NAIH (Hungary) - NAIH-3977-4/2023

From GDPRhub
Revision as of 16:16, 4 June 2024 by Lm (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
NAIH - NAIH-3977-4/2023
LogoHU.jpg
Authority: NAIH (Hungary)
Jurisdiction: Hungary
Relevant Law: Article 5(1)(b) GDPR
Article 5(1)(c) GDPR
Article 5(1)(a) GDPR
Article 6(1)(f) GDPR
Article 14(2) GDPR
Article 15 GDPR
Article 17 GDPR
Article 21 GDPR
Type: Complaint
Outcome: Upheld
Started: 19.02.2022
Decided:
Published: 17.03.2024
Fine: 10,000,000 HUF
Parties: hir-portal.hu
National Case Number/Name: NAIH-3977-4/2023
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Hungarian
Original Source: NAIH (in HU)
Initial Contributor: lm

The DPA fined a news website €25,695 (HUF 10 million) for publishing personal data about a data subject's alleged involvement in criminal matters. The DPA found that the controller's processing was excessive and its balancing of legitimate interests was inadequate.

English Summary

Facts

On 9 February 2022, a data subject filed a complaint with the Hungarian DPA (NAIH). She objected to the processing of her personal data in a news article published by the controller’s news webpage. The first article disclosed personal data concerning the data subject’s profession as a midwife and their role in criminal proceedings involving an infant death. The second article questioned the data subject’s alleged responsibility for the death of a newborn and linked them to other infant death tragedies, accusing the data subject of lacking basic professional knowledge and qualifications.

The data subject’s spouse is a well-known opposition politician, but the data subject stated that their training as a midwife and the tragic deaths occurred before their spouse’s political career. The data subject did not object to the processing of personal data relating to their marital status or role in the business organisation of their spouse. At issue was the data related to the professional activities of the data subject, which the NAIH considered did not constitute public activities or information relating to the complainant’s public role.

On 15 December 2021, the data subject requested the deletion of the following personal data: their name, photograph, education or the alleged lack thereof, alleged professional inactivity and testimony regarding the deaths of the children.

The controller responded to the request on 10 January 2022, stating that the data were used to inform public opinion in a public debate of wide interest. Its stated purpose was offering media services and public information, and its legal basis was claimed consent and legitimate interest. In particular, it cited its legitimate interests in freedom of the press, freedom of expression and public information. The controller also noted that another media outlet had previously disclosed the data subject's personal data. Thus, the controller considered there to be no unlawful processing of data in the contested article and thus did not delete the requested data. With regard to the storage duration, the controller stated that the content was deleted only if deemed necessary due to the exercise of a right by the data subject.

Holding

The NAIH found that the controller violated Articles 5(1), 5(2), 6(1), 14(2), 15(1), 15(3), 17(1), 17(3) and 21(1) GDPR. It issued a €25,695 (HUF 10,000,000) fine and ordered deletion of the personal data.

The NAIH rejected legitimate interest as a legal basis in this case, finding that the controller failed to carry out an adequate balancing of interests and thus violated Article 6(1) GDPR. When the press publishes an article containing personal data, the balancing of interests must take into account the specific personal data and processing at issue. Controllers must always examine the legitimate interest in the specific situation and whether the processing is necessary to achieve the purpose. In this case, the controller only took account of its own interests. Further, in response to the data subject’s request, the controller did not specify why its processing of personal data in the context of freedom of expression constituted a proportionate restriction of the data subject’s right to informational self-determination.

In addition, the NAIH found that the controller’s publication of personal data breached the principles of purpose limitation and data minimisation under Articles 5(1)(b) and (c) GDPR. While the NAIH acknowledge that the issue of out-of-hospital births is a matter of public interest, the controller’s articles were not aimed at generating a public debate on the issue. Instead, the articles focused only on the data subject’s testimony in criminal proceedings and the widely publicized family tragedies involving their role in the home birth. In addition, the NAIH emphasised its view that, where there is a genuine public interest in criminal proceedings, any information provided by a press body in relation to such proceedings must seek to limit the processing of personal data to the extent necessary and to respect the principle of data economy – in particular where the information can serve its purpose without disclosing excessive personal data.

The controller also violated principles of fair and transparent processing pursuant to Articles 5(1)(a) GDPR. The NAIH found that including the data subject’s name in the same article as the named infant deaths was a fundamental breach of the principle of unfair processing. The controller also fell short of transparency requirements when it failed to make the data subject aware of the essential elements of the processing.

Finally, the controller failed to adequately enforce the data subject’s rights of access, erasure and objection pursuant to Articles 15, 17 and 21 GDPR, respectively. While the controller responded to the data subject’s access, erasure and objection requests within 30 days, it did not provide information on the legal basis, duration or source of the personal data. It did not comply with the access or erasure requests, and did not justify its processing based on legitimate interest, Articles 14(2) and 15(1) and (3) GDPR.

Given all of the above infringements, the controller should have deleted the unlawfully processed personal data. Its failure to do so infringed Articles 17(1) and (3) as well as 21(1) GDPR. The NAIH rejected the controller’s argument of mere republication, noting that the fact that a data subject’s personal data were previously disclosed by another media outlet does not relieve the controller from its obligation to carry out an accurate and detailed balancing of interests concerning the processing of those personal data.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details. 

