Camera Surveillance, Puskás Arena
Data Processing Policy
regarding the use of the camera system of Puskás Arena by the HFF
1. Where to find information related to data processing?
HFF has prepared this notice in accordance with the provisions of the EU General Data Protection Regulation 2016/679 (hereinafter referred to as “GDPR” or “Regulation”) with the specific purpose to make the data management processing operations transparent in a comprehensible manner.
This notice contains key information relating to the specific data processing (legal basis and purpose of processing, scope of processed data, duration, etc.), supplemented by the document titled General Information on Data Processing, which explains your rights and how to exercise them, the obligations related to data security and the rules in the amendment of the notice. The rules in the document title General Information on Data Processing available below.
2. Presentation of the cases of processing and scope of processed data
As a rule, a security camera system is operated during the sporting events of the national team.
Pursuant to Section 74 (1) of Act I of 2004 on sports (hereinafter, the “Sports Act”), a camera recording may be made by:
- the organizer,
- if security staff employed, the security staff, and
- the representative of the travelling sports organization.
The HFF is the organizer of the national team matches and some priority events (e.g. Hungarian Cup final).
As regards the duration, the recording covers the duration of the sports events (including the time of entering and leaving the venue of the event).
As regards the place, the recording extends to:
- the venue of the sports event,
- public areas occupied by the fans waiting for admission, and
- car parks designated for the spectators as well.
The recording and the surveillance can be carried out by using cameras of quality ensuring the individual identification of the participants, which are placed in the number specified by the police or fixed on the body of the organizer or if security staff employed, the security staff.
In the case of sports events qualified as ordinary, making a recording is not an obligation, but a right, in order to ensure the personal safety and asset security of the participants.
In the case of football, making a recording is mandatory during the sports events qualified as carrying an increased security risk or a special security risk.
The data recorded by the camera is simultaneously and continuously monitored by the organizer, the members of the security company, the authorised representative of the security company and the data processors in a room set up for this purpose within the area of the sports event. The assigned representative of the police and the national security service may be present in the process. If so required by the police or the national security service, the organizer, the security company or the representative of the organizing entity must provide access to camera surveillance during the sports event.
The camera system processes as personal data the video and audio recording at the match, as well as video and audio recording of the data subjects, including their facial likeness, behaviour and clothing.
In respect of recordings made by the organizer or the travelling sports organization, the HFF is not considered a data controller, and information may be requested from and the rights of the data subjects may be exercised vis-á-vis the legal entity making the recording.
3. Duration of Data Processing
Based on Section 74 (3) of the Sports Act, the recordings are kept for 120 hours.
However, the police may call on the organizer, the security staff or the travelling sports organization during this period of 120 hours to keep the recordings for an additional period up to a maximum of 60 days if they contain information necessary for initiating or conducting a petty offence or criminal proceeding.
If, based on the recordings, the HFF launches a banning procedure, the recordings serving as the basis of the ban are retained until they are requested or, in the absence thereof, the closing of the banning procedure.
4. Purpose of Data Processing
The purpose of data processing is to meet the requirements of Sections 74 (1) and (3) of the Sports Act.
Based on the legislation above, the data can be used for the purpose of criminal or petty offence proceedings due to crimes or petty offences committed on the venue of the sports event or while accessing or leaving the area of the sports event or, pursuant to Section 73 (5) of the Sports Act, for the launch by the organizer or the travelling sports organization of a procedure for banning from attending the sports event or the launch of administrative proceedings or the enforcement of civil law claims, by the third working day of the receipt of the notice of the non-appealable closing of the proceeding, respectively, the expiry of the effect of the ban, for the purpose of banning the disturbing person.
Data which falls under restriction based on the data subject’s request may be processed by the HFF for the establishment, exercise or defence of legal claims or the protection of the rights of another natural or legal person.
The purpose of data processing after the expiry of the statutory retention period or related to sports events that do not carry an increased or special security risk, is the exercise of claims by the HFF (e.g. a claim for damages), banning the data subject from attending sports events or the securing other possible administrative procedures (verification of claims, identification of data subject).
