NAIH (Hungary) - NAIH-5461-2/2024: Difference between revisions
From GDPRhub
No edit summary |
No edit summary |
||
| (One intermediate revision by one other user not shown) | |||
| Line 67: | Line 67: | ||
}} | }} | ||
The DPA reprimanded a media company | The DPA reprimanded a media company for a failure to provide the data subject, a politician, with the information listed in [[Article 13 GDPR|Articles 13]] and [[Article 14 GDPR|14 GDPR]]. On the other hand, the DPA found that using a drone to take pictures of the data subject's house was lawful under [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. | ||
== English Summary == | == English Summary == | ||
| Line 74: | Line 74: | ||
The data subject is a Hungarian politician, while the controller is a company managing several news websites and newspapers. | The data subject is a Hungarian politician, while the controller is a company managing several news websites and newspapers. | ||
The controller acquired some images of the data subject’s house in Budapest through a camera installed on a drone. These images were then published on several news websites, along with | The controller acquired some images of the data subject’s house in Budapest through a camera installed on a drone. These images were then published on several news websites, along with statements accusing the data subject of having built his house without a building permit. | ||
Moreover, the controller also published | Moreover, the controller also published ob its news outlets the entries of an electronic log about the construction works. | ||
The data subject filed a complaint with the DPA. He argued that the controller | The data subject filed a complaint with the DPA. He argued that the controller unlawfully published the data and that he was not provided with the information listed in [[Article 13 GDPR|Articles 13]] and [[Article 14 GDPR|14 GDPR]]. | ||
The controller, at the request of the DPA, did not clarify on which legal basis it was relying for this processing activity. Later on, the controller argued it was relying on [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] and provided the DPA with a legitimate interest test. In the latter, the controller pointed out that it needs to perform this processing activity in order to inform its readers, that it constitutes a proportionate restriction and that its purpose cannot be achieved by means of a lesser restriction. In addition, it noted that the processing is not unexpected for the data subject. | The controller, at the request of the DPA, did not clarify on which legal basis it was relying for this processing activity. Later on, the controller argued it was relying on [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] and provided the DPA with a legitimate interest test. In the latter, the controller pointed out that it needs to perform this processing activity in order to inform its readers, that it constitutes a proportionate restriction and that its purpose cannot be achieved by means of a lesser restriction. In addition, it noted that the processing is not unexpected for the data subject. | ||
Moreover, it argued that the data from the | Moreover, it argued that the data from the electronic log was sent to it by an unknown person in a sealed envelope. | ||
=== Holding === | === Holding === | ||
| Line 89: | Line 89: | ||
Secondly, the DPA underlined how the freedom of the press and, more generally, the freedom of speech and expression have a very important role in a democratic country and are protected by the constitution. | Secondly, the DPA underlined how the freedom of the press and, more generally, the freedom of speech and expression have a very important role in a democratic country and are protected by the constitution. | ||
More specifically, the DPA upheld the controller’s argument that | More specifically, the DPA upheld the controller’s argument that it had a legitimate interest in performing this processing activity, given that the purpose was informing the public about the credibility of a political public figure in the context of a public issue. | ||
Thirdly, the DPA analysed if this processing activity was actually necessary to reach this purpose. The DPA held that the recording and publication of the personal data was necessary to inform the public. Moreover, the data subject was not visible in the recordings. Therefore, the DPA was of the view that the necessity requirement was fulfilled. | Thirdly, the DPA analysed if this processing activity was actually necessary to reach this purpose. The DPA held that the recording and publication of the personal data was necessary to inform the public. Moreover, the data subject was not visible in the recordings. Therefore, the DPA was of the view that the necessity requirement was fulfilled. | ||
Fourthly, as for the balancing test, the DPA found that the contested data processing operations did not constitute an unnecessary and disproportionate intrusion into the privacy of the data subject. On this point, the DPA stressed the fact that the data subject is not a normal citizen but a politician. Therefore, he could expect that an element of his private life was questioned by public opinion. | Fourthly, as for the balancing test, the DPA found that the contested data processing operations did not constitute an unnecessary and disproportionate intrusion into the privacy of the data subject. On this point, the DPA stressed the fact that the data subject is not a normal citizen but a politician. Therefore, he could expect that an element of his private life was questioned by public opinion. | ||
Therefore, it held that the controller had rightly relied on [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] for this processing activity. | |||
Fifthly, as for the electronic log data, the DPA found a violation of [[Article 14 GDPR|Article 14 GDPR]]. Indeed, the controller failed to prove that it had sent the information provided for by this article to the data subject. | Fifthly, as for the electronic log data, the DPA found a violation of [[Article 14 GDPR|Article 14 GDPR]]. Indeed, the controller failed to prove that it had sent the information provided for by this article to the data subject. | ||
Latest revision as of 14:15, 14 October 2024
| NAIH - NAIH-5461-2/2024 | |
|---|---|
 | |
| Authority: | NAIH (Hungary) |
| Jurisdiction: | Hungary |
| Relevant Law: | Article 6(1)(f) GDPR Article 13 GDPR Article 14 GDPR |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | 07.06.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | Bence Tordai Mediaworks Hungary Zrt. |
| National Case Number/Name: | NAIH-5461-2/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Hungarian |
| Original Source: | HAIH (in HU) |
| Initial Contributor: | fb |
The DPA reprimanded a media company for a failure to provide the data subject, a politician, with the information listed in Articles 13 and 14 GDPR. On the other hand, the DPA found that using a drone to take pictures of the data subject's house was lawful under Article 6(1)(f) GDPR.
English Summary
Facts
The data subject is a Hungarian politician, while the controller is a company managing several news websites and newspapers.
The controller acquired some images of the data subject’s house in Budapest through a camera installed on a drone. These images were then published on several news websites, along with statements accusing the data subject of having built his house without a building permit.
Moreover, the controller also published ob its news outlets the entries of an electronic log about the construction works.
The data subject filed a complaint with the DPA. He argued that the controller unlawfully published the data and that he was not provided with the information listed in Articles 13 and 14 GDPR.
The controller, at the request of the DPA, did not clarify on which legal basis it was relying for this processing activity. Later on, the controller argued it was relying on Article 6(1)(f) GDPR and provided the DPA with a legitimate interest test. In the latter, the controller pointed out that it needs to perform this processing activity in order to inform its readers, that it constitutes a proportionate restriction and that its purpose cannot be achieved by means of a lesser restriction. In addition, it noted that the processing is not unexpected for the data subject.
Moreover, it argued that the data from the electronic log was sent to it by an unknown person in a sealed envelope.
Holding
First, the DPA noted that the data subject is a public figure, since he is a member of the Parliament and a politician.
Secondly, the DPA underlined how the freedom of the press and, more generally, the freedom of speech and expression have a very important role in a democratic country and are protected by the constitution.
More specifically, the DPA upheld the controller’s argument that it had a legitimate interest in performing this processing activity, given that the purpose was informing the public about the credibility of a political public figure in the context of a public issue.
Thirdly, the DPA analysed if this processing activity was actually necessary to reach this purpose. The DPA held that the recording and publication of the personal data was necessary to inform the public. Moreover, the data subject was not visible in the recordings. Therefore, the DPA was of the view that the necessity requirement was fulfilled.
Fourthly, as for the balancing test, the DPA found that the contested data processing operations did not constitute an unnecessary and disproportionate intrusion into the privacy of the data subject. On this point, the DPA stressed the fact that the data subject is not a normal citizen but a politician. Therefore, he could expect that an element of his private life was questioned by public opinion.
Therefore, it held that the controller had rightly relied on Article 6(1)(f) GDPR for this processing activity.
Fifthly, as for the electronic log data, the DPA found a violation of Article 14 GDPR. Indeed, the controller failed to prove that it had sent the information provided for by this article to the data subject.
Sixthly, the DPA found a violation of Article 13 GDPR since the controller did not provide the data subject with the information provided for by that article in connection with the recording and publication of his house’s images.
On these grounds, the DPA partially upheld the data subject’s complaint and issued a reprimand to the controller.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.
File number: NAIH-5461-2/2024. Subject: decision partially rejecting the application
History: NAIH-7355/2022.
NAIH-6688/2023.
DECISION
The National Data Protection and Freedom of Information Authority (hereinafter: Authority) Tordai
Bence (hereinafter: Applicant) is the dr. János Nagy, lawyer (KASZ: 36065909,
cegkapu#19291671) with Mediaworks Hungary Zrt. (hereinafter: Applicant)
filed against the unlawful handling and disclosure of personal data
in the following data protection official procedure initiated following your request (hereinafter: Request).
makes decisions:
I. The Authority rejects the Applicant's request that the Authority
establish that the Respondent unlawfully handled the Applicant's personal
your data.
II. The Authority rejects the Applicant's request, which is unlawfully submitted by the Respondent
aimed at deleting managed personal data.
III. The Authority rejects the Applicant's request, which was aimed at that
CXII of 2012 on information self-determination and freedom of information.
impose sanctions specified in § 61 of the Act (hereinafter: Infotv.) a
Authority with media organizations violating the general data protection regulation and
possibly against other bodies (building authority).