File number: NAIH-3977-4/2023. Subject
:
Decision
DECISION
In the data protection authority proceedings before the National Authority for Data Protection and
Freedom of Information (hereinafter referred to as the Authority), the following decisions are made
on the basis of the application of the applicant represented by Dr. Nehéz- Posony Katinka, lawyer
(hereinafter referred to as the Applicant) against the respondent represented by Dr. Nagy János,
lawyer (hereinafter referred to as the Respondent) concerning unlawful data processing and
violation of data subjects' rights related to news articles published on the news portal.hu website
(hereinafter referred to as the Application).
The Authority grants the applicant's application in part and finds that
I. in the course of the data processing by the Data Subject
a. disclosed without a proper legal basis the personal data of the Applicant referred to in
paragraph 81 of this Decision in the news articles published on the URL of Article 1
(hereinafter 'Article 1') and the URL of Article 2 (hereinafter 'Article 2') in breach of Article
6(1) of the General Data Protection Regulation;
b. by carrying out the balancing of interests in support of its legitimate interest in its
response to the Applicant's request for a data subject only in a general manner,
emphasising its own interests, without taking into account the Applicant's personal rights,
and consequently by not deleting the Applicant's personal data unlawfully processed,
infringed Articles 17(1) and (3) and 21(1) of the General Data Protection Regulation;
c. by failing to provide information in its reply to the data subject's request about its
processing of data relating to the complained articles and the data it processes in relation
to the applicant, the applicant infringed Articles 14(2), 15(1) and 15(3) of the General Data
Protection Regulation.
II. The Authority finds of its own motion that the Respondent has infringed Article 5(1)(a), (b)
and (c) and Article 5(2) of the General Data Protection Regulation by disclosing the personal
data referred to in the articles under I.(a) in section (81) of this Decision.
III. As a legal consequence of data breaches under points I and II.
a) impose ex officio a data protection fine of HUF 10.000.000.-, i.e. ten million forints, and
b) pursuant to Article 58(2)(g) of the GDPR, order the immediate deletion of the unlawful
personal data referred to in point I. from Article 1 and Article 2 after the expiry of the time
limit for bringing an action to contest this decision or, in the case of an administrative
procedure, after the court decision has become final;
c) temporarily restrict access to the personal data disclosed in Article 1 and Article 2 as a
temporary measure, as a temporary measure, until the expiry of the time limit for bringing
an action under Article 58(2)(f) of the GDPR or, in the case of administrative proceedings,
until the court has given a final decision.
IV. The Respondent shall provide the Authority with written proof of compliance with the
obligations set out in points III. b) and c) within 15 days of the adoption of the measure,
together with the supporting evidence.
V. The Authority rejects the applicant's request as being in excess of the above.
The fine under point III(a) shall be paid within 30 days of the date on which this Decision becomes
final to the Authority's Centralised Revenue Collection Special Account (10032000-01040425-
00000000 Centralised Revenue Collection Account IBAN: HU83 1003 2000 0104 0425 0000 0000).
When transferring the amount, please refer to NAIH/3977/2023.
................................................................................................................................................................
1055 BudapestTel .: +36 1 391-1400 ugyfelszolgalat@naih.hu
9-11 Falk Miksa Street Fax: +36 1 391-1410 www.naih.hu
2
If the Respondent does not comply with the obligation to pay the fine within the time limit, it will be
liable to pay a late payment penalty. The amount of the default interest shall be the statutory interest
rate, which shall be the base rate of the central bank in force on the first day of the calendar half-
year in which the default occurred.
In case of non-execution of the controller's act as a legal consequence of the data protection
infringements identified in this Decision and non-payment of the data protection fine and interest for
late payment imposed, the Authority shall order the enforcement of the Decision.
There is no administrative remedy against the present decision, but it may be challenged in an
administrative lawsuit within 30 days of notification by means of a petition addressed to the
Metropolitan Court of Justice. The application must be sent to the Authority electronically1 which
shall forward it to the court together with the case file. The request for a hearing must be indicated in
the application. For persons who do not benefit from a full personal exemption from fees, the fee for
the judicial review procedure is HUF 30,000 and the action is subject to a right to a fee waiver. Legal
representation is mandatory in proceedings before the Metropolitan Court.
I N D O C U L A R Y
I. The Application
(1) On 9 February 2022, the applicant filed a complaint on e-Paper, objecting to the processing of data
in the news articles published by the defendant's press product (www.hírportál.hu) and referred to
below. It requested that the Authority initiate data protection authority proceedings against the
Applicant pursuant to Article 60(1) of the Infotv.
- declare the unlawful processing of the Applicant's personal data concerned and the
infringement of the data subject's rights under the General Data Protection Regulation on the
basis of point (ba) of paragraph (1)(b) of Article 61 of the Infotv;
- 61 (1) paragraph b) point bc) order the erasure of unlawfully processed data;
- Article 61 (1) (b) (bd) prohibit further processing;
- impose a fine on the data controller pursuant to point bg) of paragraph (1)(b) of Article 61:
(2) Article 1: The article entitled "Title of Article 1" (published on 25.02.2019, available at URL of Article
1) discloses personal data concerning the Applicant's professional activities as a midwife and her
role in the criminal proceedings, based on a testimony given by the Applicant in a criminal trial. The
Complained Image of the Applicant in the article is currently (05.04.2023) no longer available.
(3) Article2: "Title of Article2" (published on 10.08.2021, available at Article2. URL evaluates the
Applicant's professional functioning in connection with his testimony in a criminal case involving an
infant death, questions the Applicant's alleged responsibility for the death of the newborn, links his
person to other infant death tragedies, and alleges the Applicant's lack of basic professional
knowledge and the lack of the necessary qualifications and licenses to practice his profession. The
complained Article 2 is available with amended content (05.04.2023.): the following content is
available in italics in quotation marks before the content of the article: "The defendant violated the
plaintiff's right of good repute by falsely reporting in the article that the plaintiff [...] The defendant
infringed the applicant's right to the protection of his personality by processing as personal data,
without a proper legal basis and without a compelling legitimate interest as justified by the
applicant's express objection, in breach of the principles of fair processing, purpose limitation and
accuracy, the personal data and the image of the applicant relating to his professional activities, his
professional knowledge and his testimony as a witness in criminal proceedings."
(4) The applicant submitted that her husband is a well-known opposition politician, but that his training