5. Recipients of Data, Categories of Recipients
Data from the recordings may be requested by the national security service, the police, the petty offence authority, the public prosecutor’s office and the court in order to discharge their national security, criminal prosecution, petty offence and justice duties, as well as the data subject. The organizer and the travelling sports organization may transmit the recordings to the acting body for the purposes of subsequent procedures, including those in Section 4.
The camera surveillance system will be operated by the Nemzeti Sportközpontok from 14.02.2020., until that date the system will be operated by its contractual partners, the ZÁÉV Építőipari Zrt. and the Magyar Építő Zrt. jointly, and all tasks will be performed related to the operation.
Nemzeti Sportközpontok
registered address: 1146 Budapest, Istvánmezei út 3-5.
postal address: 1442 Budapest Pf. 94.
phone number: +36 1 471 4100
E-mail address: titkarsag@mnsk.hu
ZÁÉV Építőipari Zrt.
registered address: 8900 Zalaegerszeg, Millenium köz 1.
postal address: 8900 Zalaegerszeg Millenium köz 1.
phone number: +36 92 504 100
E-mail address: zaev@zaev.hu
Magyar Építők Zrt.
registered address: 1149 Budapest XIV. Pillangó utca 28.
postal address: 1591 Budapest Pf: 340
phone number: +36 1 467 2700
E-mail address: info@magyarepito.hu
LOGIPIX Műszaki Fejlesztő, Gyártó és Kereskedelmi Kft.
registered address: 1158 Budapest, Késmárk utca 11-13.
postal address: 1158 Budapest, Késmárk utca 11-13.
E-mail address: info@valyilaw.hu
The Logipix Kft. is the maker of the video cameras observing the stadium bowl, the developer and operator of their software.
Honeywell Szabályozástechnikai Kft.
registered address: 1139 Budapest, Petneházy u 2-4. 3. em.
postal address: 1139 Budapest, Petneházy u 2-4.
phone number: +36 1 451 4300
website: https://www.honeywell.com/en-us/global/hu-hu
A Honeywell Szabályozástechnikai Kft. is the operator of the other cameras of the stadium.
The assigned members of the above-mentioned entities may reach the camera records during the process of the recording and storing to the extend it is necessary to perform their tasks related to the operation of the system but the records may be processed and used only by the orders of the data controller. The server run and operated by the Nemzeti Sportközpontok.
6. Source of Personal Data
The data are recorded based on the participants’ knowledge.
7. Legal Basis of Data Processing
The legal basis of the data processing is paragraph c) of Article 6 (1) of the Regulation, that is, meeting the legal obligation under Section 74 of the Sports Act in the case of sports events involving the national team and other events involving an increased or special security risk directly organized by the HFF (e.g. Hungarian Cup final).
The legal basis for the processing of camera recordings exceeding the duration set out in Section 74 (3) of the Sports Act or at an event other than one involving an increased or special security risk, is paragraph f) of Section 6 (1) of the Regulation, that is, the legitimate interest of the HFF to exercise its legitimate interests (e.g. claim for damages or passing through damages) and in the course thereof, as well as for verifying and exercising its legitimate interests in banning and other potential official proceedings and identifying the data subjects.
8. Areas Under Surveillance
In the Puskás Arena, the cameras cover the following areas:
- grandstands and associated staircases;
- entry points;
- player exit, other corridors of the building;
- the field and areas around the field closed from the spectators;
- areas under the grandstands (so-called cloister);
- operating areas;
- parking lots;
- the fence surrounding the stadium and public areas near the admission points.
General Information on Data Processing
(General Privacy Policy and Rights of Data Subjects)
1. Practicing the Rights of Data Subjects
You can reach us at any of the contact points below regarding issues related to data processing:
Email address: mlsz@mlsz.hu
Email address of data protection officer: adatvedelem@mlsz.hu
Mailing address: 1386. Budapest 62. Pf. 906/1
You can initiate exercising your rights by sending an email to the bejelentes@mlsz.hu address or a letter to the above mailing address, however, exercising your rights requires your identification, so we suggest that you use the https://adatvedelem.mlsz.hu/adatbejelento-urlap site in order to protect your data and speed up the process.
