Followed its internal policy -> this is why they did it

and Hungarian law -> this is how they did it

European law about data protection and breaches, not sure if it is in effect yet and not sure if it applies to this exact case:

http://www.lexology.com/library/detail.aspx?g=8185429b-c98d-...