Camera Surveillance
Data Processing Policy
regarding the camera systems installed with the contribution of the HFF and the use of the camera system of Groupama Arena by the HFF
1. Where to find information related to data processing?
HFF has prepared this notice in accordance with the provisions of the EU General Data Protection Regulation 2016/679 (hereinafter referred to as “GDPR” or “Regulation”) with the specific purpose to make the data management processing operations transparent in a comprehensible manner.
This notice contains key information relating to the specific data processing (legal basis and purpose of processing, scope of processed data, duration and your rights), supplemented by the document titled General Information on Data Processing, which explains your rights and how to exercise them, the obligations related to data security and the rules in the amendment of the notice. The rules in the document title General information on data processing have been inserted in this document, so the policy contains all the necessary information.
2. Presentation of the cases of processing and scope of processed data
As a rule, a security camera system is operated during the matches of the national team.
Pursuant to Section 74 (1) of Act I of 2004 on sports (hereinafter, the “Sports Act”), a camera recording may be made by:
- the organizer,
- if security staff employed, the security staff, and
- the representative of the travelling sports organization.
The HFF is the organizer of the national team matches and some priority events (e.g. Hungarian Cup final).
As regards the duration, the recording covers the duration of the sports events (including the time of entering and leaving the venue of the event).
As regards the place, the recording extends to:
- the venue of the sports event,
- public areas occupied by the fans waiting for admission, and
- car parks designated for the spectators as well.
The recording and the surveillance can be carried out by using cameras of quality ensuring the individual identification of the participants, which are placed in the number specified by the police or fixed on the body of the organizer or if security staff employed, the security staff.
In the case of sports events qualified as ordinary, making a recording is not an obligation, but a right, in order to ensure the personal safety and asset security of the participants.
In the case of football, making a recording is mandatory during the sports events qualified as carrying an increased security risk or a special security risk.
The data recorded by the camera is simultaneously and continuously monitored by the organizer, the members of the security company or the representative of the organizing entity in a room set up for this purpose within the area of the sports event. The assigned representative of the police and the national security service may be present in the process. If so required by the police or the national security service, the organizer, the security company or the representative of the organizing entity must provide access to camera surveillance during the sports event.
The camera system processes as personal data the video and audio recording at the match, as well as video and audio recording of the data subjects, including their facial likeness, behaviour and clothing.
In respect of recordings made by the organizer or the travelling sports organization, the HFF is not considered a data controller, and information may be requested from and the rights of the data subjects may be exercised vis-á-vis the legal entity making the recording.
3. Duration of Data Processing
Based on Section 74 (3) of the Sports Act, the recordings are kept for 120 hours.
However, the police may call on the organizer, the security staff or the travelling sports organization during this period of 120 hours to keep the recordings for an additional period up to a maximum of 60 days if they contain information necessary for initiating or conducting a petty offence or criminal proceeding.
If, based on the recordings, the HFF launches a banning procedure, the recordings serving as the basis of the ban are retained until they are requested or, in the absence thereof, the closing of the banning procedure.
4. Purpose of Data Processing
The purpose of data processing is to meet the requirements of Sections 74 (1) and (3) of the Sports Act.
Based on the legislation above, the data can be used for the purpose of criminal or petty offence proceedings due to crimes or petty offences committed on the venue of the sports event or while accessing or leaving the area of the sports event or, pursuant to Section 73 (5) of the Sports Act, for the launch by the organizer or the travelling sports organization of a procedure for banning from attending the sports event or the launch of administrative proceedings or the enforcement of civil law claims, by the third working day of the receipt of the notice of the non-appealable closing of the proceeding, respectively, the expiry of the effect of the ban, for the purpose of banning the disturbing person.
Data which falls under restriction based on the data subject’s request may be processed by the HFF for the establishment, exercise or defence of legal claims or the protection of the rights of another natural or legal person.
The purpose of data processing after the expiry of the statutory retention period or related to sports events that do not carry an increased or special security risk, is the exercise of claims by the HFF (e.g. a claim for damages), banning the data subject from attending sports events or the securing other possible administrative procedures (verification of claims, identification of data subject).