The type of the right you may exercise in relation to the specific data processing depends on the legal basis we use for processing your data, which can be the following (but, of course, may also apply for exercising all your rights):
|
Right |
Legal obligation |
Legitimate interest |
|
access to personal data and information relating to data processing |
x |
x |
|
right to data portability |
||
|
right to erasure |
x |
|
|
right to restriction |
x |
x |
|
right to rectification |
||
|
right to object |
x |
|
|
withdrawal of consent |
||
|
right to go to supervisory authority and court |
x |
x |
The rights may be exercised by the legal representative of minors under the age of 16, and the rights of a minor above the age of 16 may be exercised by his legal representative.
Data Processing Related to Complaints Management
Complaints related to data processing are responded within one month at the latest, which may be extended by another 2 months in justified cases.
If you wish to exercise your rights, we have to identify you and necessarily communicate with you.
The HFF ensures the identification of the applicant as follows:
- Personal identification: this can be arranged at the HFF county directorate of your choice or the HFF headquarters. In this case, we identify you personally based on your identity card and this is the only form of identification where no personal data is recorded.
- Identification through the verification of data: if you are unable to appear for personal
identification, you need to disclose to us the number of one of your identification documents (which can be an ID card, passport or driver licence), your mother’s birth name, your place and date of birth and your name. Based on this data, we make a search in the Personal Data and Address Register by using the ID of your document to check if the data is real. If the data is real, it is confirmed that you have an identity card that contains the specified data.
Please note that if you choose this method of identification or any other method we offer during the procedure that does not require personal presence, the HFF disclaims all liability for any damage and/or other disadvantage incurred by you or any other legal or natural person resulting from the fulfilment of the request.
In the case of a legal representative, if his declaration on his right of representation is not available in our system, it is also necessary for the applicant to make a declaration on his representation by using the form provided by the HFF, which involves the processing of the name, ID card number and home address of the declarant and the witnesses confirming the declaration.
The data provided by the data subject and/or the legal representative and the witnesses during the identification and/or when making the declaration, as well as the application are retained by the HFF for 5 years in accordance with the document management policy. The application and related correspondence will also be available in our email account.
If in doubt, we may call the applicant to carry out further acts of identification. We exercise this right if complying with the application would have legal effects on the applicant or the data subject. Such cases include, for example, if someone requests erasure of his data but he is an active football player and erasing the data would cause revoking the competition licence of the football player.
The legal basis of data processing is paragraph f) of Article 6 (1) of the Regulation, that is, the legitimate interest of the HFF to process complaints and verify how it proceeded and what measures it took in respect of each complaint.
The data processor linked to the processing of the applications is RelativeGROUP Kft., being the operator of the mlsz.hu site (Registered address: 2000 Szentendre, Tölgy utca 12.).
The storage and organisation duties related to our documents are carried out by PRIV-DAT Dokumentum Archiváló és Tároló Kft. (registered address: 1211 Budapest, Weiss Manfred út 5-7).
1.1. Right to request information and copy (right of access)
You have the right to obtain feedback as to whether or not personal data concerning you are being processed, and, where that is the case, you have the right to:
- be given access to the personal data processed (that is, to request a copy thereof), and
- be informed by us of the following:
o purposes of the data processing;
o categories of the personal data processed;
o information on recipients or categories of recipients to whom or which the personal data has been or will be communicated;
o the planned duration of storage of the personal data, or if it is not possible, the
criteria for the definition of such period;
o your right to request the rectification, erasure or restriction of the processing of your personal data, and to object to the processing of your personal data where the processing is based on legitimate interest;
o the right of submitting complaints addressed to the supervisory authority;
o if the data was not collected from you, all available information regarding their source;
o information about the existence of automated decision-making, including profiling (if such a procedure is used) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.
The purpose of the exercise of the rights may be directed to establish or verify the legality of data processing, so we may charge a reasonable fee for providing the information if you request information on multiple occasions.
Access to the personal data is ensured in the form you request, which can be in electronic form, by post or personal information.