ARC. The Authority grants the Applicant's request and determines that it is the Respondent
failed to inform the Applicant's stakeholders from the e-log during its data management
with regard to data from the natural persons
on the protection of personal data in terms of processing and that such data is free
(EU) 2016/679 on the flow and repeal of Directive 95/46/EC
Regulation (hereinafter: general data protection regulation), paragraphs (1)-(3) of Article 14.
V. The Authority ex officio establishes that the Respondent during its data management
failed to provide the Applicant with information regarding the photo recordings,
thereby violating Article 13 (1)-(2) of the General Data Protection Regulation.
VI. The IV. and V. as a legal consequence of violations, the Authority is the general
on the basis of Article 58 (2) point b) of the Data Protection Regulation - data subject rights
in view of his disregard - the Applicant is condemned.
There is no place for administrative appeal against this decision, but from the announcement
within 30 days with a claim addressed to the Capital Tribunal in a public administrative case
can be attacked. The letter of claim must be submitted electronically to the Authority, which is the case
1 The NAIH_K01 form is used to initiate an administrative lawsuit: NAIH_K01 form (16.09.2019) The form is the general
can be filled out using a form-filling program (ÁNYK program).
………………………………………………………………………………………………………………………………………… ………….
1055 Budapest Tel.: +36 1 391-1400 naih.hu/adatkezelesi-tajekoztatok
Falk Miksa utca 9-11 KR ID: 429616918 ugyfelszolgalat@naih.huiratai will be forwarded to the court. The request to hold the hearing must be indicated in the claim.
For those who do not benefit from the full personal tax exemption, the administrative court fee
HUF 30,000, the lawsuit is subject to the right to record levies. In the proceedings before the Metropolitan Court, the legal
representation is mandatory.
The Authority publishes its decision with full data content on its website.
JUSTIFICATION
I. Declarations of the parties
(1) On September 9, 2022, the Applicant submitted a request for official data protection procedure
to the Authority, then the Authority NAIH-7355-2/2022. 2022 for gap filling call no.
in his reply sent on November 3, he supplemented the private document with full evidentiary force
with a request sent in the form The Applicant submitted that the Respondent is the general
data protection regulation and Infotv. committed a serious breach as follows:
(2) The data of the e-log was obtained and made public without the consent of the Applicant.
The e-diary is a non-public database containing personal data. Its contents
in some way without the consent of the holder at least to Metropol magazine, but
it is believed to have reached other media outlets as well, and this is a legal authorization or the person concerned
without your consent is illegal (violation of Article 5 of the General Data Protection Regulation).
(3) He did not contribute to the making of the drone footage and the disclosure of their data content.
Their disclosure is not necessarily necessary to present your financial situation, a
this part of his private life is not a public matter. (violation of Article 5)
(4) One of the articles indicated by the Applicant - listed in paragraph (7) of this decision
in the evening, no prior information about data management was provided either. (Breach of Article 14.)
(5) The Applicant explained: he does not dispute the right of the press to inform the public about the
continuously and up-to-date information on public matters of public interest,
at the same time, fraudulently obtaining personal data belonging to your private life
(access to the e-diary, taking drone footage) these frames obviously
exceeds. Satisfying the public's curiosity and need for gossip is not the same as a
with the right to discuss public affairs.
(6) The Applicant requested Infotv. The imposition of sanctions specified in § 61 is the general
with press organizations and possibly other organizations that violate the data protection regulation
(building authority), including a fine and ordering the deletion of data.
(7) The publication of the Applicant's personal data was, among other things, issued by the Applicant
Metropol, Magyar Nemzet, Szegedma., BEOL, Origo, Ripost, 888.hu, Bors, SZOLJON
In the following articles published on internet platforms (hereinafter: Articles), he insulted:
https://metropol.hu/aktualis/150-millios-villat-epitett-engedely-nelkul-a-neves-magyar-baloldali-
politician-752709/#
https://szegedma.hu/2022/07/paraszthaznak-alcazhatta-szazmillios-villajat-tordai-bence
https://magyarnemzet.hu/belfold/2022/07/150-millios-villat-epitett-engedely-nelkul-a-neves-
Hungarian left-wing politician
https://www.origo.hu/itthon/20220712-tordai-bence-menekul-a-kerdesek-elol-miutan-kiderult-
that-I-did-not-have-a-150-million.html
https://www.beol.hu/orszag-vilag/2022/07/150-millios-villat-epitett-engedely-nelkul-az-ismert-
Hungarian left-wing politician
https://ripost.hu/politik/2022/07/engedely-nelkul-epult-az-ismert-baloldali-politikus-150-millios-
Buda villa
2 https://888.hu/kinyilott-a-pitypang/tordai-bence-villasreggeli-a-paraszthazban-4373597/
https://www.origo.hu/itthon/20220714-mibol-epitett-budai-villat-tordai-bence.html
https://magyarnemzet.hu/belfold/2022/07/150-millios-kerdes-mibol-epitett-budai-villat-tordai-
bence
https://magyarnemzet.hu/belfold/2022/07/mar-az-ugyeszseg-elott-tordai-bence-villabotranya
https://www.origo.hu/itthon/20220712-tordai-bence-parbeszed-luxusvilla.html
https://www.origo.hu/itthon/20220715-mar-az-ugyeszseg-elott-tordai-bence-villabotranya.html
https://metropol.hu/aktualis/elhatarodolott-tordai-bencetol-a-ii-keruleti-polgarmester-756349/
https://magyarnemzet.hu/belfold/2022/07/elhatarolodott-tordai-bencetol-a-ii-keruleti-
mayor
https://magyarnemzet.hu/belfold/2022/07/feknyuz-tordai-ismet-kamuzik
https://www.origo.hu/itthon/20220720-tordai-bence-villabotranya.html
https://magyarnemzet.hu/belfold/2022/07/a-kormanyhivatal-mar-vizsgalja-tordai-bence-
lightning scandal
https://www.origo.hu/itthon/20220720-mediaworks-hircentrum-tordai-bence-vllabotrany.html
https://www.beol.hu/orszag-vilag/2022/07/lebontathatjak-tordai-bence-budai-luxusvillajat
https://www.borsonline.hu/aktualis/2022/07/mikor-bontjak-le-tordai-engedely-nelkul-epitett-
his luxury villa
https://www.beol.hu/orszag-vilag/2022/07/itt-az-ujabb-fejlemeny-tordai-villabotranyaban
https://www.origo.hu/itthon/20220722-tordai-bence-ingatlanmutyi.html
https://magyarnemzet.hu/belfold/2022/07/tordai-bence-nyilvanvaloan-hazudik-probalja-
deny-the-permission-nelkuli-epitkezest-video
https://www.szoljon.hu/orszag-vilag/2022/07/tordai-bence-probalja-letagadni-az-engedely-
nelkuli epitkezest
https://magyarnemzet.hu/belfold/2022/07/lebontas-var-tordai-bence-luxushazara
https://www.origo.hu/itthon/20220722-ezert-kell-lebontatni-tordai-bence-hazat.html
https://www.origo.hu/itthon/20220727-jogszabalyok-sorat-szeghette-meg-tordai-bence.html
(8) Based on the Application, Infotv. According to Section 60 (1), data protection on November 3, 2022
an official procedure was initiated. Indicated in the Applicant's request, in paragraph (7) of this decision
regarding the data management of newspaper articles not included in the Authority's additional data protection
conducts official procedures against data controllers other than the Application.
(9) NAIH-7355-5/2022 of the Authority dated November 23, 2022. the facts in order no
in order to clarify, the Applicant invited the Applicant to make a personal statement
the purpose of processing your data, its legal basis according to the General Data Protection Regulation, and
about why the publication of personal data was absolutely necessary for data management
to achieve its goal. The Authority also requested from the Application the general data protection
consideration of interests according to Article 6 (1) point f) of the Decree and provided to the Respondent
sending your information.
(10) According to the Respondent's statement dated December 9, 2022, in the objected articles
data made public by editorial offices as media organizations today is one of the broadest
for forming opinions in public debates of special importance
was used in order to give the public freedom of expression
within the framework, the resulting freedom of the press and the right to information as fundamental rights
properly inform through its practice, thereby contributing to the public debate, its
3 to assess its merits. The subject of the public debate is the Applicant, as an active public politician
illegal construction, which is capable of influencing the Applicant
the social perception of his credibility as a public figure and politician, and with which he passed because of this
during this period, several media outlets were also involved. IX of the Basic Law to the Applicant. Article (1) and (2)
with its paragraphs, as well as on the freedom of the press and the basic rules of media content
CIV of 2010 according to his position supported by § 10 of the Act in the objected articles
no unlawful data processing took place. The Respondent further noted that if a
fundamental rights could be established in relation to objectionable communications (for the protection of personal data
the right to freedom of expression and the right to freedom of the press) conflict,
in his opinion, the Authority does not have the authority to dissolve it.
(11) The Authority NAIH-7355-5/2022. no. despite his request in the order, the Respondent
in his statement, he did not indicate the general data protection as the affected data processing
its legal basis listed in Article 6 of the Decree.
(12) NAIH-6688-1/2023 of the Authority dated July 7, 2023. in order no
requested a statement from the applicant on whether he had completed Article 6 of the General Data Protection Regulation.
consideration of interests according to point f) of paragraph (1) of Article, and whether information was provided by the
Article 13 of the General Data Protection Regulation on the processing of personal data for the applicant
or based on Article 14. The Authority also requested information on how
the Respondent came into possession of the data from the e-diary referred to in the articles.