5. Recipients of Data. Categories of Recipients
Data from the recordings may be requested by the national security service, the police, the petty offence authority, the public prosecutor’s office and the court in order to discharge their national security, criminal prosecution, petty offence and justice duties, as well as the data subject. The organizer and the travelling sports organization may transmit the recordings to the acting body for the purposes of subsequent procedures, including those in Section 4.
5.1. In facilities where a camera system installed with the contribution of the HFF is operated, the entity below is involved in the activity as a data processor:
Nádor Rendszerház Kft.
Registered address: 1152 Budapest, Telek utca 7-9.
Company register number: 01-09-074755
Mailing address: 1152 Budapest, Telek utca 7-9.
Email address: info@nador.hu
Nádor Rendszerház Kft. is the operator of the camera system within its scope of activities, and is engaged in the search, saving, export and maintenance of the data based on the instructions of the data controller.
Logipix Kft.
Registered address: 1158 Budapest, Késmárk utca 11-13.
Company register number: 01-09-468155
Mailing address: 1158 Budapest, Késmárk utca 11-13.
Email address: info@valyilaw.hu
Logipix Kft. is the developer of the camera system installed in collaboration with the HFF and, in this context, in engaged in the support of the system.
5.2. In the Groupama Arena, the camera system is operated by Lagardere Sports Hungary Kft. and FTC Zrt., who perform all tasks related to the operation:
Lagardere Sports Hungary Kft.
Registered address: 1091 Budapest, Üllői út 129.
Company register number: 01-09-187952
Mailing address: 1091 Budapest, Üllői út 129.
Email address: csaba.siklosi@groupamaarena.com
FTC Zrt.
Registered address: 1091 Budapest, Üllői út 129.
Company register number: 01-10-044877
Mailing address: 1091 Budapest, Üllői út 129.
Email address: ftc@fradi.hu
6. Source of Personal Data
The data are recorded based on the participants’ knowledge.
7. Legal Basis of Data Processing
The legal basis of the data processing is paragraph c) of Article 6 (1) of the Regulation, that is, meeting the legal obligation under Section 74 of the Sports Act in the case of sports events involving the national team and other events involving an increased or special security risk directly organized by the HFF (e.g. Hungarian Cup final).
The legal basis for the processing of camera recordings exceeding the duration set out in Section 74 (3) of the Sports Act or at an event other than one involving an increased or special security risk, is paragraph f) of Section 6 (1) of the Regulation, that is, the legitimate interest of the HFF to exercise its legitimate interests (e.g. claim for damages or passing through damages) and in the course thereof, as well as for verifying and exercising its legitimate interests in banning and other potential official proceedings and identifying the data subjects.
8. Areas Under Surveillance
In the Groupama Arena, the cameras cover the following areas:
- grandstands and associated staircases;
- entry points;
- player exit, other corridors of the building;
- the field and areas around the field closed from the spectators;
- areas under the grandstands (so-called cloister);
- operating areas;
- parking lots;
- the fence surrounding the stadium and public areas near the admission points.
9. Rights of Data Subjects
You can reach us at any of the contact points below regarding issues related to data processing:
Email address: mlsz@mlsz.hu
Email address of data protection officer: adatvedelem@mlsz.hu
Mailing address: 1386. Budapest 62. Pf. 906/1
You can initiate exercising your rights in connection with the camera recordings by sending an email to the bejelentes@mlsz.hu address or a letter to the above mailing address, however, exercising your rights requires your identification, so we suggest that you use the https://dataprivacy.mlsz.hu/data-processing-form site in order to protect your data and speed up the process. The type of the right you may exercise in relation to the specific data processing depends on the legal basis we use for processing your data, which can be the following (but, of course, may also apply for exercising all your rights):
| Right | Legal obligation | Legitimate interest |
| Access to personal data and information related to data processing | x | x |
| Right to data portability in respect of certain data | ||
| Right to erasure | x | |
| Right to restriction | x | x |
| Right to rectification | ||
| Right to object | x | |
| Withdrawal of consent | ||
| Right to address the supervisory authority and the court | x | x |
The rights may be exercised by the legal representative of minors under the age of 16, and the rights of a minor above the age of 16 may be exercised by his legal representative.
