Government Decree No. 226/2003. (XII. 13.) Korm. on the ... - English

<strong>Government</strong> <strong>Decree</strong> <strong>No</strong>. <strong>226</strong>/<strong>2003.</strong> (<strong>XII</strong>. <strong>13.</strong>) <strong>Korm</strong>.
on the Special Conditions of Data Management by Electronic
Communications Service Providers, the Data Security of Electronic
Communications Services, and the Rules of Identifier Presentation and
Call Diversion
On the basis of the authorization granted in Article 182, paragraph (2), subparagraph i) of Act 100 of 2003 on
Electronic Communications (hereinafter: “Eht..”), the <strong>Government</strong> hereby orders the following:
Article 1
(1) The effect of this <strong>Decree</strong> shall extend to natural persons, legal entities and unincorporated organizations
providing electronic communications services in Hungary (hereinafter: “service provider”), as well as to the
subscribers and users of electronic communications services.
(2) The effect of this <strong>Decree</strong> shall not extend to data supply performed for organizations authorized to gather
intelligence and obtain secret data and data supply performed pursuant to Articles 200 to 206 of Act 19 of 1998
on Criminal Proceedings, as well as to data management associated with the establishment and operation of
private networks.
Article 2
(1) The service provider shall select and operate the electronic communications devices used for the
management of personal data during the provision of the service in such a way that
a) the managed data are available to the authorized persons (availability),
b) the authenticity and authentication of the managed data are ensured (authenticity of data management),
c) the consistency of the managed data can be proven (data integrity),
d) the managed data are protected against unauthorized access (confidentiality of data).
(2) The service provider shall ensure the protection of the security of data management with technical and
organizational measures that provide a level of protection corresponding to the risks arising in connection with
data management.
Article 3
(1) The service provider shall draw up a data protection and data security code on the detailed rules of the
management of personal data, the selection and operation of devices used for the management of personal data,
as well as of data transmission and record-keeping associated therewith (hereinafter: “code”).
(2) The code shall include:
a) range of personal data that may be managed by the service provider;
b) period and method of the storage of personal data;
c) cases when personal data may be passed on;
d) legal title for the management of personal data, which may be the consent of the person concerned or data
management prescribed by law;
e) In the case of data management prescribed by law, specification of the legal rule ordering the management
of data;
f) purpose of personal data management;
g) name, position and contact details of the internal data protection officer of the service provider;
h) obligation of data protection and secrecy binding the employees, members and agents of the service
provider.
(3) The service provider shall publish an information bulletin regarding the management of the personal data
of subscribers and users at its client service and on its Internet website. The bulletin shall include the items set
forth in Paragraph (2), subparagraphs a) to g), as well as the information defined in Article 156, Paragraphs (3)

and (4) of Eht., with special regard to the fact that the security of service shall include the security of data
management associated with the service.
(4) The code defined in Paragraph (1) and the bulletin defined in Paragraph (3) shall be forthwith updated in
the case of the existence of circumstances giving rise thereto, thus, in particular, a change in the circumstances
affected by the provision of information set forth in Paragraph (3). The updated bulletin shall be published
forthwith in the way regulated in Paragraph (3).
Article 4
(1) The service provider shall, pursuant to Article 142, Paragraph (2) of Eht., indicate the traffic and
invoicing data that are required to allow the subscriber to become familiar and check the correctness of the
calculation of the fee, to the extent required for the calculation of the fee and passing judgement in any fee
dispute.
(2) The statement defined in Paragraph (1) may not contain data suitable for the unambiguous identification
of the called party, with the exceptions set forth in Paragraphs (3) to (5).
(3) If, pursuant to Article 142, Paragraph (2) of Eht., the subscriber requests a statement containing more
detailed data than the items set forth in Paragraphs (1) and (2) from the service provider, the service provider
shall, prior to providing such data, call the attention of the subscriber to the fact that together with the statement,
it may come into the possession of the personal data of natural person users other than the subscriber using the
electronic communications service, and the subscriber is only entitled to become familiar with such data if the
users have consented thereto.