(13) In his statement dated August 1, 2023, the Respondent stated that from the e-diary
data from Metropol was delivered in a sealed envelope by an unknown person
to its editorial office. Regarding the information provided by the Applicant, he did not give a specific answer, but
explained that the general information available on the data controller's website contains the
information related to data management. It was attached to the Respondent's statement by him
carried out assessment of interests in tabular form (Serial number: [1/12.07.2022]).
(14) According to the interest assessment test sent by the Respondent to the Authority, it is
the purpose of data management is to inform the public in a public debate, the applicant is a public figure
the legal basis for recording and storing your personal data is "legitimate interest", in which case a
corresponds to the following: "press, mass media, media service". The consideration of interests
based on the test, data processing is limited to the Applicant's privacy "to a reasonable extent" and
your right to privacy protection. In support of the finding, the consideration of interests
test does not contain any data or information regarding the Applicant. The
according to the balance of interests test, the Applicant is adversely affected by the lack of data management
would affect it, necessary to achieve its goal, since it would not be able to provide media services without it
to carry out activities, and it is also necessary for the readers' right to information. THE
In its consideration of interests, the respondent states that data processing is a proportionate restriction
means, its goal cannot be achieved by implementing a smaller restriction. Readers are at a disadvantage
due to the lack of data management, and even in the absence of a specific balance of interests, declares
that the data processing does not cause unreasonable damage or inconvenience to the Applicant. The
according to the balance of interests, the data management did not affect the Applicant unexpectedly. THE
as a result of the test, the Respondent found that his own legitimate interest is higher
such as the Applicant's right to privacy and protection of privacy, which he does not understand
disproportionate damage due to data processing. The balance of interests finally records that a
You have requested data management in accordance with the relevant rules and the data subject is required
continues with information.
(15) The Authority dated 14.12.2023. dated NAIH-6688-3/2023. in his order under no
Application, NAIH-6688-4/2023. and the Applicant in order no. that the facts
they can get to know the evidence discovered during its clarification and further motions for proof
they can do. Neither the Respondent nor the Applicant made a motion for proof.
4 II. The facts
(16) In the present case, the Authority is related to the newspaper article published by the Respondent
the legality of data management, as well as whether the Respondent complied with the preliminary requirements
obligation to provide information.
(17) The Authority is the available evidence, officially known and public knowledge facts
based on the following facts:
(18) The Applicant is a politician, a parliamentary representative of the Párbészéd – Greens political party,
co-chairman, so he is clearly a public figure.
(19) In 2021, the Applicant addressed a question requiring a written answer to Dr. István Nagy,
to the Minister of Agriculture "When will the garage of the nature-damaging Csipak villa be demolished?" titled,
then submitted a public interest data request for a decision ordering the demolition of the building
regarding getting to know him. These were also reported by several news portals (for example:
https://hvg.hu/ingatlan/20210519_csipak_villa_harmashatar_hegy_bontas).
(20) On March 30, 2022, the Applicant's Facebook page
(https://www.facebook.com/TordaiBenceParbeszed/posts/pfbid02yQMGr3VEXmPkt9agkrZEv
xCKBXTUVyuAfqidpAbJFXX6bM5q7b7vPucb3zbafX4RlFacebook) announced that
files a complaint for abuse of office, as "it is still the Government Office's fault
illegal, nature-destroying Csipak Villa", despite the fact that the demolition of the building was ordered.
The Applicant states in the same place: "We will no longer tolerate that the Fidesz privileged people are the law
stand above them, and we will not tolerate that pro-state bureaucrats like Sára Botond
they use their official power to scuttle the illegal affairs of other Fidesz criminals!", "The
There is no place in Parliament for someone who disregards both the rule of law and natural resources
for politicians!". Several news portals reported on the Applicant's Facebook post
(https://24.hu/belfold/2022/03/30/csipak-villa-tordai-jambor-sara-botond-bontas-
kormanyhivatal-feljelentes/#, https://ezalenyeg.hu/helyben/tordai-benceek-feljelentest-
they-make-rogan-friends-because-of-their-villa_003-223490).
(21) Metropol, Magyar Nemzet, szegedma.hu, BEOL, Origo, Ripost published by the Applicant,
A total of 27 articles on 888.hu, Bors, SZOLJON internet interfaces (hereinafter: Articles)
was published with similar content regarding the Applicant on 12.07.2022. and 27.07.2022.
between. The Articles referred to the Metropol for the published photos and the electronic construction log
as a source of data.
(22) The content of the Articles can be summarized as that the Applicant without a building permit,
he built his family home in an illegal manner. According to the Articles, the Applicant's plot has an old one
farmhouse, and the Applicant "hiding" behind it started to evade the building regulations, as
because of the strict regulations on the land, he could not get a construction permit for a new building. The Articles
explain that the Applicant completely demolished the old farmhouse and replaced it with a new house
built. The Applicant provides several photos in the Articles to support this statement
of his house in its current state, as well as of the referenced farmhouse, the two states
for the purpose of comparison (captions, for example: "the original farmhouse was like this", "that
instead of a permitted renovation, it became this").
(23) The Articles also report that Metropol obtained the mandatory e-
diary, from which, according to the Articles, it appears that the old house was completely demolished and a new one
brand new foundations were dug for the house with a machine. According to the Articles, the e-diary also contains that
"complete demolition and mechanical foundation excavation" took place. According to the Articles, it gives a special light to the unlicensed
construction, that it is the Applicant who has been attacking the loudest for a long time
also the II. a real estate investor building illegally in the district, he even filed a complaint
case.
(24) The source of the e-log is unknown, the Authority - the official data protection procedure
taking into account his device system - he could not determine.
5(25) The Articles contain the following personal data: about the Applicant's residential property
(family house and garden) photos - which do not capture human activity -; the
a photo taken previously of the farmhouse on the lot; for the construction of the Applicant's residential property
relevant e-log entries: "complete demolition and mechanical foundation excavation", "included in the plans
no existing, remaining walls can be found, instead there was a completely new frame ceramic
carried out". The Articles identify the Applicant as the owner of the property to which the e-
diary data apply and from which the photos were taken.
(26) The Authority states that on the Applicant's website https://mediaworks.hu/wp-
content/uploads/2022/09/4534531Mediaworks data privacy policy20221001.pdf
can be found in the "Data protection" referred to in the Applicant's statement
information" (hereinafter: Information) document. Point 4.b) of the document
The Applicant details the contents of the online interface under the heading "Editorial contents".
the personal data of the persons involved for the purpose of informing the public, legitimate interest
details of its treatment based on Section 9 of the Information Sheet contains the rights of the data subject a
regarding the management of your personal data. 9.1. according to point the person concerned at any time a
you can request information about the data management concerning you at the contact details indicated in the information, and
you can request the correction, deletion or restriction of the processing of your data, and
you can object to the processing of personal data. Handled in editorial content is personal
the rules on prior information of data subjects are not included in
Informational.
(27) Metropol, Magyar Nemzet, szegedma.hu, BEOL, Origo, Ripost, 888.hu, Bors
and the SZOLJON internet interfaces are owned by the Applicant.
III. Applicable legal provisions
(28) Basic Law of Hungary (hereinafter: Basic Law) VI. according to paragraph (3) of Article
everyone has the right to protect their personal data, as well as data of public interest
for learning and dissemination.
(29) Article IX of the Basic Law. based on paragraphs (1) and (4) of Article, everyone has the right to
to freedom of expression. The exercise of freedom of expression
it cannot be aimed at violating the human dignity of others.
(30) Article IX of the Basic Law. According to Article (2), Hungary is recognized and protected by the press
freedom and diversity, ensures the development of democratic public opinion
necessary conditions for free information.
(31) On the protection of natural persons with regard to the management of personal data
and on the free flow of such data, as well as outside the scope of Directive 95/46/EC
Regulation (EU) 2016/679 (hereinafter: General Data Protection Regulation)
Based on Article 2 (1), the General Data Protection Regulation shall apply to personal
for the processing of data in a partially or fully automated manner, as well as those
for the processing of personal data in a non-automated manner, which
are part of a registration system or which become part of a registration system
they want to do.
(32) Pursuant to Article 4, Point 1 of the General Data Protection Regulation, "personal data": identified or
any information relating to an identifiable natural person ("data subject"); can be identified
the natural person who, directly or indirectly, in particular
identifier such as name, number, location data, online identifier or natural
person's physical, physiological, genetic, intellectual, economic, cultural or social
can be identified based on one or more factors relating to its identity.
(33) Based on Article 4, Point 2 of the General Data Protection Regulation, "data management": personal
any automated or non-automated processing of data or data files
operation or a set of operations, such as collection, recording, organization, segmentation, storage,
6 transformation or change, query, insight, use, transmission of information,
by means of distribution or other means of making available, coordination or
connection, restriction, deletion or destruction.
(34) Based on Article 4, point 7 of the General Data Protection Regulation: "data controller": the natural
or legal person, public authority, agency or any other body that a
the purposes and means of processing personal data independently or together with others
defines; if the purposes and means of data management are determined by EU or member state law
and, the data manager or the special aspects regarding the designation of the data manager
can also be determined by EU or member state law.