Data Processing Related to Complaints Management
Complaints related to data processing are responded within one month at the latest, which may be extended by another 2 months in justified cases.
If you wish to exercise your rights, we have to identify you and necessarily communicate with you.
The HFF ensures the identification of the applicant as follows:
Personal identification: this can be arranged at the HFF county directorate of your choice or the HFF headquarters. In this case, we identify you personally based on your identity card and this is the only form of identification where no personal data is recorded.
Identification through the verification of data: if you are unable to appear for personal identification, you need to disclose to us the number of one of your identification documents (which can be an ID card, passport or driver licence), your mother’s birth name, your place and date of birth and your name. Based on this data, we make a search in the Personal Data and Address Register by using the ID of your document to check if the data is real. If the data is real, it is confirmed that you have an identity card that contains the specified data.
Please note that if you choose this method of identification or any other method we offer during the procedure that does not require personal presence, the HFF disclaims all liability for any damage and/or other disadvantage incurred by you or any other legal or natural person resulting from the fulfilment of the request.
In the case of a legal representative, if his declaration on his right of representation is not available in our system, it is also necessary for the applicant to make a declaration on his representation by using the form provided by the HFF, which involves the processing of the name, ID card number and home address of the declarant and the witnesses confirming the declaration.
The data provided by the data subject and/or the legal representative and the witnesses during the identification and/or when making the declaration, as well as the application are retained by the HFF for 5 years in accordance with the document management policy. The application and related correspondence will also be available in our email account.
If in doubt, we may call the applicant to carry out further acts of identification. We exercise this right if complying with the application would have legal effects on the applicant or the data subject. Such cases include, for example, if someone requests erasure of his data but he is an active football player and erasing the data would cause revoking the competition licence of the football player.
The legal basis of data processing is paragraph f) of Article 6 (1) of the Regulation, that is, the legitimate interest of the HFF to process complaints and verify how it proceeded and what measures it took in respect of each complaint.
The data processor linked to the processing of the applications is RelativeGROUP Kft., being the operator of the mlsz.hu site (Registered address: 2000 Szentendre, Tölgy utca 12.).
The storage and organisation duties related to our documents are carried out by PRIV-DAT Dokumentum Archiváló és Tároló Kft. (registered address: 1211 Budapest, Weiss Manfred út 5-7).
9.1. Right to request information and copy (right of access)
You have the right to obtain feedback as to whether or not personal data concerning you are being processed, and, where that is the case, you have the right to:
be given access to the personal data processed (that is, to request a copy thereof), and
be informed by us of the following:
purposes of the data processing;
categories of the personal data processed;
information on recipients or categories of recipients to whom or which the personal data has been or will be communicated;
the planned duration of storage of the personal data, or if it is not possible, the criteria for the definition of such period;
your right to request the rectification, erasure or restriction of the processing of your personal data, and to object to the processing of your personal data where the processing is based on legitimate interest;
the right of submitting complaints addressed to the supervisory authority;
if the data was not collected from you, all available information regarding their source;
information about the existence of automated decision-making, including profiling (if such a procedure is used) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.
The purpose of the exercise of the rights may be directed to establish or verify the legality of data processing, so we may charge a reasonable fee for providing the information if you request information on multiple occasions.
Access to the personal data is ensured in the form you request, which can be in electronic form, by post or personal information.
9.2. Right to Restriction of Processing
You have the right to obtain from us restriction of processing where one of the following applies:
you contest the accuracy of the personal data. In this case, the restriction applies to a period enabling us to verify the accuracy of the personal data (we do not apply restriction if no verification is necessary);
the processing is unlawful and you oppose their erasure and demand the restriction of their use instead;
we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
you have objected to processing the data, but it is based on our legitimate interest (in this case, the processing is restricted until it is verified whether our legitimate grounds override your legitimate grounds).
