Information on data managing by the pension insurance administration bodies

2023.09.21. 13:01

Controller of the pension insurance register:

Hungarian State Treasury Centre
Registered office: 1054 Budapest, Hold utca 4.
Postal address: 1909 Budapest
Phone numbers: +36-1-327-3600
Electronic contact information: HERE
Data protection officer’s name: Dr. Bálint Dobai
Postal address: 1909 Budapest
E-mail address: adatvedelem@allamkincstar.gov.hu

Section 55(2)(a) of Act CXXII of 2019 on Entitlements to Social Security Benefits and on Funding These Services (hereinafter Social Insurance Act) provides that the controller of the pension insurance register is the central pension insurance body, and the Hungarian State Treasury Centre has been designated to perform this task.

The bodies managing and processing pension insurance data are the following:

The controller of the pension insurance register is the Hungarian State Treasury, which performs central pension insurance tasks and whose head is obliged, with regard to his responsibility for the protection of citizens' personal data, to take technical and organisational measures and to establish a control system that adequately ensures compliance with data protection requirements. [Section 96 (7) of Act LXXXI of 1997 on Social Security Pension Benefits (hereinafter Social Security Pension Benefits Act)]

In view of the fact that the register is a public register belonging to the national data property, the controller of the pension insurance register may entrust the processing tasks related to the register only to a public administration body or an economic entity wholly owned by the state.

The administrative bodies using pension insurance data are the following:

the government offices of the capital and the counties (with the exception of the Pest County Government Office),
the Hungarian State Treasury Centre,
Pension Payment Directorate of the Hungarian State Treasury

For what purposes can pension insurance bodies manage personal data?

The pension insurance administration bodies shall record the personal data necessary for the performance of their tasks, as defined in Section 96(2) of the Social Security Pension Benefits Act on the use of identification codes and the methods of identification replacing the personal identification number, pursuant to Section 6(2) of Act XX of 1996 on the use of identification codes.

Their tasks primarily include the processing of data on the acquisition of social security rights, the registration of pension insurance declarations and payments, the assessment, payment and control of benefits claimed, which requires the processing of personal data of insured persons, persons applying for benefits and their representatives. The recording of data is necessary for the identification of the applicant of the benefit, for maintaining contact between the applicant and the pension insurance body, for performing official procedures, for assessing, establishing and paying entitlement to the benefit applied for, and for the ongoing verification and checking of entitlement to the benefit in the case of a statutory requirement relating to the particular benefit.

What are the legal basis for pension insurance bodies to manage personal data?

The data managing by pension insurance bodies in connection with the performance of their tasks is not based on consent, but is necessary and obligatory for the fulfilment of the legal obligations applicable to pension insurance bodies, as detailed below.

Pursuant to Section 27 (1) of Act CL of 2016 on the General Administrative Procedure, pension insurance bodies are entitled to obtain and process the natural person identification data of the client and other participants in the procedure, as well as personal data as defined in the Social Security Pension Benefits Act, and other personal data that are indispensable for clarifying the facts.

In addition to the above, pension insurance bodies are obliged by law to keep records of pension insurance activities, and the legal basis for the processing of data in this context is specified in the Social Security Pension Benefits Act.

What personal data can be kept by pension insurance bodies?

The scope of the personal data that may be recorded is defined in Section 96 (2) of the Social Security Pension Benefits Act as follows:

identification data of natural persons (surname and forename of the natural person, surname and forename at birth, place of birth, date of birth, and the mother's surname and forename at birth),
marital status, citizenship,
domicile (place of residence),
the occupation, job, function, activity,
data concerning the degree of disability, the degree of health impairment, the state of health, the capacity for occupational activity, the possibility of rehabilitation, and the state of health, where the pension or other benefits are determined by law taking into account the state of health,
data on earnings, income and contributions deducted and paid,
data on relatives, where the pension or other benefits are determined by law taking into account the status of the relatives,
data on the benefits awarded or disbursed,
the data received from the Hungarian Financial Supervisory Authority and, if transferred to the general government, the amount of payments of returning members,
in the case of the winding-up of a private pension fund, the data received from the liquidator or liquidators on members returning to the social security pension scheme,
an individual identifier linked to the identification service to be provided by the Government,
the identifier linked to the electronic information service (i.e. the official electronic mailbox identifier).

The Hungarian State Treasury may process the tax identification number of the holder of the right to use the tax identification number in order to fulfil its data reporting and other statutory obligations towards the state tax authority and after the termination of the contact code under the consolidation register.

The data on the acquisition of the right are entered in the pension insurance register upon fulfilment of the obligation to notify by the employers or the bodies or persons obliged to notify and upon notification of the tax authority.

If the pension insurance body initiates an administrative procedure on request or on the basis of a statutory provision, it is also entitled to obtain and process the identification data of the natural person client and other participants in the procedure and the personal data specified in the act governing the type of case, as well as other personal data that are indispensable for clarifying the facts.

In order to assess entitlement, the data must be provided by the client on the application form or obtained by the pension insurance body during the verification procedure. The application form may also ask you to provide personal data that you are not obliged to provide, e.g. your telephone number or e-mail address, which can make it easier for us to contact you and accelerate the process.

To which bodies may personal data be transferred?

The rules on transferring data are specified in Section 96 (3)-(6) of the Social Security Pension Benefits Act in detail.