as a midwife and the tragic deaths occurred before his spouse's political career. The Applicant did
not object to the processing and disclosure of personal data relating to her marital status or her role
in a business organisation with her husband
1 To initiate an administrative lawsuit, use the form NAIH_K01, which can be downloaded from https://www.naih.hu/kozig-hatarozat-
birosagi-felvevevevskalata
3
are related to. However, the data processing activities complained of are related to the professional
activities of the Applicant and therefore do not constitute public activities or information relating to
the Applicant's public role.
(5) The applicant requested the deletion of the following personal data in the context of her midwifery
activities: her name, including by reference to her husband; her photograph; her education or
alleged lack thereof; her alleged professional inactivity in the context of her activities; her testimony
regarding the deaths of children in the negative context that
is listed as a witness "for the time being". Finally, the Applicant requested the removal of its full
name from the search labels of the articles.
(6) On 15 December 2021, the Applicant submitted a request to the Respondent, in which the General
Data Protection Regulation
a.) Article 15 of the GDPR, you have requested information about your personal data processed,
b.) Article 15(3) of the GDPR, he requested a copy of his personal data processed by the
Respondent and not disclosed in the articles complained about,
c.) objected to the processing pursuant to Article 21(1) and
d.) requested the erasure of his/her personal data on the basis of Article 17(1).
e.) It also requested information from the Respondent on how it had complied with Articles 12 and
14.
(7) According to the Respondent's reply of 10 January 2022, based on constitutional and legal
provisions, the data published in the contested article were used by the editorial staff to form
opinions in a public debate of wide interest and high importance in order to inform the public opinion
in the framework of freedom of expression, thus contributing to the public debate and its substantive
assessment. In its view, there was no unlawful processing of data in the contested article.
II. Facts
(8) With regard to the contested articles, it can be established that in Article 1, the Respondent, by
repeating information disclosed in a public community page accessible to anyone, from a post made
by a well-known paediatrician on 24 February 2019 and from the testimony of the Respondent in
court on 4 January 2019, and by linking to an article available on the news portal1 (URL of the
article1, 22 February 2019), disclosed information about the Respondent's midwifery activities.
Article1, as amended since 25 February 2019, is currently available on the Applicant's website.
(9) The image communicated in Article 1 depicts the Applicant in an environment where, among the
material and sanitary conditions of the "clean bed suitable for childbirth" defined in the Government
Decree 35/2011 (III. 1.) on the professional rules, conditions and grounds for exclusion of out-of-
hospital births, the "clean bed suitable for childbirth" can be identified. In addition, the walls and
floors of the room shown in the photo are tiled, which, like the conditions in the institution, serves to
ensure hygiene.
(10) The content of the challenged image, which is now no longer available in the challenged Article 1,
was as follows: the Applicant was in civilian clothes, sitting next to a double bed with a colourful
cover in a bedroom-like room, while the walls and floor were tiled.
(11) Article 2 will be published on 10 August 2021, or after any previous press releases. In the
absence of a statement by the respondent, the Authority will treat the further linked articles
["linked news portal2." - 10.08.2021 - linked article2 URL, "two of those babies" - 07.02.2019 - linked
article3 URL, "seven weeks old" - 02.02.2019 - linked article4 URL, "linked news portal2." -
10.08.2021 - linked article5 URL] as the source in Article2. Article2. is currently available on the
Respondent's online platform.
(12) In its Order No. NAIH-2809-2/2022, the Authority invited the Respondent to submit comments and
informed the Respondent of the opening of the data protection authority procedure.
(13) The Respondent made its views known in Statement 1 (NAIH-2809-6/2022). It referred to Article IX
(1)-(2) o f the Fundamental Law, Section 10 of the Smtv., and stressed that the contested
4
The information published in article 3.1 was used by your editorial office, as a press body, to
formulate opinions in one of the most important and widely public debates of our time, in order to
inform public opinion in the framework of freedom of expression, by exercising the resulting freedom
of the press and the right to information as fundamental rights, thus contributing to the public debate
and its substantive assessment. In its view, there was no unlawful processing of data in the
contested article. As the source of Article 1, the applicant cited an entry on the social networking site
of a doctor [URL of the entry on the social networking site], and as the source of Article 2, the
applicant cited the article on the same subject on the news portal2.hu, but did not cite the source
article with an exact link.
(14) In its Statement 2 (NAIH-2809-8/2022), the Authority repeatedly invited the Respondent to
supplement its position to the extent that, in its opinion, the public debate referred to by the
Respondent was still relevant at the time of publication of the contested articles.
(15) The Authority subsequently invited the Applicant to submit further comments, and the Applicant
attached to its reply (NAIH-2809- 11/2022.) a written communication from the Press Secretariat of
the Metropolitan Court of Appeal dated 11 June 2021 confirming the first instance judgment in the
so-called Vitamin K case [https://fovarosiitelotabla.birosag.hu/sajtokozlemeny/20210611/fovarosi-
itelotabla-helybenhagyta-
the-un-vitamin-k-in-one-added-elsofoku, hereafter: court press release].
(16) The Applicant submitted that, in relation to the photograph published in Article 1, the Applicant used
a photograph which originally appeared on the Hungarian language page of the magazine Name
magazine on 21.01.2018 as an illustration of an interview with the Applicant in the article entitled
"Title of the article by author name by author" [magazine article URL]. The Applicant contributed the
photograph solely to illustrate this article. In its opinion, the mere fact that the image is found on an
otherwise publicly accessible forum does not render the consent unnecessary, since it is used for a
different purpose and without any legal basis.
(17) The Applicant further explained that no criminal or other (judicial) proceedings have ever been
brought against him in connection with his midwifery practice, and therefore he cannot comment on
the beginning and the end of such proceedings. She has not had any formal case in which her
professional responsibility has been challenged or investigated. The Applicant was heard as a
witness by the Budapest District Court on 4 January 2019 in Case No. 7.B.26/2017, which was
brought against a couple of parents whose child was born on 12 November 2012 in the Applicant's
practice, outside the institution, and died at the age of two months. During the criminal proceedings,
the Applicant testified as a witness as to whether the newborn had received vitamin K and whose
responsibility it was to administer it. The professional responsibility of the Applicant did not arise
during the proceedings, and the Metropolitan Court of Appeal in its second instance judgment
upheld the first instance judgment in the so-called Vitamin K case, which found the parents liable.