(4) The service provider is not obliged to examine the existence of the consent or the content thereof, only the
subscriber shall be responsible for the consent.
(5) The information defined in Paragraph (3) shall be included in the general terms of contract or, if the
service provider is not obliged to draw up such a contract, in the individual subscriber contract.
Article 5
(1) In the statement defined in Article 4, Paragraph (3), the service provider may not, even at the request of
the subscriber, state the calling numbers of the organizations published by the National Communications
Authority (hereinafter: “authority”) as “unidentifiable calling number” at least five days prior to receipt of the
subscriber’s request, on which
a) a service is provided mostly to anonymous callers from which special data may be inferred regarding the
calling party, thus, in particular, calls made to emergency lines related to religious or physiological problems or
pathological addictions,
b) mostly anonymous callers are allowed to report crimes (anonymous witness lines),
c) emergency services are notified.
(2) The authority shall keep electronic records of the unidentifiable calling numbers (hereinafter: “registry of
unidentifiable calling numbers”).
(3) The application for entry in the registry of unidentifiable calling numbers shall be submitted to the
authority. The authority shall decide on the application within 15 days, and shall enter the calling number
specified by the applicant in the registry of unidentifiable calling numbers or shall refuse such entry in the
registry.
(4) The authority shall ensure that the electronic communications service providers may have access
continuously and electronically, without paying a separate fee, to the list of calling numbers included in the
registry of unidentifiable calling numbers.
Article 6
(1) The service provider shall ensure free of charge, at the written request of the subscriber,
a) for the calling party user to be able to prohibit the presentation of its identifier on the called telephone set
for each call,
b) for the calling subscriber that it may prohibit the presentation of its identifier on the called telephone set at
each subscriber access point,
c) for the calling party user that it allow the presentation of its identifier on the called telephone set for each
call, notwithstanding the prohibition defined in paragraph b),
d) for the called subscriber that the identifier of the calling party be not presented on its telephone set,
e) for the called subscriber to refuse to accept calls in the cases of which the calling party has prohibited the
presentation of its identifier.
(2) The prohibition defined in Paragraph (1), subparagraphs a) and b) shall not apply to the calling numbers
of organizations defined in a separate legal rule that are especially important for the functioning of the state and
2

the provision of the public with essential services and for the emergency services (police, fire brigade and
ambulance), including calls made to the “112” uniform European emergency number. In order to respond to
emergency calls, the service provider shall, at the request of the emergency services, make available data
relating to the identification of the calling party and the location of the calling party even in the case of the lack
or withdrawal of its consent to the identification of the calling party and the handling of data identifying
locations.
(3) The service provider shall be entitled to temporarily disregard the prohibition of the identification of the
line of the calling party while cooperating with the authorities defined in Article 155, Paragraph (7) of Eht., in
the procedure defined therein, if a subscriber requests this in the interest of tracking malicious or harassing calls
in the cases of which there is good reason to suspect that any of the crimes defined in Article 155, Paragraph.
(7) of Eht. have been perpetrated. In this case, the service provider shall store the call data containing the
identification of the calling subscriber and shall make them available to the entities authorized to have access to
them.
(4) The service provider shall ensure free of charge for its called subscriber that, at its request, in the case of
calls made to the calling number of the subscriber, the identifier of the called line is not presented on the
telephone set of the calling party (prohibition of the presentation of the identifier of switched lines).
(5) The mobile radio telephone service provider shall only ensure that the provisions of this Article are
performed when the mobile radio telephone services are used for the purpose of voice transmission.
(6) The service provider shall also ensure that the provisions of this Article are performed in the case of
international calls within its own network in respect of subscriber lines connected to analogue exchanges if this
is technically and economically feasible.