The following bodies are authorized to request natural person identification data or data related to the benefits awarded or paid from the data recorded:

the state tax and customs authority and the municipal tax authority for reasons of control and enforcement and establishing support,
the employment supervisory authority, occupational safety and health authority, family welfare authority, rehabilitation authority, social and guardianship administration bodies and the government employment agency for the purpose of employment supervisory procedures and occupational safety inspections, and for establishing, payment and control of benefits,
the bodies or persons providing healthcare services with a view to discharging their duties in providing healthcare services,
the refugee authority for the purpose of granting and payment of benefits and support and for the control of eligibility, and in asylum procedures for verifying the client’s statements, and for verifying compliance with statutory requirements,
the organization defined in Section 35/A of Act XLI of 2012 on Passenger Transport Services relating to persons who received a travel voucher from the pension paying agency, with a view to monitoring travel allowances in the carriage of passengers in public transportation systems,
the body delegated to handle matters related to artists’ allowances provided for in the Act on the Hungarian Academy of Arts with a view to the payment of artists’ allowances and for verifying eligibility.

The following bodies are authorized to request natural person identification data, data on relatives (where the pension or other benefits are determined by law taking into account the status of the relatives) or data related to the benefits awarded or paid:

the central financial department of the ministry of the minister in charge of defense for the purpose of processing in connection with planning and interest representation functions, for establishing, payment and monitoring benefits, and for statistical purposes, with respect to persons to whom the Hungarian Armed Forces provide social care,
the law enforcement bodies and organizations and the civilian national security service for establishing and monitoring eligibility for additional dependent support and/or supplementary aid to orphans.

Bodies entitled to access the full range of data recorded:

court,
public prosecutor's office,
law enforcement and penitentiary authorities,
national security services.

The above bodies may request data from the pension insurance bodies for the performance of their mandatory tasks, for the purposes and under the conditions laid down in the laws applicable to them. [Section 96 (4) of the Social Security Pension Benefits Act]

Pursuant to Section 96 (1a) of the Social Security Pension Benefits Act, pension insurance bodies may also process, for the purposes of government information, data on the names, addresses, pension reference numbers and the benefits paid and the benefits provided of persons receiving benefits, for the time necessary to provide the information and to monitor the provision and the provision of benefits.

Pursuant to Section 96(5a) of the Social Security Pension Benefits Act, data which may be recorded by pension insurance bodies must be transmitted to the Hungarian Central Statistical Office for statistical purposes, after prior verification of the statistical purpose and to the extent necessary for the statistical purpose.

Pension insurance bodies will only transfer your data to other bodies than those listed above if you give your prior written consent [Section 96 (6) Social Security Pension Benefits Act] or if required by legislation.

Duration of data managing:

The managing of data concerning the insured person or the person entitled to benefits is restricted in the records

5 years after the death of the insured person, former insured person or the beneficiary,
15 years after the cessation of the survivor's pension, but no later than 5 years after the death of the person receiving the survivor's pension.

The restriction may be lifted only for the purpose of establishing, paying or checking benefits. Data that have been continuously restricted for 20 years must be deleted.

What rights do you have in relation to your personal data managed?

Under the provisions of Section 96 (7) - (8) of the Social Security Pension Benefits Act, you or your representative may consult the social security register, request information about the personal data recorded and request information about the processing of your data. To this end, you may contact the pension insurance body to which you have submitted your application or which is dealing with your case.

Right to information

You have the right to receive from the pension insurance bodies, prior to the processing or at the latest immediately after the first processing operation, transparent and comprehensible information on the essential aspects of the processing, your rights and legal remedies. This privacy notice is published in view of your right to prior information.

You may exercise further rights and remedies in relation to the processing of your personal data if you prove your identity.

Right of access to the data (right of access)

You have the right to obtain from the pension insurance bodies information about the personal data concerning you which are processed in connection with pension insurance matters, the purposes, legal basis and duration of the processing, the legal basis and recipients of any data transfers.

Right to have access to data

You or your representative may consult the records kept by the pension insurance administration and, on request, the pension insurance administration will provide you with an extract of the data kept on you.

Right to rectification (amendment), deletion, restriction (blockage)

You have the right not only to access your personal data processed by the pension administration bodies, but also to ask for the rectification of your data and, in the case of data not mandatorily recorded, to request their deletion or restriction of processing. [The provisions on your rights in relation to processing and how to exercise them are specified in Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information and the EU General Data Protection Regulation (GDPR).]

The deletion or blockage of data concerning the acquisition of pension insurance rights and data concerning the entitlement to pension benefits disbursed, and other data subject to mandatory processing based on legislation, may not be requested.

Right to object

On the basis of this right, in the event of your objection, the pension insurance body will restrict the processing of your data not subject to mandatory processing and will investigate your objection. The pension insurance body may continue to process your data not subject to mandatory processing only if it has compelling legitimate grounds for processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

If the Hungarian State Treasury establishes that your objection is justified, it will stop processing your data not covered by the mandatory processing and delete the data.

How can you exercise these rights and what legal remedies do you have?

If you exercise the above rights, the pension insurance body will examine your request as soon as possible, but not later than 25 days after you have submitted it, and will notify you of its decision. The information should also indicate the body to which you can address your complaint about processing, what rights you have to remedy the complaint, how to take your case to court and to the Hungarian National Authority for Data Protection and Freedom of Information.

You can lodge a general complaint regarding the processing of your personal data with the Hungarian State Treasury as the central pension insurance body (1054 Budapest Hold u. 4.) or the Hungarian National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa u. 9-11., postal address: 1363 Budapest, P.O. Box 9.), or if you consider that the processing of your personal data is unlawful, you may bring a civil action against the Hungarian State Treasury before the competent court of the place of your residence or domicile.

Information on data managing by the pension insurance administration bodies

Legislation