Where data processing is restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of your legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
You will be informed of lifting the restriction of processing in advance (at least 3 working days before the restriction is lifted).
Please note that, in certain cases, restricting the right of data processing may lead to other consequences, such as losing any benefits that are associated with the processing (e.g. buying tickets online, use of fan discounts or losing the right to enter the field as a player). You will be informed of such eventualities when this right is exercised.
9.3. Right to erasure and to be forgotten
You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the following grounds applies:
the personal data are no longer necessary in relation to the purpose for which were collected or processed;
you withdraw consent on which the processing is based and where there is no other legal ground for the processing;
you object to the processing based on their legitimate interests and there are no overriding legitimate grounds (that is, legitimate interest) for the processing;
the personal data have been unlawfully processed and this established on the basis of the complaint;
the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject;
Where we have made the personal data processed about you public for any lawful reason and we are obliged to erase them for any of the reasons above, we will take reasonable steps taking account of available technology and the cost of implementation, including technical measures, to inform the other controllers which are processing the personal data that you have requested the erasure of the personal data concerned of any links to, or copy or replication of, those personal data (right to be forgotten). As a rule, your personal data will not be made public. If the recordings made at the match are made public by the television rights holders and media service provider or its partners, it will do so based on its commercial rights. You can address any relevant claim to the media service provider.
Erasure does not apply to the extent that processing is necessary:
for exercising the right of freedom of expression and information;
for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject (such cases include, e.g. processing in the context of billing, as the invoice must be retained based on legal obligation, or the mandatory registration of sportsmen, records of competition licences);
for the establishment, exercise or defence of legal claims (e.g. if we have a claim against you and you have not fulfilled it yet, or a consumer complaint or data processing complaint is being processed).
9.4. Right to object
You have the right to object on grounds relating to your particular situation to the processing of your personal data based on legitimate interest. In this case, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
9.5. Legal remedies
If you believe we have violated any statutory provisions concerning data processing or failed to fulfil any of your requests, you may initiate the investigation of the National Authority for Data Protection and Freedom of Information in order to eliminate such implied unlawful data processing (mailing address: 1363 Budapest, Pf.: 9., e-mail: ugyfelszolgalat@naih.hu).
Please note that you may also bring a civil lawsuit before the court.
10. Data security
We provide the necessary privileges and internal organization and technical solutions during the operation of the information technology systems in order to prevent unauthorized persons from accessing, erasing or modifying your data or saving them from the system. We enforce the data protection and security requirements against our data processors as well.
We keep records of potential personal data breaches in accordance with our rules on the management of breaches. In the case of a personal data breach within the meaning of the Regulation, we notify you (if we have the opportunity) and the supervisory authority as well.
11. Miscellaneous provisions
The HFF reserves the right to amend the data processing policy in a way not affecting the purpose or legal basis of the processing.
However, if we want to carry out data processing in respect of the collected data for purposes other than the purpose for which they were collected, we inform you of the purpose of such processing before the additional processing as well as the following information:
the duration of storage of the personal data, or if it is not possible, the criteria for the definition of such period;
your right to request access to the personal data relating to you, the rectification, erasure or restriction of the processing of the data and, in the case of processing based on legitimate interests, to object to the processing of personal data, and, in the case of processing based on consent or contract, to request ensuring the right to data portability;
in case of data processing based on consent, you may withdraw your consent at any time,
the right of submitting complaints addressed to the supervisory authority;
whether the personal data were provided based on a legal or contractual obligation or if it is a condition precedent to entering into a contract, whether you are obliged to provide the personal data and the possible consequences where you do not provide the data;
information about the existence of automated decision-making, including profiling (if such a procedure is used) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.
Processing may be commenced after that only. Where consent is the legal basis for the new data processing, your consent in addition to the information is also required for the processing.
Otherwise, information about the modification is given by means of posting a notice on the adatvedelem.mlsz.hu site.
This policy takes effect on 28.07.2021. Its archived version can be found among the downloadable documents below the policy.