(35) Based on Article 5 (1) point b) of the General Data Protection Regulation, personal data only
it can be collected for a specific, clear and legitimate purpose and not in conflict with these purposes
cannot be handled in an agreeable manner ("target limitation"), based on point c) of the personal
data must be appropriate and relevant for the purposes of data management,
and they must be limited to what is necessary ("data sparing").
(36) Pursuant to Article 5 (2) of the General Data Protection Regulation, the data controller is responsible
for compliance with paragraph (1) and must also be able to prove this compliance
("accountability").
(37) Based on Article 6 (1) of the General Data Protection Regulation, personal data only
can be handled legally if and to the extent that at least one of the following is met:
a) the data subject has given his consent to the processing of his personal data for one or more specific purposes
for its treatment;
f) data management to enforce the legitimate interests of the data controller or a third party
necessary, unless the interests of the person concerned take precedence over these interests
interests or fundamental rights and freedoms that make personal data protection
necessary, especially if a child is involved.
(38) Pursuant to Article 14 (2) of the General Data Protection Regulation, the data controller is the data subject
fair and transparent data management for the data subject
additional information necessary to provide:
b.) if the data management is based on point f) of paragraph (1) of Article 6, you are the data controller
about the legitimate interests of third parties;
(39) According to Article 15 (1) of the General Data Protection Regulation, the data subject is entitled to
receive feedback from the data controller regarding the handling of your personal data
is ongoing, and if such data management is ongoing, you are entitled to have your personal
data and get access to the following information:
a) the purposes of data management;
b) categories of personal data concerned;
c) recipients or categories of recipients with whom or with which the personal
data has been disclosed or will be disclosed, including in particular that of a third country
recipients and international organizations;
d) where appropriate, the planned period of storage of personal data, or if this is not the case
possible aspects of determining this period;
e) the right of the data subject to request from the data controller the personal data relating to him
rectification, deletion or restriction of processing of data, and can object to such
against the processing of personal data;
f) the right to submit a complaint addressed to a supervisory authority;
g) if the data were not collected from the data subject, everything about their source is available
information;
7 h) the fact of automated decision-making referred to in paragraphs (1) and (4) of Article 22, including
also profiling, and at least in these cases to the applied logic and that
comprehensible information about the significance of such data management and that
what are the expected consequences for the person concerned.
(40) Pursuant to Article 17(1) of the General Data Protection Regulation, the data subject is entitled to
that, upon request, the data controller deletes the personal data relating to him without undue delay
data, and the data controller is obliged to provide the personal data concerning the data subject
delete it without undue delay if any of the following reasons apply:
a) the personal data are no longer needed for the purpose for which they were collected or
treated differently;
b) the data subject revokes Article 6 (1) point a) or Article 9 (2)
pursuant to point a) of paragraph
there is no other legal basis for data processing;
c) the data subject objects to the processing of his data on the basis of paragraph (1) of Article 21, and there is no
overriding legitimate reason for data processing, or the data subject is subject to Article 21 (2)
objects to data processing based on paragraph;
d) personal data were handled unlawfully;
e) the personal data is prescribed by EU or Member State law applicable to the data controller
must be deleted to fulfill a legal obligation;
f) for the collection of personal data referred to in paragraph 1 of Article 8, informational
it took place in connection with the offering of services related to society.
(41) Pursuant to Article 17 (2) of the General Data Protection Regulation, if the data controller
disclosed the personal data and is obliged to delete it pursuant to paragraph (1),
it will, taking into account the available technology and the costs of implementation
reasonably expected steps - including technical measures - in order to
inform the data controllers handling the data that the data subject has requested from them orally
links to circulating personal data or a copy of this personal data, or
deletion of its duplicate.
(42) Based on Article 17 (3) of the General Data Protection Regulation, paragraphs (1) and (2) are not
applies if data management is necessary:
a) for the purpose of exercising the right to freedom of expression and information;
(43) Based on Article 21 (1) of the General Data Protection Regulation, the data subject is entitled to
to object to the processing of your personal data at any time for reasons related to your own situation 6.
against treatment based on point e) or f) of paragraph (1) of Article, including the mentioned
provision-based profiling as well. In this case, the data controller is the personal one
data may not be processed further, unless the data controller proves that the data management
it is justified by compelling legitimate reasons that take precedence over the person concerned
against your interests, rights and freedoms, or which are legal claims
are related to its presentation, validation or protection.
(44) Pursuant to Article 77 (1) of the General Data Protection Regulation, other public administrative
or without prejudice to judicial remedies, all interested parties are entitled to file a complaint
with a supervisory authority - in particular your usual place of residence, place of work or
in the Member State where the alleged infringement took place - if, according to the judgment of the data subject, the
the handling of relevant personal data violates this regulation.
(45) Pursuant to Article 85 (1) of the General Data Protection Regulation, Member States
the right to the protection of personal data according to this regulation is harmonized in law
with the right to freedom of expression and information, including personal
data for journalistic purposes or for scientific, artistic or literary expression
treatment as well.
8(46) According to Article 85 (2) of the General Data Protection Regulation, personal data
graduated for journalistic purposes or for the purpose of scientific, artistic or literary expression
regarding treatment, the member states define exceptions or deviations in II.
chapter (principles), III. chapter (rights of the data subject), IV. chapter (the data manager and
data processor), Chapter V (the transfer of personal data to third countries or international
transmission to organizations), the VI. chapter (independent supervisory authorities), VII.
chapter (cooperation and uniformity) and IX. from chapter (special cases of data management),
if these exceptions or deviations are necessary to protect personal data
the right to freedom of expression and information can be negotiated
by right.
(47) According to preamble paragraph (65) of the General Data Protection Regulation, “[…] the personal
the further retention of data can be considered legal if the expression of opinion and
exercising the right to freedom of information is a legal obligation
compliance, or the execution of a task carried out in the public interest or entrusted to the data controller
due to the exercise of a public authority, or in the public interest affecting the field of public health,
for the purpose of archiving in the public interest, for scientific and historical research purposes or for statistical purposes
purpose, or necessary for the presentation, enforcement or defense of legal claims."
(48) Pursuant to preamble paragraph (69) of the General Data Protection Regulation "[B]any affected
the right to have the data relating to their unique situation must also be ensured
object to its processing if the personal data can be processed legally, because it is
for data management in the public interest or the exercise of a public authority granted to the data controller
to perform a task within the framework of, or the data controller or a third party is entitled
it is necessary based on your interests. The data controller proves that you are with the interests of the data subject
against his fundamental rights and freedoms, his compelling legitimate interest
takes priority."
(49) Based on preamble paragraph (153) of the General Data Protection Regulation, "[a] Member States
the right to express an opinion and information must be reconciled - including that
concerning freedom of journalistic, scientific, artistic and literary expression
rules with the right to protect personal data according to this regulation. appropriate,
that the exclusively personal data is journalistic, scientific, artistic or that
its treatment for the purpose of literary expression should be subject to a deviation or be exempted from e
from the requirements contained in certain provisions of the decree, if this is necessary to
the right to the protection of personal data to the freedom of expression and
be reconciled with the right to information provided by Article 11 of the Charter. This
applies in particular to personal data in the audiovisual field, as well as
for handling in news archives and press libraries. Consequently, Member States
are determined by adopting legislative measures between these fundamental rights
the necessary exceptions and deviations for the sake of balance. Member States have exceptions and
deviations are accepted by the general principles, the rights of the data subject, the data manager and data processor,
transfer of personal data to third countries or international organizations
forwarding, independent supervisory authorities, cooperation and uniform
application and in terms of individual data management situations. If you are the exceptions
deviations differ between Member States, the applicable Member State law must apply to the data controller
apply. The right to freedom of expression is all democratic
in order to take into account its importance in society to this freedom
concepts such as journalism must be interpreted broadly."
(50) CXII of 2011 on the right to information self-determination and freedom of information.
Act (hereinafter: Infotv.) § 3. 5. data of public interest: state or local government
task, as well as a body performing other public tasks defined by law
in the management of a person and related to his activity or by the performance of his public duty
arising in connection with, not covered by the concept of personal data, in any way
information or knowledge recorded in the form, regardless of the way it is handled, you are independent
from its collective nature, so in particular the authority, competence, organizational structure,
9 professional activities, including evaluation of their effectiveness, owned
types of data and the legislation governing the operation, as well as management, a
data on concluded contracts.
(51) Infotv. § 3. 6. public data in the public interest: not covered by the concept of public interest data
all data whose disclosure or accessibility you are
making it accessible is ordered by law in the public interest.
(52) Infotv. Pursuant to § 26, paragraph (2), data that is public in the public interest is that which fulfills a public duty
the name of the person acting in the body's duties and powers, duties, duties, managers
mandate, other personal data related to the performance of the public task, as well as those a
personal data, the disclosure of which is required by law. Public in the public interest
personal data may be disseminated in compliance with the principle of purpose-bound data management.
(53) Infotv. Pursuant to § 38, paragraph (2), the Authority is responsible for personal data
for its protection, as well as for getting to know data of public interest and public interest
monitoring and facilitating the enforcement of the right, as well as personal data in the European Union
facilitating its free flow within. The tasks and powers of the Authority are general
Article 57 (1), Article 58 (1)-(3) of the Data Protection Regulation and Infotv. Section 38
It is defined in detail in paragraphs (2)-(4).