(18) Article 2 also mentions two other deaths in connection with the Applicant, claiming that they were
caused by the Applicant's midwifery activities. In one case, in 2015, a newborn baby was stillborn
during a delivery attended by the Applicant. No proceedings were brought in this case and the
Applicant was not held professionally liable for the death. In the other case, in May 2015, a case
known from the media as the "media flagging" case, in which the Applicant was not involved in the
death of the 19-month-old child, according to an article published on the online news site of the
referenced news portal3 on 8 January 2019 [URL of the article of the referenced news portal3], one
person was involved in the tragedy of the settlement child and the child who died due to vitamin K
deficiency: the paediatrician and not the Applicant. However, the deaths were misleadingly
presented to the public by the Respondent in the articles in such a way that the whole content and
title of the article implied that they were the result of the professional incompetence of the
Respondent, and in fact, by suggesting false conclusions, it communicated untrue information about
the Respondent.
(19) In the Applicant's view, the Applicant has made the following untrue statements in its articles, and
thus its data management is necessarily inaccurate and unlawful:
- it is untrue that the Applicant w a s involved in or liable for t h e death of any infant
- it is untrue that he had no professional qualifications
- it is untrue that she has been working as a midwife without a licence
- it is untrue that he lacked the necessary professional knowledge
5
- it is untrue that the midwife has any professional responsibility for vitamin K given to the
infant after birth.
(20) In response to the Authority's request, the Respondent explained in its Statement No.3 (NAIH-2809-
12/2022,) that in responding to the data subject's request, the Respondent did not take into account
the final judgment attached to the request, as it was not a party to the proceedings and the judgment
did not concern data processing. He also attached the post of 24 February 2019 on the social
networking site of his doctor's name, which is the source of Article 1 and is currently available.
(21) In its Statement4 (NAIH-2809-16/2022.), the Authority repeatedly stated that, although it was aware
of the court press release, the publication of Articles 1 and 2 serves the public debate, as family
tragedies involving the death of infants are always of great public interest. The prosecution of these
tragedies is also of major public interest, including the prosecution referred to in these articles. The
topicality of the public debate is demonstrated by the fact that the applicant has taken an active
public and political role, having campaigned actively for her politician husband in the recent past.
Because of this active involvement in public life, the Applicant's person and other activities are also
of public interest.
(22) The Petitioner has supported his active public and political involvement and his status as a public
figure with three articles published in the year 2022 in Petitioner's Statement 5 (NAIH-2809-
19/2022):
- URL1,
- URL2,
- URL3.
23) With regard to the image published in Article 1, the Respondent indicated its source: the URL of the
magazine article. It further explained that the contested image, which had already appeared on
other websites with the consent of the Respondent and in connection with the activity on which the
contested article was based, contributes to a social debate of public interest by presenting a person
who is a direct participant in this social debate. In his view, the legal conditions for the restriction
were fulfilled, since the contested article was aimed at the free discussion of public affairs, the
image contains information that promoted that discussion, and the lack of consent to the use of the
image therefore constituted a necessary and proportionate restriction (Civil Code, Article 2:44).
(24) The Authority informed the Applicant (NAIH-3977-2/2023.) and the Respondent (NAIH-3977-
1/2023.) of the completion of the evidentiary procedure and in this context drew their attention to the
exercise of the right to make a statement and to inspect the file. The order was successfully served
to the Applicant on 9 March 2023 and to the Respondent on 21 March 2023. In the present case,
neither party has submitted any observations or requests for access to the file to the Authority.
III. Legal provisions applied
(25) According to Article VI (3) paragraph 3 of the Fundamental Law of Hungary (hereinafter:
Fundamental Law), everyone has the right to the protection of personal data and to the disclosure
and dissemination of data of public interest.
(26) Under Article IX(1) and (4) of the Fundamental Law, everyone has the right to freedom of
expression. The exercise of freedom of expression may not be directed against the human dignity of
others.
(27) According to Article IX (2) of the Fundamental Law, Hungary recognises and protects the freedom
and diversity of the press, and ensures the conditions for the free flow of information necessary for
the development of democratic public opinion.
(28) Pursuant to Article 2(1) of Regulation (EU) 2016/679 on the protection of natural persons with
regard to the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (hereinafter the General Data Protection Regulation), the General Data
Protection Regulation applies to the processing of personal data wholly or partly by automated
means and to the processing of personal data which form part of a filing system or are intended to
form part of a filing system by non-automated means.
6
(29) According to Article 4(1) of the GDPR, "personal data" means any information relating to an
identified or identifiable natural person ("data subject"); an identifiable natural person is one who can
be identified, directly or indirectly, in particular by reference to an identifier such as a name, number,
location data, an online identifier or to one or more factors specific to the physical, physiological,
genetic, mental, economic, cultural or social identity of that natural person.
(30) According to Article 4(2) of the GDPR, 'processing' means any operation or set of operations which
is performed upon personal data or on sets of personal data, whether or not by automated means,
such as collection, recording, organisation, structuring, structuring, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available,
alignment or combination, restriction, erasure or destruction.
(31) According to Article 4(7) of the GDPR: 'controller' means a natural or legal person, public authority,
agency or any other body which, alone or jointly with others, determines the purposes and means of
the processing of personal data; where the purposes and means of the processing are determined
by Union or Member State law, the controller or the specific criteria for the designation of the
controller may also be determined by Union or Member State law.
(32) According to Article 5(1)(b) of the GDPR, personal data may only be collected for specified, explicit
and legitimate purposes and not processed in a way incompatible with those purposes ('purpose
limitation'), and according to Article 5(1)(c), personal data must be adequate, relevant and limited to
what is necessary for the purposes for which they are processed ('data minimisation').
(33) Under Article 5(2) of the GDPR, the controller is responsible for compliance with paragraph 1 and
must be able to demonstrate such compliance ('accountability').
(34) Pursuant to Article 6(1) of the General Data Protection Regulation, personal data may be lawfully
processed only if and to the extent that at least one of the following conditions is met:
a) the data subject has given his or her consent to the processing of his or her personal data for
one or more specific purposes;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or
by a third party, except where those interests are overridden by the interests or fundamental rights
and freedoms of the data subject which require the protection of personal data, in particular where
the data subject is a child.
(35) Pursuant to Article 14(2) of the GDPR, the controller shall provide the data subject with the
additional information necessary to ensure fair and transparent processing for the data subject:
(b) where the processing is based on Article 6(1)(f), the legitimate interests of the controller or a
third party;
(36) Pursuant to Article 15(1) of the GDPR, the data subject has the right to obtain from the controller
feedback as to whether or not his or her personal data are being processed and, if such processing
is taking place, the right to access the personal data and the following information:
a) the purposes of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipients to whom or with whom the personal data have
been or will be disclosed, including in particular recipients in third countries or international
organisations;
d) where applicable, the envisaged period of storage of the personal data or, if this is not
possible, the criteria for determining that period;
e) the right of the data subject to obtain from the controller the rectification, erasure or
restriction of the processing of personal data concerning him or her and to object to the
processing of such personal data;
f) the right to lodge a complaint with a supervisory authority;
g) if the data were not collected from the data subject, any available information on their
source;
7
h) the fact of automated decision-making, including profiling, referred to in Article 22(1) and
(4) and, at least in those cases, clear information on the logic used and the significance of
such processing and its likely consequences for the data subject.
(37) Pursuant to Article 17(1) of the GDPR, the data subject shall have the right to obtain on his or her
request the erasure of personal data relating to him or her without undue delay and the controller
shall be obliged to erase personal data relating to him or her without undue delay where one of the
following grounds applies:
a) the personal data are no longer necessary for the purposes for which they were collected or
otherwise processed;
b) the data subject withdraws the consent referred to in Article 6(1)(a) or Article 9(2)
(a), and there is no other legal basis for the processing;
c) the data subject objects to the processing on the basis of Article 21(1) and there are no
overriding legitimate grounds for the processing, or the data subject objects to the
processing on the basis of Article 21(2);
d) the personal data have been unlawfully processed;
e) the personal data must be erased in order to comply with a legal obligation under Union or
Member State law to which the controller is subject;
f) the personal data have been collected in connection with the provision of information society
services referred to in Article 8(1).
(38) Pursuant to Article 17(2) of the GDPR, where a controller has disclosed personal data and is
required to erase them pursuant to paragraph 1, it shall take reasonable steps, including technical
measures, taking into account the available technology and the cost of implementation, to inform the
controllers that process the data that the data subject has requested the deletion of the links to or
copies or replicas of the personal data in question.
(39) On the basis of Article 17(3) of the General Data Protection Regulation, paragraphs 1 and 2 shall
not apply where the processing is necessary:
a) for the exercise of the right to freedom of expression and information;
(40) Pursuant to Article 21(1) of the GDPR, the data subject shall have the right to object at any time, on
grounds relating to his or her particular situation, to the processing of his or her personal data based
on Article 6(1)(e) or (f), including profiling based on that provision. In this case, the controller may
also not process the personal data unless the controller demonstrates compelling legitimate
grounds for the processing which override the interests, rights and freedoms of the data subject or
for the establishment, exercise or defence of legal claims.
(41) Without prejudice to any other administrative or judicial remedy under Article 77(1) of the General
Data Protection Regulation, any data subject shall have the right to lodge a complaint with a
supervisory authority, in particular in the Member State of his or her habitual residence, place of
work or place of the alleged infringement, if the data subject considers that the processing of
personal data relating to him or her infringes this Regulation.
(42) Pursuant to Article 85(1) of the GDPR, Member States shall by law reconcile the right to the
protection of personal data under this Regulation with the right to freedom of expression and
information, including the processing of personal data for journalistic, scientific, artistic or literary
purposes.
(43) Az általános adatvédelmi rendelet 85. cikk (2) bekezdése értelmében a személyes adatok újságírási
célból, illetve tudományos, művészi vagy irodalmi kifejezés céljából végzett kezelésére vonatkozóan
a tagállamok kivételeket vagy eltéréseket határoznak meg a II. fejezet (elvek), a III. fejezet (az
érintett jogai), a IV. fejezet (az adatkezelő és az adatfeldolgozó), az V. Chapter VI (independent
supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific cases
of processing), where such exceptions or derogations are necessary to ensure that personal data
are processed in accordance with the law of the Member State in which they are processed.
8
reconcile the right to data protection with the right to freedom of expression and information.
(44) According to the preamble of the General Data Protection Regulation (65), "[...], the further retention
of personal data may be regarded as lawful where it is necessary for the exercise of the right to
freedom of expression and information, for compliance with a legal obligation, for the performance
of a task carried out in the public interest or in the exercise of official authority vested in the
controller, or in the public interest in the sphere of public health, for archiving purposes in the public
interest, for scientific or historical research purposes, for statistical purposes or for the
establishment, exercise or defence of legal claims."
(45) According to the preamble of the General Data Protection Regulation (69), '[A]ny data subject
should have the right to object to the processing of data relating to his or her particular situation
even if the personal data can be lawfully processed because the processing is necessary for the
performance of a task carried out in the public interest or in the exercise of official authority vested
in the controller, or on the basis of the legitimate interests of the controller or of a third party. The
controller shall demonstrate that his or her compelling legitimate interests override the interests or
fundamental rights and freedoms of the data subject."
(46) According to the preamble of the General Data Protection Regulation (153), '[t]he law of the Member
States must reconcile the rules on freedom of expression and information, including journalistic,
scientific, artistic and literary expression, with the right to the protection of personal data under this
Regulation. It is appropriate that the processing of personal data solely for journalistic, scientific,
artistic or literary expression should be subject to derogation or exempted from the requirements of
certain provisions of this Regulation where this is necessary to reconcile the right to the protection of