1.2. Right to restriction of processing
You have the right to obtain from us restriction of processing where one of the following applies:
- you contest the accuracy of the personal data. In this case, the restriction applies to a period enabling us to verify the accuracy of the personal data (we do not apply restriction if no verification is necessary);
- the processing is unlawful and you oppose their erasure and demand the restriction of their use instead;
- we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
- you have objected to processing the data, but it is based on our legitimate interest (in this case, the processing is restricted until it is verified whether our legitimate grounds override your legitimate grounds).
Where data processing is restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of your legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
You will be informed of lifting the restriction of processing in advance (at least 3 working days before the restriction is lifted).
Please note that, in certain cases, restricting the right of data processing may lead to other consequences, such as losing any benefits that are associated with the processing (e.g. buying tickets online, use of fan discounts or losing the right to enter the field as a player). You will be informed of such eventualities when this right is exercised.
1.3. Right to erasure – right to be forgotten
You shall have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- you withdraw your consent, and there is no other legal ground for the processing;
- you object to the processing based on legitimate interest, and there are no overriding legitimate grounds (namely legitimate interests) for the processing;
- the personal data have been unlawfully processed, and it has been established on the basis of the complaint;
- the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject.
If, for any legitimate ground, we have made your personal data public and we are obliged to erase them for any reason listed above, and by taking account of available technology and the cost of implementation, we shall take reasonable steps, including technical measures, to inform other controllers which are processing the personal data that you have requested the erasure of any links to, or copy or replication of, those personal data (right to be forgotten). As a rule, we will not make your personal data public.
If the records recorded during the sporting events were published by the rights holder television, media provider or its partners, it was done by their commercial rights. Please turn with your requests to the provider if it is related to this topic.
The erasure shall not apply to the extent that processing is necessary:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject (such case is, for example, the processing carried out during invoicing, since the storage of the invoice is required by law, or the compulsory registration of the sportsman, registration of the license);
- for the establishment, exercise or defence of legal claims (e.g. if we have a claim you have not fulfilled, or if the processing of a consumer complaint or a complaint against data processing is in progress).
1.4. Right to object
You shall have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you based on legitimate interest. We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
1.5. Legal Remedies
If you think we have breached a legislative provision relating to the processing of personal data, or we have not executed your request for the termination of alleged unlawful processing of personal data, you may request an investigation procedure from the Hungarian National Authority for Data Protection and Freedom of Information (mailing address: 1363 Budapest, Pf.: 9., email: ugyfelszolgalat@naih.hu).
Furthermore, please note that you also have the right to bring a civil action in a court.
2. Security of personal data
We provide the necessary privileges and internal organization and technical solutions during the operation of the information technology systems in order to prevent unauthorized persons from accessing, erasing or modifying your data or saving them from the system. We enforce the data protection and security requirements against our data processors as well.
We keep records of potential personal data breaches in accordance with our rules on the management of breaches. In the case of a personal data breach within the meaning of the Regulation, we notify you (if we have the opportunity) and the supervisory authority as well.
3. Miscellaneous provisions
The HFF reserves the right to amend the data processing policy in a way not affecting the purpose or legal basis of the processing.
However, if we want to carry out data processing in respect of the collected data for purposes other than the purpose for which they were collected, we inform you of the purpose of such processing before the additional processing as well as the following information:
- the duration of storage of the personal data, or if it is not possible, the criteria for the definition of such period;
- your right to request access to the personal data relating to you, the rectification, erasure or restriction of the processing of the data and, in the case of processing based on legitimate interests, to object to the processing of personal data, and, in the case of processing based on consent or contract, to request ensuring the right to data portability;
- in case of data processing based on consent, you may withdraw your consent at any time,
- the right of submitting complaints addressed to the supervisory authority;
- whether the personal data were provided based on a legal or contractual obligation or if it is a condition precedent to entering into a contract, whether you are obliged to provide the personal data and the possible consequences where you do not provide the data;
- information about the existence of automated decision-making, including profiling (if such a procedure is used) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.
Processing may be commenced after that only. Where consent is the legal basis for the new data processing, your consent in addition to the information is also required for the processing.
Otherwise, information about the modification is given by means of posting a notice on the adatvedelem.mlsz.hu site.
This policy takes effect on 28.07.2021.