(7) The service provider shall inform the public about the possibilities provided to them in this Article at its
client service, on its Internet website and in other customary ways.
Article 7
(1) The service provider shall ensure for the subscriber free of charge that if the service provider
automatically diverts, at its request, the calls arriving at its telephone set to a telephone set with another calling
number, it may request that no data
a) that contains reference to the calling number to which the diversion has been made or
b) that contains reference to the person of the subscriber to whom the diversion has been made
appear on the telephone set of the calling party.
(2) The service provider shall ensure free of charge that the subscriber may prohibit, at the request of the
diverting subscriber, the automatic diversion of calls arriving at the calling number of the diverting subscriber to
the subscriber’s own calling number if it is technically possible.
Article 8
The service provider shall allow the subscriber and the user to carry out the provisions of Articles 6 and 7 in
a simple way, thus, in particular, to perform the individual prohibitions by using the telephone set if the
telephone set is technically suitable therefor.
Article 9
For the purposes of Article 6 and Article 7, Paragraph (1), it shall also be regarded as the presentation of the
identifier if the identifier is communicated to the user through an automated voice recording.
Article 10
The service provider may only disclose information to the called party about the identification of the location
of the calling subscriber, with the exception set forth in Article 6, Paragraph. (2), with the consent of the calling
subscriber, and the service provider shall provide for the granting or refusal of such consent for the calling
subscriber free of charge.
Article 11
(1) An automated call system operating without human intervention may only be used for the purposes of
directly soliciting business or providing information in respect of the subscriber if the subscriber has consented
thereto in advance.
(2) In the case of an already existing consent of the subscriber, the service provider may regard the
subscriber’s consent as granted, but only in respect of its own similar products or services, and only if the
service provider has obtained the subscriber’s electronic contact details in accordance with the provisions of the
law.
3

(3) The service provider shall ensure that the subscriber may withdraw its consent granted in advance at any
time for no cost to it and without any other detriment.
Article 12
The authority shall verify compliance with the rules set forth in this <strong>Decree</strong> as part of its market supervision
activity.
Closing Provisions
Article 13
(1) This <strong>Decree</strong> shall come into force on 1 January 2004, with the exception of the provisions of Paragraph
(2), simultaneously, <strong>Government</strong> <strong>Decree</strong> <strong>No</strong>. 253/2001 (<strong>XII</strong>.18.) <strong>Korm</strong>. on the Special Conditions of Data
Management by Communications Service Providers, the Data Security of Communications Services and the
Rules of Identifier Presentation and Call Diversion shall cease to be in force.
(2) Article 6, Paragraph (1) of this <strong>Decree</strong> shall come into force on 1 February 2004.
(3) The provisions set forth in Articles 6 to 9 and 11 of this <strong>Decree</strong> shall apply to service providers providing
fixed-line telephone service and mobile radio telephone service, while the provision set forth in Article 10 shall
only apply to service providers providing mobile radio telephone service.
(4) This <strong>Decree</strong> contains regulation compatible with Directive 2002/58/EC of the European Parliament and of
the Council concerning the processing of personal data and the protection of privacy in the electronic
communications sector (Directive on data protection and electronic communications) in harmony with the
provisions of the European Agreement on the Establishment of Association between the Republic of Hungary
and the European Communities and Their Member States, signed in Brussels on 16 December 1991; Act 1 of
1994 promulgating the Agreement; as well as the provisions of the Treaty on Accession to the European Union
signed between the Member States of the European Union, the Czech Republic, the Republic of Estonia, the
Republic of Cyprus, the Republic of Latvia, the Republic of Lithuania, the Republic of Hungary, the Republic
of Malta, the Republic of Poland, the Republic of Slovenia, and the Republic of Slovakia signed on 16 April
2003 in Athens and coming into force simultaneously with the coming in to force of the Act promulgating the
Treaty of Accession on 1 May 2004, together with Act 100 of 2003 on Electronic Communications.
4