personal data with the right to freedom of expression and information guaranteed by Article 11 of the
Charter. This applies in particular to the processing of personal data in the audiovisual field and in
news archives and press libraries. Consequently, Member States shall adopt legislative measures to
determine the exceptions and derogations necessary to strike a balance between these fundamental
rights. Member States shall adopt exceptions and derogations with regard to general principles, the
rights of the data subject, the controller and processor, the transfer of personal data to third
countries or international organisations, independent supervisory authorities, cooperation and
uniform application, and specific processing situations. Where those exceptions or derogations differ
between Member States, the law of the Member State applicable to the controller should apply. In
order to take account of the importance of the right to freedom of expression in all democratic
societies, concepts such as journalism which are part of that freedom should be interpreted
broadly."
(47) Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information
(hereinafter: Infotv.), Article 3.5. data of public interest: information or knowledge, which is not
covered by the concept of personal data, recorded in any manner or form, which is in the
possession of an organ or person performing a state or local government function or other public
function as defined by law and which relates to its activities or arises in connection with the
performance of its public function, irrespective of the way in which it is handled, whether or not it is
of a specific or collective nature, in particular data concerning the powers, competences,
organisation, structure, professional activities, including an assessment of their effectiveness, the
types of data held and the legislation governing their operation, as well as data concerning
management and contracts concluded.
(48) Public data in the public interest: any data not covered by the concept of data in the public interest,
the disclosure, knowledge or making available of which is ordered by law in the public interest.
(49) Pursuant to Paragraph (2) of Article 26 of the Information Act, public data is the name, scope of
duties, job title, managerial mandate, other personal data related to the performance of public
duties, and personal data whose disclosure is required by law. Personal data in the public interest
may be disseminated in compliance with the principle of purpose limitation.
(50) Pursuant to Paragraph (2) of Article 38 of the Information Act, the Authority is responsible for
ensuring the protection of personal data and the right of access to data of public interest and public
interest.
9
and to facilitate the free flow of personal data within the European Union. The tasks and powers of
the Authority are set out in detail in Articles 57(1), 58(1) to (3) of the General Data Protection
Regulation and Article 38(2) to (4) of the Infotv.
(51) Pursuant to Article 4 (1) of Act CIV of 2010 on Freedom of the Press and the Fundamental Rules of
Media Content (hereinafter: Smtv.), Hungary recognises and protects the freedom and diversity of
the press.
(52) Section 4 (2) Freedom of the press also extends to independence from the state and from any
organisation or interest group.
(53) Section 4 (3) The exercise of freedom of the press shall not constitute a criminal offence or an
incitement to commit a criminal offence, shall not violate public morals, and shall not infringe the
personal rights of others.
(54) Article 6 (1) Media content providers and persons in an employment or other legal relationship with
them shall be entitled, as defined by law, to keep confidential the identity of the person providing
information to them in connection with their media content provider activities (hereinafter referred to
as the "source of information") in the course of judicial and official proceedings, and to refuse to
hand over any document, record, object or data carrier that may be suitable for identifying the
source of information.
(55) Section 7 (1) Employees of media content providers or persons having other employment
relationships with media content providers shall be entitled to professional independence from the
owner of the media content provider and from natural or legal persons supporting the media content
provider or placing commercial announcements in the media content, and to protection against
pressure from owners or supporters to influence media content (editorial and journalistic freedom).
(56) Article 10 of the Constitution Everyone has the right to be properly informed about local, national
and European public affairs and events of importance to the citizens of Hungary and the members
of the Hungarian nation. It is the duty of the media system as a whole to provide credible, prompt
and accurate information on these matters and events.
(57) Article 13 of the Smtv. Linear media services providing information shall provide balanced
information on events and controversial issues of public interest at local, national, national and
European level, as well as events of importance to the citizens of Hungary and the members of the
Hungarian nation, in their information and news programmes. The detailed rules of this obligation
shall be laid down by law in accordance with the requirements of proportionality and the
safeguarding of democratic public opinion.
(58) Section 21 (1) Media content providers shall decide independently on the publication of media
content within the limits of the law and shall be responsible for compliance with the provisions of this
Act.
(59) Act LIII of 2018 on the Protection of Private Life (hereinafter: Mvtv.) § 2:44 [Protection of the right to
privacy of public figures] (1) The exercise of fundamental rights ensuring the freedom to discuss
public affairs may restrict the protection of the public figure's right to privacy to a necessary and
proportionate extent, without prejudice to human dignity; however, it may not entail any infringement
of his/her private and family life and home.
(60) (2) A public figure shall be entitled to the same protection as a non-public figure against any
communication or conduct outside the scope of free discussion of public affairs.
(61) (3) No activity or information relating to the private or family life of a public figure shall be considered
a public matter.
(62) The General Data Protection Regulation shall apply to the processing of data subject to the General
Data Protection Regulation pursuant to Article 2(2) of the Infotv with the additions specified in the
provisions indicated therein.
(63) Pursuant to Article 60 (1) and (2) of the Data Protection Act, the Authority shall, upon request of the
data subject, initiate data protection authority proceedings and may initiate data protection authority
proceedings ex officio in order to enforce the right to the protection of personal data. Initiation of the
data protection authority procedure
10
may be submitted in the cases provided for in Article 77(1) and Article 22(b) of the General Data
Protection Regulation.
(64) Pursuant to Paragraph (5) of Article 60 of the Infotv., in the case specified in paragraph (2), the
application shall contain, in addition to the information specified in the Act on General Administrative
Procedure
a) an indication of the alleged infringement,
b) a description of the specific conduct or situation giving rise to the alleged infringement,
c) the data necessary for the identification of the controller or processor of the alleged
infringement, available to the applicant,
d) the facts and evidence supporting the allegations of the alleged infringement; and
e) a confirmatory application for a decision requiring the rectification of the infringement.
