EU Law analysis: In Budapest Főváros IV Kerület Újpest Önkormányzat Polgármesteri Hivatala v Nemzeti Adatvédelmi és Információszabadság Hatóság, the Court of Justice ruled that national supervisory authorities have the power to order data controllers to erase unlawfully processed personal data, even if the data subject has not directly asked for this. The court also stated that, when data processing is unlawful, the national supervisory authority can order the erasure of personal data whether the controller collected the data directly from data subjects or from third parties. This ruling could have a significant impact on future data-driven products and services, as businesses may not only end up with significant fines but may also be obliged to delete valuable datasets that violate the EU GDPR, even without any request from a data subject. Written by Kinga Kálmán, Junior Associate, Ádám Simon, Senior Associate, and Bálint Halász, Partner at Bird & Bird.