32. Data Protection Procedures of the Authority Section 60 (1) The Authority is entitled to launch data protection procedures to enforce the right to the protection of personal data. (2) Unless otherwise provided in this act, the Act on the general rules of administrative proceedings applies for data protection procedures. (3) Data protection procedures can only be launched ex officio, and shall not qualify as a procedure launched on request even if an investigation based on a report and made by the Authority preceded the data protection procedure. Should, however, an investigation based on a report and made by the Authority have preceded the data protection procedure, the reporting individual must be notified of the launch and the closing of the data protection procedure. (4) The Authority shall launch a data protection procedure, if, on the basis of the investigation based on a report or otherwise, unlawful control of the personal data is presumed and the unlawful control a. concerns a wide scope of persons; b. concerns special data, or c. significantly harms interests or engenders the risk of damages. (5) The deadline date for administration within the scope of the data protection procedure is two months. Section 61 (1) In the decision made within the scope of the data protection procedure, the Authority may a. b. c. d. e. f. order the correction of unauthentic personal data; order the blocking, deletion or destruction of illegally controlled personal data; prohibit the illegal control or processing of the personal data; prohibit the transfer of the personal data to other countries; order notification of the data subject, should the controller have unlawfully refused to, and impose a fine. (2) The Authority is entitled to instruct the disclosure of their decision – by disclosing the ID data of the controller – should this be required in the interest of data protection or to protect the rights of a greater number of data subjects ensured within the scope of the present Act. (3) The fine imposed in accordance with subsection (1)(f) may range from 100,000 HUF to 10,000,000 HUF. (4) To decide whether a fine should be imposed and to determine its amount, the Authority shall consider all circumstances of the case, with special regard to the size of the scope of individuals affected by the legal offense, its weight and repetition. (5) The disputed data cannot be deleted or destroyed until the deadline for launching the procedure relevant to initiating a review by the court expires, or until the court issues its final verdict in the case of the initiation of review. 33. Procedure for the Supervision of Classified Data Section 62 (1) The Authority is authorised to launch a procedure for the supervision of classified data, should, pursuant to the investigation conducted based on the report made, it may otherwise be presumed that national classified information has been illegally classified. The procedure for the supervision of classified data of the Authority does not encompass tasks undertaken by the National Security Authority defined within the scope of the act on the protection of classified information.