(65) Pursuant to Article 61(1)(a) of the Data Protection Act, the Authority may apply the legal
consequences pursuant to Article 58(2) of the General Data Protection Regulation in its decision in
the procedure of the data protection authority in connection with the processing operations specified
in Article 2(2) of the Data Protection Act. Accordingly, the Authority, acting under its remedial
powers:
a) warns the controller or processor that certain of its intended processing activities are likely to
infringe the provisions of this Regulation;
b) censure the controller or processor where its processing activities have infringed the
provisions of this Regulation;
c) instruct the controller or processor to comply with a data subject's request to exercise his or
her rights under this Regulation;
d) instructs the controller or processor to bring its processing operations into compliance with
the provisions of this Regulation, where applicable, in a specified manner and within a
specified period;
e) instructs the controller to inform the data subject of the personal data breach;
f) temporarily or permanently restrict processing, including the prohibition of processing;
g) order the rectification or erasure of personal data or the restriction of processing in
accordance with Articles 16, 17 and 18 respectively, and notify the recipients to whom or
with which the personal data have been disclosed in accordance with Articles 17(2) and 19;
h) withdraw the certificate or instruct the certification body to withdraw the certificate issued in
accordance with Articles 42 and 43, or instruct the certification body not to issue the
certificate if the conditions for certification are not or are no longer fulfilled;
i) impose an administrative fine in accordance with Article 83, in addition to or instead of the
measures referred to in this paragraph, depending on the circumstances of the case; and
j) order the suspension of data flows to a third country recipient or international organisation.
(66) Pursuant to Paragraph (6) of Article 61 of the Data Protection Act, the data concerned by the
contested processing may not be erased or destroyed until the expiry of the time limit for bringing an
action to contest the decision or, in the case of administrative proceedings, until the court has
issued a final decision.
(67) Pursuant to Article 75/A of the GDPR, the Authority shall exercise its powers under Article 83(2) to
(6) of the GDPR taking into account the principle of proportionality, in particular by taking action to
remedy a first infringement of the provisions on the processing of personal data laid down by law or
by a binding legal act of the European Union, in particular by issuing a warning to the controller or
processor in accordance with Article 58 of the GDPR.
(68) Unless otherwise provided for in the General Data Protection Regulation, the provisions of the
General Data Protection Act shall apply to the data protection authority procedure initiated upon
request, with the exceptions set out in the Infotv.
(69) Pursuant to Section 35 (1) of the General Civil Code, an application is a statement by the customer
requesting the conduct of a public authority procedure or a decision by the public authority in order
to enforce his/her right or legitimate interest.
(70) Pursuant to Article 83(7) of the General Data Protection Regulation, without prejudice to the
supervisory authorities' remedial powers under Article 58(2), each Member State may lay down
rules on whether a supervisory authority established in that Member State, whether public or not, is,
11
whether and to what extent an administrative fine may be imposed on a body with public responsibilities
IV. Evidence taken into account in the Authority's decision and its assessment
IV.1. The public persona of the applicant
(71) In the explanatory memorandum of the decision of the AB 3145/2018 (7 May 2018), the panel
stressed that "[the] decisive criterion for determining the status of a public figure is not the status of
the person concerned, but whether the participants in the public debate concerning public affairs or
public life have become, by their voluntary decision, a shaper of public affairs, public life, a regular
or periodic participant". {3145/2018 (7.5.2018) AB, Reasoning [50], paragraph 50}
(72) The Authority accepts the qualification of the Metropolitan Court of Appeal, which in its reasoning in
its judgment No 2.Pf.20.757/2020/6 stated in relation to the person of the Applicant that "[t]he
applicant, who worked as a midwife in her own business, was clearly not a public figure; her
testimony in criminal proceedings is not a public figure, [...]". {Indent [56]}
(73) The Applicant cannot be considered either a public figure or a public figure in relation to the news
articles examined in the present case, despite the fact that there was a high public interest in the
case covered by the court proceedings in the articles, since the Applicant participated in the
proceedings covered by the articles solely on the basis of her professional activity as a midwife, as
a witness in the criminal proceedings and in a non-charging position.
(74) The Authority observes that, in its view, the Applicant may be a public figure by virtue of his or her
public statements on certain public-political issues, but it is not sufficient that the Applicant's spouse
is a public figure as a mayor and a public figure as a politician, since on this basis the close relative
of any politician would automatically become a public figure, which is clearly contrary to the purpose
of the Privacy Act: the Mvtv. The reasoning of the Mvvtv Act underlines that the law does not
specifically mention the relative of a public figure within the meaning of the Civil Code, and that a
relative cannot be considered a public figure merely because of the public figure.
(75) The Authority also does not accept the Respondent's argument that the Respondent has taken an
active public, political role by participating in her politician husband's campaign in the recent past
and
is a "flyer", and therefore his personal and other activities are of public interest. The Applicant - as a
natural consequence - supported her husband's political campaign activities as a relative, as a
member of the family, but this did not automatically make her a public figure or a public figure, just
as individual contributors to political campaigns and activists are not automatically considered public
figures because of their activities.
IV.2. Identity of the controller
(76) According to the deed of incorporation signed on 24 June 2019, the registered publisher of the news
portal.hu (publisher's name) was merged on 30 September 2019 into the general successor
company, the Respondent, as the acquiring company, which terminated the legal personality of the
merging company.
(77) The information on the news portal.hu online news site is effective from 1 October 2019, and last updated
on 1 October 2021.
Point 1 of the Privacy Policy, updated on the 1st of this year, states that the data controller with
regard to the processing of data related to the use of the website www.hírportál.hu is the Applicant
company, i.e. the Applicant. In the imprint of the website, the Applicant is also identified as the
publisher.
(78) The publication of the newspaper articles complained of by the Complainant is in breach of Article 2 of the
General Data Protection Regulation
(1), falls under the General Data Protection Regulation, and consequently the rules of the General
Data Protection Regulation apply to this processing.
(79) Pursuant to paragraphs (69) to (71), the Respondent, as the publisher of the online press products
of the news portal.hu, is the data controller in respect of the processing complained of.
12