(54) CIV of 2010 on freedom of the press and basic rules of media content. law (a
hereinafter: Smtv.) According to Section 4 (1), Hungary recognizes and protects the press
freedom and diversity.
(55) Smtv. Section 4 (2) Freedom of the press extends from the state, as well as from any organization and
independence from interest groups.
(56) Smtv. § 4 (3) The exercise of freedom of the press may not constitute a crime or
call to commit a crime, may not violate public morals, and may not
violating the privacy rights of others.
(57) Smtv. § 6 (1) The media content service provider, as well as your employment relationship with him
persons in other legal relationships for employment are defined by law
is entitled to in connection with media content service activities
the identity of the person providing the information (hereinafter: information source) is judicial and official
to keep confidential during procedures, and to identify any source of information
to refuse the handover of potentially suitable documents, documents, objects or data carriers.
(58) Smtv. § 7 (1) The employee of the media content provider, or the media content provider
A person in another legal relationship to work with a service provider is entitled to a
from the owner of the media content provider, as well as the supporter of the media content provider,
or a natural or legal person placing a commercial notice in the media content
aimed at professional independence from the person and influencing media content
for protection against owner or supporter pressure (editorial and journalistic
freedom).
(59) Smtv. § 10. Everyone has the right to be properly informed by local and national authorities
and the affairs of European public life, as well as citizens of Hungary and members of the Hungarian nation
about events of importance to him. The task of the media system as a whole is to provide authentic,
quick, accurate information about these matters and events.
(60) Smtv. § 13 The linear media services performing information activities are obliged to a
local, national, national and European of public interest, as well as Hungary
about events of importance to its citizens and members of the Hungarian nation, is controversial
about issues in the informative and news programs they publish
to inform in a balanced way. The detailed rules of this obligation are laid down in the proportionality law
and establishes it in accordance with the requirements of ensuring democratic public opinion.
10(61) Smtv. § 21. (1) The media content service provider independently decides within the framework of the legislation a
on the publication of media content and is responsible for complying with the provisions of this law.
(62) Act V of 2013 on the Civil Code (hereinafter: Civil Code) 2:42. §
(1) Everyone has the right to, within the limits of the law and the rights of others
personality, so especially private and family life, home, relationships with others -
in any way or by any means - in respect of contact and reputation
to exercise his right to keep freely, and that no one prevents him from doing so.
(63) Civil Code 2:42 (2) Everyone is obliged to respect human dignity and the personal rights arising from it
to respect. Personal rights are protected by this law.
(64) Civil Code 2:42 (3) Behavior to which the data subject has consented does not violate privacy rights.
(65) Civil Code 2:43 a.m. § It means a violation of personal rights in particular
a) violation of life, physical integrity and health;
b) violation of personal freedom, privacy, private residence;
c) discrimination against the person;
d) violation of honor and reputation;
e) violation of the right to privacy and protection of personal data;
f) violation of the right to use one's name;
g) violation of the right to image and sound recording.
(66) Civil Code 2:44 a.m. §(1) The exercise of fundamental rights that ensure the free discussion of public affairs is a public actor
protection of personal rights to a necessary and proportionate extent, human dignity
you can limit without prejudice; however, it should not affect your private and family life as well
to the detriment of his home.
(67) Civil Code 2:44 (2) A public figure with a communication outside the scope of free discussion of public affairs
or behavior is entitled to the same protection as a non-public actor.
(68) Civil Code 2:44 (3) The private or family life of a public figure is not considered a public matter
related activity or data.
(69) Civil Code 2:45 a.m. § (1) Violation of honor means, in particular, another person's social honor
able to adversely influence his judgement, and is unreasonably hurtful in its expression
expression of opinion.
(70) Civil Code 2:45 (2) Means damage to reputation, especially if it concerns another person and
asserts or makes rumors about an untrue fact that offends this person, or misrepresents a real fact.
(71) For data management under the scope of the General Data Protection Regulation, Infotv. Section 2 (2)
according to paragraph of the general data protection regulation in the provisions indicated there
must be used with specific additions.
(72) Infotv. The right to the protection of personal data pursuant to Section 60 (1) and (2).
in order to enforce it, the Authority is a data protection authority at the request of the data subject
initiates a procedure and may initiate a data protection official procedure ex officio. The data protection authority
request to initiate a procedure Article 77 (1) of the General Data Protection Regulation
can be submitted in the case specified in paragraph b) of § 22.
(73) Infotv. According to § 60, subsection (5), in the case specified in subsection (2), the application is
includes beyond what is specified in the Act on General Administrative Procedures
a) indication of the alleged infringement,
b) a description of the specific behavior or state that caused the alleged violation,
c) to identify the data manager or data processor who committed the alleged violation
11 necessary data available to the applicant,
d) the facts supporting the allegations related to the presumed violation of law and those
evidence, furthermore
e) a definite request for a decision to remedy the indicated infringement.
(74) Infotv. Pursuant to § 61, paragraph (1), point a), it was made in the official data protection procedure
in its decision, the Authority issued Infotv. data management defined in paragraph (2) of § 2
in connection with operations, Article 58 (2) of the General Data Protection Regulation
can apply legal consequences according to Accordingly, within the corrective powers of the Authority
acting as:
a) warns the data controller or the data processor that some planned data processing
its activities are likely to violate the provisions of this regulation;
b) condemns the data manager or the data processor if its data management activities
violated the provisions of this regulation;
c) instructs the data manager or the data processor to comply with this regulation for the data subject
your request regarding the exercise of your rights under;
d) instructs the data manager or the data processor that its data management operations - given
in a specified manner and within a specified period of time - harmonize e
with the provisions of the decree;
e) instructs the data controller to inform the data subject about the data protection incident;
f) temporarily or permanently restricts data management, including data management
also its prohibition;
g) in accordance with the provisions of Articles 16, 17 and 18, orders personal data
rectification or deletion, or restriction of data processing, as well as Article 17 (2)
in accordance with paragraph and Article 19, the addressees are ordered to do so
notification to whom or to whom the personal data was disclosed;
h) revokes the certificate or instructs the certification body to comply with Articles 42 and 43
to withdraw a duly issued certificate, or instructs the certification body,
not to issue the certificate if the conditions for the certification are not or are no longer met;
i) imposes an administrative fine in accordance with Article 83, depending on the circumstances of the given case
depending, in addition to or instead of the measures mentioned in this paragraph; and
j) orders directed to a recipient in a third country or an international organization
suspension of data flow.
(75) Infotv. Pursuant to Section 61 (6), the decision is open to challenge
until the expiry of the deadline for filing an action, or in the event of an administrative lawsuit, the court is final
the data affected by the disputed data processing cannot or cannot be deleted until the decision is taken
can be destroyed.
(76) Infotv. 75/A. pursuant to § 83 (2)-(6) of the General Data Protection Regulation, the Authority
exercises its powers in accordance with the principle of proportionality,
especially with the fact that you are in the legislation regarding the handling of personal data
The regulations defined in the mandatory legal act of the European Union are being implemented for the first time
in case of violation, to remedy the violation with Article 58 of the General Data Protection Regulation
in accordance with - takes action primarily with the warning of the data manager or data processor.
(77) In the absence of a different provision of the General Data Protection Regulation, the application was initiated
for official data protection procedure, Art. provisions shall be applied in Infotv
with certain deviations.
12(78) of the Acr. Based on Section 35 (1), the request is a declaration by the client with which the official
requests the conduct of a procedure or a decision of the authority for his right or legitimate interest
in order to validate it.
(79) Acr. According to § 51 (1) point b, if the authority exceeds the administrative deadline, the procedure
of the fee payable for its execution or administrative according to the Act on Fees
administrative fees paid for official procedures or for the use of administrative services
an amount corresponding to the service fee, failing which ten thousand forints shall be paid by a
to the requesting client, who is also exempt from paying the procedural costs.
(80) Pursuant to Article 83 (7) of the General Data Protection Regulation, the supervisory authorities 58.
without prejudice to its corrective powers under Article (2), each Member State
may establish the rules regarding the fact that a public authority based in a given member state
or whether an administrative fine can be imposed against another body performing public duties, and if
yes, to what extent.
(81) LIII of 2018 on the protection of privacy. preamble of the Act (hereinafter: Mtv.):
The right to privacy belongs to every person, and that also during the free discussion of public affairs
must be respected, in view of this, the free discussion of public affairs cannot be allowed
private and family life, as well as harming the home. In accordance with the Basic Law a
a public figure is also entitled to the protection of his privacy and the peace of his home. The law
states that a public figure is tolerated only in connection with his public activities
obliged.
(82) Mtv. § 1. Everyone has the right to have their private and family life, home,
their contact (hereafter collectively: the right to privacy) should be respected.
(3) The essence of the right to privacy is that it - with exceptions defined in a separate law
– against the will of the individual, others may not hurt him.
(83) Mtv. Section 7 (1) Everyone has the right to have their private life protected and
reveal it to others only of your own free will or in cases specified by law.
(2) The public figure's private and family life, as well as his home, are not to the public figure
is entitled to the same protection as a qualifying person.
(84) Mtv. Section 8 (1) Purpose of the right to respect for private life, especially for naming
right, personal data, privacy, image and voice recording, honor and good
reputation protection.
