newsletter, they must assess on a case-by-case basis how such benefit influences the free nature of the consent. In particular, it is important to examine whether the denial or withdrawal of consent (e.g. opt-out) causes any disadvantage for the individual. The provision of a service or a benefit shall not be conditional on a consent to data processing for additional purposes (e.g. direct marketing). Such practice is allowed only if the benefit is inseparable from the newsletter, e.g. the newsletter contains an exclusive content or offer.