(2) It may represent a violation of the right to respect for private life by the individual
in particular with personal data, secrets that you want to keep in relation to your private life,
misuse of images, audio recordings, or damage to honor and reputation.
(85) Mtv. Section 10 (1) The state provides legal protection for the tranquility of the home. The tranquility of home
ensures the development of private and family life, and the private sphere is free and complete
livelihood. In order to respect this, everyone's home as
the arena of his private life and family life deserves increased protection. (2) The home
unauthorized access to the home of others is a violation of the right to respect
trespassing, or other unauthorized intervention in an insulting, disturbing or harassing manner.
ARC. Decision of the Authority
IV.1. The person of the data controller
(86) The Respondent's quality as a data controller is based on the following facts:
- at the initiation of the procedure, the Internet user indicated in paragraph (7) of this decision
in the imprint of press products (hereinafter: Press products) the Applicant
has been listed as a publisher,
- the data protection information found on the website of Press products, effective at the time of initiation of the procedure
13 in information sheets in the case of data management associated with the use of websites
data manager is the Requested, 2
- in the online register of the National Media and Communications Authority
The applicant is listed as the publisher of the Press Products.
(87) The publication of Articles infringed by the Applicant is in accordance with Article 2 of the General Data Protection Regulation.
is subject to the general data protection regulation based on paragraph (1) of Article
consequently, the rules of the general data protection regulation apply to this data management
are applicable.
(88) Pursuant to the above, the Applicant, such as Metropol, Magyar Nemzet, szegedma.hu, BEOL,
Origo, Ripost, 888.hu, Bors, publisher of SZOLJON online press products, the objectionable data management
is considered a data controller.
IV.2. The person of the Applicant
(89) In the matter of public affairs-public actor, the recent practice of the Constitutional Court and its
court case law formed as a result resulted in important resolutions which
rather, they strengthen the interpretation according to which the case affected by the statement of opinion
The nature of "public matter" is the primary aspect of the reduced scope of personal protection
when establishing.
(90) The data protection commissioner's previous, 26/K/1999. according to resolution no. personal data
the degree of limitation of the right to its protection is what distinguishes the public figure
from the "civilian" who does not take a public role. In the same resolution of the Data Protection Commissioner
explained that "[...] this circle necessarily includes all persons who exercise public authority
practices and who decides on the use of public funds. It is also clear that it is not homogeneous here
it is a personal circle. There are also no precise limits laid down in legislation
to establish that the persons performing a public duty or undertaking a public role
which data they are obliged to tolerate being made public, and where does it start with the public
their private lives are closed off. It is possible and necessary to decide this on a case-by-case basis."
(91) VI of the Basic Law. (1) ensures compliance with the new challenges of digital life,
as well as the provisions of Article 7 of the Charter of Fundamental Rights, when it places the
private sphere and at the same time, it regulates private sphere rights and others at the constitutional level
the collision of fundamental rights (such as freedom of expression).A
enhanced protection of prominent elements of private sector rights in the Basic Law on the expression of opinion
he names the external limits of his freedom, which are private and family life, as well as the home
right to respect.
(92) The Authority - the European Court of Human Rights (hereinafter: ECtHR) and the
With regard to the jurisprudence of the Constitutional Court - he emphasizes that with public affairs
communications made in connection with a wider range of freedom of expression.
(93) The Constitutional Court 7/2014. (III. 17.) Based on what was explained in the decision of AB, from that a
from the point of view of whether someone is classified as a public figure, it is not primarily the person
status must be examined, but whether the given person is in some way a matter of public interest,
whether it can be linked to a public issue, after the expression of a political opinion
its focus is primarily on the cases themselves and not on the persons involved. {7/2014.
(III. 17.) AB [46] – [50], [57]}
2 Press products (nmhh.hu) (query date: November 14, 2023)
14 IV.3. Scope of processed personal data
(94) When evaluating the definition of personal data, the following conceptual elements must be considered
examine:
- form and content criteria of the data ("any information");
- the identified or identifiable natural person ("data subject");
- the relationship between the data and the data subject ("relevant").
(95) In general, all information that relates to the individual,
affects or can affect the situation of the individual in some way. The information is therefore
since it affects the situation of the individual, it is considered personal data. Regarding the data subject
data includes, in particular, the name and identification number of the data subject, one or more physical,
knowledge specific to your physiological, mental, economic, cultural or social identity,
as well as his image, voice and physical characteristics suitable for identifying the data subject. THE
personal data also includes personal and family life of the individual, i.e
so-called data belonging to the world of "privacy", but the workplace, economic or social
facts or value judgments affecting its activities.
(96) The data subject may be any specified natural person whose personal data
identified or - directly or indirectly - identifiable. The data subject
in relation to the natural person status and the identifiability to be examined. One
it must be taken into account when examining the nature of information as personal data
on the issue of identifiability, i.e. whether the individual can be identified by given information
based on If yes, the information is clearly considered personal data.
(97) The essential element of the concept of personal data is the connection between the information and the data subject.
The information must be related to the data subject and must be personal data
it remains as long as the relationship of the information with the data subject can be restored.
(98) In the Applicant's Application, the data of the e-diary relating to the construction of his family house, as well as
criticizes Cickek's publication of photos of his family home. These data are not a
They are about the applicant, the information carried by the data concerns objects, but at the same time the
They relate to the applicant and are therefore considered his personal data.
(99) The working group under Article 29, Regulation No. 4/2007 on the concept of personal data
according to his opinion (WP 136), a piece of data can be considered "relating" to an individual if
if its use is likely to affect the rights and interests of the given person,
taking into account all the circumstances surrounding the given case.
(100) The data cited by the Articles of the e-diary, as well as the Applicant's family home and
The Applicant uses the photos taken of the previous house on the Applicant's property
their rights and interests are likely to be affected, their situation is influenced, they affect the
their situation and the perception of the electorate are likely to be affected. This
is also supported by the fact that, according to the article of the Magyar Nemzet published on 07.05.2022, the
in connection with construction, a complaint was filed after the publication of the Articles: "The Central
Budapest Regional Investigative Prosecutor's Office subordinate to the Prosecutor General's Office
investigates the report related to the Bence Tordai villa scandal, Mediaworks informed
His news center is Péter Szabadi. The deputy spokesperson of the KNYF added: the complaint is being assessed
still in progress. In the Tordai case, István Tényi, famous for his reports, appealed to the
to the authorities, and in his complaint he cited the Metropol article from a few days ago."
IV.4. The legality of the affected data management
(101) In the present case, the Authority is related to the Articles made public by the Respondent
the legality of data management, as well as whether the Respondent complied with the preliminary requirements
obligation to provide information.
15 IV.4.1. Legal basis for recording and publishing personal data
(102) The general data protection regulation defines in points a)-f) of Article 6 (1) that
which legal bases can be used in the case of processing personal data.
(103) According to the Authority's consistent position, related to journalistic activity
the legal basis for data management - if it is not about voluntary consent - is the general one
legitimate interest according to Article 6 (1) point f) of the Data Protection Regulation. The legal basis
official practice in addition to the application of Kfv. 37.978/2021/10. also in judgment no
confirmed. Smtv. § 10 establishes the public's right to information, i.e
on matters of local, national and European public life, as well as the citizens of Hungary and the
about events of importance to members of the Hungarian nation
their right to information, states that the press is responsible for these matters and
authentic, fast and accurate information about events. In this regard, the court referred to
explained in his judgment: the Smtv. this provision does not require the performance of a task of public interest
for a press organization, so the journalistic activity it carries out cannot be of public interest either
as a task, nor as a public task in the terminology of Hungarian national law. The court
he also pointed out that journalistic activity is linked in the Basic Law
to specific information and to the fundamental right to information. These provisions
according to the press, it is the duty of the press to ensure the basic constitutional rights protected in the Basic Law
is necessary and needs protection, therefore the data management is necessary for the performance of this task
it is essential for the press to be able to fulfill its task set out in the Smtv.
(104) According to Article 6 (1) point f) of the General Data Protection Regulation, it is legal
data management, if it is to enforce the legitimate interests of the data controller or a third party
necessary, unless the interests of the person concerned take precedence over these interests
interests or fundamental rights and freedoms that make personal data protection
necessary.
(105) The Authority first examined whether it was the Respondent or a third party
whether you have a legitimate interest in data management. The 7/2014. (III.7.) AB decision [39], [40], [42] and [48]
paragraphs is supported by the following essential findings to the Respondent and a
the legitimate interest of third parties in data management.
(106) The right to free expression occupies a special place in the fundamental rights of the Basic Law
in order. On the one hand, individual autonomy is indispensable for the possibility of free speech
for its fulfillment, since the development of the personality is completely unimaginable
without anyone being able to communicate their views to others freely and without restrictions on content,
his thoughts. The free self-expression of free persons is constitutional based on the Basic Law
one of the essential elements and meaning of order. On the other hand, freedom of speech is democratic and plural
foundation of society and public opinion. Freedom of social and political debates and
without its diversity, there is no democratic public opinion, no democratic rule of law.
(107) Freedom of the press - which encompasses the freedom of all types of media - is freedom of speech
institution. Namely, the increasingly complex and diversified nature of the press's activities
in addition to - above all, the expression of opinions, the formation of opinions and
it is a tool for obtaining information that is essential for forming an opinion. Freedom of speech
its privileged nature also applies to the freedom of the press in this regard, and is subject to the
double verification of freedom: the importance of freedom of the press is determined by the subjective fundamental right and the
the constitutional institution of democratic public opinion also confirms it.
(108) The privileged role of freedom of speech means that, on the one hand, it must only be exceptionally
allow against other rights and constitutional values brought up for its limitation,
on the other hand, laws restricting free expression must be interpreted restrictively.
(109) Speech concerning public figures is central to the expression of political opinion
component. They are an essential part of the discussion of public affairs for the shapers of public affairs
manifestations affecting his activities, views and credibility. The social and political debates
in a significant part, they consist precisely of the fact that the actors of public life, and in the public debate -
16 typically through the press - participants share each other's ideas, political achievements and
in connection with that, they also criticize each other's personality. And for the press, it is constitutional
its mission is to check the practitioners of public authority, which is an integral part of the
presentation of the activities of persons and institutions involved in shaping public affairs
and his - even extremely sharp - criticism. Despite the fact that the public
the focus of the expression of opinion is on the public affairs themselves - not on the public figures, a
necessarily, the majority of manifestations affecting the personality of the shapers of public affairs
and inevitably falls under the protection of political expression. Public affairs
the outstanding constitutional significance of its debate is therefore associated with the fact that the actors in public life
narrower restrictions on freedom of speech and the press are responsible for the protection of his personality
only the requirements derivable from the Basic Law. It is particularly important constitutional
it is in the interest of citizens and the press to buy without uncertainty, compromise and fear
participate in social and political debates. It would work against this if the speakers had a public life
in view of the privacy protection of the actors, they should be widely held liable
by trait.
(110) The Authority established in paragraph (18) of this decision that the Applicant
as a member of parliament and co-chairman of a political party, he is clearly a public figure.
It can also be stated that the Articles report on a public matter, a public matter at that
the credibility of the actor - the Applicant - is examined: does the Applicant have a moral basis other than
to criticize public figures for their illegal activities, or their own alleged
his illegal behavior - according to the Articles, his illegal construction - excludes this. THE
public debate was initiated by the Applicant, including on the Facebook page March 2022
published on the 30th with the following statements: "it is still the Government Office's fault
illegal, nature-destroying Csipak villa", "We will no longer tolerate the Fidesz privileged
should be above the law, and we will not tolerate pro-state bureaucrats like Sára Botond
they use their official power to scuttle the illegal affairs of other Fidesz criminals!",
"There is no place in the National Assembly to ignore both the rule of law and natural resources
for politicians!"
(111) The Respondent fulfills its and its readers' legitimate interest in data management with the following
substantiated: the data made public in the objected articles by the editors,
as media organs, it is one of the most widely-interested and prominent subjects of our time
was used to form opinions in his public debate in order to public opinion
within the framework of freedom of expression, the resulting freedom of the press and
properly informed through the exercise of the right to information as a fundamental right,
thereby contributing to the public debate and its merits. The subject of the public debate is a
The applicant, as an active public figure, is a politician in violation of the law, which is suitable for
to influence the public perception of the Applicant's credibility as a public figure and politician,
and which, for this reason, has been covered by several media outlets in the past period.
(112) Given that the purpose of the Respondent's data management is to inform the public
concerning the credibility of a political figure in public life, especially with such a public matter
in context, the public discussion of which was initiated by the Applicant, a
Authority determines that for data management both the Requested and
readers have a legitimate interest.
(113) Article 6 (1) point f) of the General Data Protection Regulation to the Authority
within the scope of its applicability, it then had to examine whether the data management
is it necessary to enforce the legitimate interest of the Respondent or a third party, i.e. a
Is the aggrieved party required to provide information on a public matter identified in articles
data management.
(114) The Articles examine the credibility of the Applicant public figure. To check authenticity
a report on a suspected violation is clearly required. The Applicant
a report on the presumed illegal construction of the affected property was prepared
the Articles support it with photos and e-log data.
17(115) The Authority therefore concludes that the recording of the Applicant's personal data and
publication to enforce the legitimate interest of the Applicant and the readers, i.e. a
it was necessary to provide information about the credibility of a political public figure. THE
the Applicant and his family members are not visible in the recordings, even in the data of the e-diary
the details of the conversion of the former residential building are included in the Articles
are related to the extent. According to the Authority's point of view, the information provided in the Articles is personal
data therefore do not exceed the substantiation of the alleged violation and about it
the range of data required for providing information.
(116) After that, the Authority had to consider whether the Applicant's
interests or fundamental rights and freedoms against the legitimate interest of the Respondent.
(117) In considering the interests and fundamental rights, it is necessary as an important factor that
to appear in the Mtv., according to Section 7 (2) of which the protection of the home is a matter of public interest
it also enjoys increased protection in the case of actors.
(118) At the same time, the Authority refers to the 7/2014. (III.7.) also to paragraph [57] of the AB decision, where
The Constitutional Court explains: "However, the person affected by the speech cannot be ignored
nor the status of a person: the persons exercising public power and the politicians in public roles
in his case, the limitation of personal protection is broader than for everyone else
is considered "necessary and proportionate". On the one hand, they changed based on their own decision
become more active shapers of public affairs than others, thus undertaking the publicity of the affected community
prior evaluations and criticisms, so you are involved in the discussion of public affairs
they have to tolerate expressions of opinion that attack them with more patience.
On the other hand, those exercising public power and public politicians are broader than everyone else
in a circle and can use mass communication tools more effectively for them
against attacks. Thirdly, in their case, the criticism of their person and
classification by the social public is inherently different, the democratic debate is necessary
as part of it, typically to be interpreted along the lines of different political interests
treats it as a manifestation. In Hungary, the plural has developed in the recent period
the peculiarities of the operation of political publicity, including during public debates
society can evaluate what has been said with due caution".
(119) In paragraphs [29] and [31] of the same decision, the Constitutional Court refers to
Also to the case law of the European Court of Human Rights (hereinafter: ECtHR). In public affairs
As an argument in favor of wider criticism of acting politicians, the ECtHR explained that a
politicians consciously and inevitably expose themselves to the fact that journalists and
wider public opinion should both closely follow their every word and
their actions. Consequently, they have to be more patient with criticism
against, especially when they themselves participate in the public debate [ECtHR,
Oberschlick v Austria (11662/85), 23 May 1991, para 59]. Public actors,
especially with regard to politicians, at the same time, there may be a case where the
in special circumstances related to the discussion of public affairs, not only with the
public participation, but also in relation to the private life of the person concerned, must be taken into account
public opinion's right to information [ECtHR, Von Hannover v. Germany (no. 2)
(40660/08 and 60641/08), February 7, 2012, paragraph 110].
(120) The 26/2019 (VII.23.) In paragraph [33] of the AB decision, the Constitutional Court is the public actor
regarding the disclosure of information about his private life, he highlighted: "That
Basic Law II. and VI. exceptional public figures also enjoy the protection of Article By them
their undisclosed activities not related to public affairs
(the protected part of their private life) cannot be made public by the media pursuant to Art. IX of the Basic Law. to his article
with reference. If, on the other hand, the subject of the public debate is a slice of private life,
then - closely in this circle - freedom of expression should be prioritized
favor".
(121) The personal data published in the Articles relate to the Applicant's private life. However
precisely this slice of his private life is the subject of public debate: the public figures, presumably
18 to what extent will the illegal constructions remain without legal consequences, will they be paid for this
help from their contacts in decision-making positions.
(122) As a political public figure, the Applicant could count on the public debate he initiated
for its credibility to be examined in relation to the subject of the dispute and the investigation
the public will be informed of the result. It may not apply to all public debates
a public figure that certain areas of his private life are made public,
however, when the subject of the public debate initiated by him is a public figure, it is illegal
construction, i.e. a matter affecting the private sector, then he had to expect that his own
the legality of his construction, this slice of his private life also became part of the public debate
can become
(123) The Authority established that the objectionable data management operations were not reported
unnecessary and disproportionate interference in the Applicant's private life, since a
Data management was necessarily connected to the public matter discussed in the articles, furthermore
the Articles only assume footage of the property and the construction
e-log data to support its illegality were shared, privacy
other moments that are not necessary to support the credibility of the Applicant
not immortalized. The Authority therefore refuses the Applicant to establish it
your request that the Respondent handled your personal data illegally. THE
The Authority also rejects the Applicant's request, according to which a
Authority to order the Applicant to delete his unlawfully processed personal data,
or impose a fine.
IV.4.2. Information on data management
(124) The Applicant requested a finding of violation of Article 14 of the General Data Protection Regulation,
in view of the fact that the management of the e-diary data by individual media outlets, furthermore
in the case of the photos being taken and made public, the preview did not take place
information.
IV.4.2.1. Information on the recording and publication of e-diary data
(125) According to the consistent position of the Authority, which the Metropolitan Court
104.K.701.309/2021/15. judgment no. was also confirmed, the person carrying out press activities
data controllers are also obliged to provide information according to Article 14 of the General Data Protection Regulation
provide to those concerned. The judgment of the Metropolitan Court states that “Everything
The data subject should have received individual information pursuant to Articles 14-15 of the General Data Protection Regulation.
about the contents of its articles. [...] The argument of the first-order plaintiff that [...] on its website is baseless
Stakeholder rights enforcement options included in the published general data management information
14-15 of the General Data Protection Regulation were replaced. contained in Article It's common
according to Article 14 (1) and Article 15 (1) of the Data Protection Regulation, the data subject from the data controller
entitled to information and feedback about the management of their personal data, i.e. I.
class II plaintiff was obliged to active information activities in the II-IV. Plaintiffs
regarding. The argument is weightless - especially that the brochures omitted a
For the availability of the general data management information published on the Forbes website
reference - that the persons concerned could have viewed the website. The above active informational
the first class plaintiff failed to fulfill his obligation, therefore the defendant legally established it
14-15 of the General Data Protection Regulation. violation of its articles. [...] The general
of the information contained in Article 14 of the Data Protection Regulation on the processed personal data
it must contain individualized information for stakeholders, in the same way as general information
data protection decree on the data subject's right of access according to Article 15 (1)
for information. The purpose of individualized information is precisely that the person concerned is his own
receive specific information about the management of your personal data and your rights in relation to it -
non-general form and nature - information. One published on the data controller's website
19 information of a general nature does not provide individualized information about who is the data controller
exactly which personal data of the data subject is managed, what is the source of the data, what is the data management
its legal basis, and the duration of the data subject in accordance with the purpose of this data management
you can expect data management. The data subject knows this precisely on the basis of this individualized information
to exercise his rights as a stakeholder, to enforce his demands, based on which he can decide that it is
which data controller you must request correction of your personal data; or if it is
there is room for restriction or deletion of data, which is the management of personal data
can initiate its restriction or deletion."
(126) Despite the Authority's repeated invitations, the Respondent did not declare that
Did you provide individualized information to the applicant? Regarding your information, the Applicant
he did not give a specific answer, but explained that it is general available on the website of the data controller
information sheet contains information about data management. The Applicant that
stated that none of the articles listed in paragraph (7) of this decision took place in the evening
and advance information on data management.
(127) Based on the statement of the Respondent and the Applicant, the Authority determined ex officio,
that the Respondent did not provide individualized information to the Applicant,
thereby violating Article 14 (1)-(3) of the General Data Protection Regulation.
IV.4.2.2. Information on the recording and publication of drone footage
(128) The Applicant refers to the violation of Article 14 of the General Data Protection Regulation due to
that no advance information on data management was given on any of the Articles. THE
The Authority did not understand the legal classification of the lack of information about drone footage
one with the Applicant. According to the Authority's point of view, the Applicant's house a
The recording made by the applicant's colleague is personal obtained from the applicant
is considered data based on the following.
(129) The Authority NAIH-3476-1/2022. in its decision no. of the working group according to Article 29
guidelines for his opinion on transparency according to Regulation (EU) 2016/679 (a
hereinafter: Opinion) stated that "The fact that the camera recording and
photo was taken by one of the applicant's colleagues, does not mean that it is personal
data was not obtained directly from the Applicant." This conclusion of the Authority
based on the fact that, according to the Opinion, Article 13 of the General Data Protection Regulation is for that
applies to the case when the data is obtained from the data subject. This below is personal
includes data: consciously provided by the data subject to the data controller (e.g. online form
when filling in) data provided; or collected by the data controller from the data subject through monitoring
data (e.g. automated data collection devices or data collection software such as cameras,
network equipment, Wi-Fi tracking, radio frequency identification or other types
use of sensors). According to the Opinion, Article 14 applies when it
data is not obtained from the data subject. This includes personal data that
data manager obtained from the following sources, among others: third-party data managers;
publicly available resources; data brokers; or other stakeholders.
(130) The Authority established ex officio that the Applicant's house published in the Articles
by omitting information about the recording and publication of the recorded images a
The respondent violated Article 13 (1)-(2) of the General Data Protection Regulation.
IV.5. Additional data processing related to the Request
(131) The Applicant requested Infotv. The imposition of sanctions specified in § 61 is the general
in addition to media organizations violating the data protection decree, possibly with other organizations
(building authority) as well.
20(132) The Authority requested a statement from the Respondent about from whom it obtained the e-diary
data from The Respondent stated that he sent the data in a sealed envelope
sent by an unknown sender to the Metropol editorial office. The Authority could not investigate anything else
the data management of bodies or persons concerning the data from the e-diary
in the absence of knowledge. No result can be expected from further proof, since it is a construction
diary can be accessed by several people, as well as Smtv. Based on Section 6 (1) a
media content provider, as well as those who work with him or work with him
a person in another legal relationship is entitled to a
Person providing information in connection with media content provider activity (a
hereinafter: source of information) to keep his identity secret during court and official proceedings,
in addition, any document that may be suitable for identifying the source of information,
refuse to hand over an object or data carrier.
(133) In view of this, the Authority rejects the Applicant's request to impose
Who is Infotv? 61. sanctions with other bodies (for example, the construction
authorities).
V. Application for the imposition of a fine
(134) The application of the legal consequence of the data protection fine affects the right or legitimate interest of the Applicant
does not directly affect him, such a decision of the Authority does not create a right or obligation for him
arises, as a result of this – falling within the scope of public interest enforcement –
with regard to the application of legal consequences, the Applicant is not considered a customer under Art. Section 10
(1), and since the Ákr. does not comply with paragraph (1) of § 35, e
there is no place to submit an application, these parts of the application do not constitute an application
can be interpreted.
VI. Legal consequences
(135) In addition to the express request of the Applicant, the Authority in the procedure based on the Application
examined ex officio whether a data protection fine against the Application was justified
imposition.
(136) Based on Article 58 (2) point b) of the General Data Protection Regulation – the
due to the disregard of the rights of stakeholders - the Request was condemned by the data protection authority
in the implementation of an infringement.
(137) The Authority ex officio examined whether it was justified due to the Respondent's violation
imposing a data protection fine. In this context, the Authority is Article 83 of the General Data Protection Regulation
(2) and Infotv. 75/A. on the basis of §, the whole case was considered ex officio
circumstances, and found that in the case of the violations discovered during the present procedure,
Conviction is a proportional, deterrent sanction, so a fine is not necessary.
(138) In this regard, the Authority is in accordance with Article 83 (2) of the General Data Protection Regulation and
Infotv. 75/A. based on §, he considered all the circumstances of the case and, according to his judgment, the present
in the case of a violation discovered during the procedure, the conviction is proportionate and deterrent
sanction, therefore the imposition of a fine is not necessary. The Authority took into account that a
Articles 13 and 14 of the General Data Protection Regulation regarding the respondent
he had not previously established his grievance, and that the processed personal data
they are not classified as special data, neither the Applicant nor in the managed recordings
his family, or any other personal information related to their family and private life activities
data is not visible.
(139) Infotv. Pursuant to § 61, subsection (2), point b), the Authority publishes this decision
provided for its adoption, especially in paragraphs (89)-(93) and (107)-
to the provisions of paragraph (115), so in particular that the present decision by the Authority
It was brought in connection with the activities of 21 parliament members, the facts and subject of the case
it affects a public debate, and thus the enforcement of the constitutional fundamental rights mentioned in the decision
also for the sake of
(140) On the basis of the above, the Authority made a decision in accordance with the statutory part.
VII. Other questions
(141) The competence of the Authority is defined by Infotv. Paragraphs (2) and (2a) of § 38 define it, and its competence is
covers the entire territory of the country.
(142) The decision in Art. 80-81. § and Infotv. It is based on paragraph (1) of § 61. The decision is in Art.
Based on § 82, paragraph (1), it becomes final upon its publication.
(143) The rules of the administrative trial are set out in Act I of 2017 on the Administrative Procedure
hereinafter: Kp.) is defined. The Kp. Based on § 12, paragraph (1), by decision of the Authority
the administrative lawsuit against falls within the jurisdiction of the court, the lawsuit is referred to in the Kp. Section 13 (3)
Based on subparagraph a) point aa), the Metropolitan Court is exclusively competent. The Kp.
On the basis of § 27, paragraph (1) point b) in a lawsuit within the jurisdiction of the court, the legal
representation is mandatory. The Kp. According to paragraph (6) of § 39, the submission of the statement of claim a
does not have the effect of postponing the entry into force of an administrative act.
(144) The Kp. According to § 124, paragraph (6), if in the case of a collection of claims permitted by law a
a part of claim applications is the simplified procedure, the other part is the general rules
should be judged according to, the court acts according to the general rules.
(145) The Kp. Paragraph (1) of § 29 and, in view of this, Pp. It is applicable according to § 604, that is
of 2015 on the general rules of electronic administration and trust services
CCXXII. Act (hereinafter: E-Administration Act.) According to Section 9 (1) point b) of the
the customer's legal representative is obliged to maintain electronic contact.
(146) The time and place of filing the statement of claim is specified in Kp. It is defined by § 39, paragraph (1).
(147) The amount of the fee for the administrative lawsuit is determined by the XCIII of 1990 on fees. law
(hereinafter: Itv.) 45/A. Section (1) defines. From the advance payment of the fee
the Itv. Section 59 (1) and Section 62 (1) point h) exempt the procedure
initiating party.
Budapest, June 7, 2024.
Dr. Habil. Attila Péterfalvi
president
c. university teacher
22