IV.3. The personal data at issue
80) Among the textual statements and descriptive information published in the newspaper articles
complained of, which can be linked to the Applicant, the Applicant's role in criminal proceedings, his
statements made there, his qualifications and professional knowledge constitute personal and
special data of the Applicant. However, the Authority considers that the articles complained of
contain a mixture of personal data concerning the Applicant and opinions taken by the Applicant
from other articles, which the Authority has no competence to judge.
(81) The Authority has identified the following personal data concerning the Complainant in the articles
complained about:
- the name of the Applicant, including the search labels of the articles (Article 1, Article 2)
- details of his role in the criminal proceedings (Article 1 "[...] he is being prosecuted for the
death of an infant five years ago and has been heard as a witness in the trial [...]")
- information on her activity as a midwife ("[...] - she did not have a valid licence, she did not
have a ÁNTSZ licence, [...]". Article 2.)
- and the likeness of the Applicant (Article 1). Article 1 has been amended in the meantime,
as a result of which the likeness of the Applicant is not currently included in its contents.
(82) The applicant's name is clearly personal data. The inclusion of the name in the articles complained
about and their search labels without the consent of the data subject or the demonstration of a
compelling legitimate interest justifying publication constitutes unlawful processing.
(83) The fact that the Applicant is a witness in a criminal proceeding is a special category of personal
data in criminal matters within the meaning of Article 3(4) of the Data Protection Act, the disclosure
of which by the Applicant constitutes processing within the scope of the EU Data Protection
Regulation [NAIH Decision No.2868-23/2021].-The qualification of the position of the witness in
Article 1.1 as "for the time being", taking into account the current state of the criminal proceedings
concerning the Applicant at the time of publication of the online article, can be considered as
processing incompatible with the purpose of the publication as stated by the Applicant, namely to
provide credible information to the public.
(84) The Authority has consulted the data sheet of the Applicant in the Register of Health Care Workers
[https://kereso.enkk.hu/index.php], which shows that the Applicant is a qualified midwife: as a health
care worker, she has a valid licence (midwife qualification) from 4 November 2011 to 4 November
2021, and in 2016 she obtained the professional points in the obstetrical care group in both
theoretical and practical areas. Pursuant to Article 26(2) of the Infotv, these data are public data in
the public interest and may be disseminated in accordance with the principle of purpose limitation.
(85) In the present case, dissemination for a specific purpose would have been intrinsically linked to fair
processing, but the Respondent stressed, for the opposite purpose, that the Respondent did not
have the necessary qualifications and licenses to carry out its professional activities.
IV.4. Disclosure of a photograph as personal data
(86) The image originally disclosed in Article 1 depicted the Applicant in the context described in
paragraphs (9) to (10). The Applicant has not indicated to the Authority its intention to amend the
objectionable content and to delete the image of the Applicant. However, the Authority emphasises
that the fact that the complained about image has been deleted does not invalidate the unlawful
processing carried out by the Respondent.
(87) Article 10 of the European Convention on Human Rights also covers the communication of
photographs, i.e. freedom of expression includes the publication of photographs. [Egeland and
Hanseid v. Norway, no.34438/04, judgment of 16 April 2009, Von Hannover v. Germany, no.
59.320/08, judgment of 24 June 2004, Von Hannover v. Germany, no.40.660/08 and 60.641/08,
judgment of 7 February 2012, Von Hannover v. Germany no.8772/10, judgment of 19 September
2013, Verlagsgruppe News GmbH. and Bobi v. Austria, no.59.631/9, judgment of 4 December 2012]
In its judgments, the ECtHR refers in general terms to the aspects to be examined when assessing
an infringement in the case of publication of a photograph without the consent of the person
concerned. These are: the extent to which the communication contributes to the public debate, the
degree of knowledge of the person concerned and the press release's
14
the subject of the communication, the previous conduct of the person concerned, the circumstances
in which the picture was taken (how the information was obtained and the authenticity and
circumstances of its obtaining), the content, form and consequences of the communication. A further
condition is that there must be a link between the article and the image presented, the latter being
linked to the content of the article.
(88) On the basis of paragraph (82), a connection can be established between the imagery of the
contested likeness and the content of Article 1: the Applicant, who is a witness in the criminal
proceedings, is shown as the central person in the photograph, the background is the environment
of the birth outside the institution.
(89) The Authority has carried out a search on the Internet based on the declaration made by the
Respondent in relation to the Image. It was found that the image complained of by the Applicant had
been used by other media outlets without identifying the source:
a. link1 (currently available)
b. link2 (currently available).
(90) However, the Authority refers to ECtHR Decision 931/13, in which the Grand Chamber pointed out
that the mere fact that information is in the public domain does not necessarily exclude it from the
protection of Article 8 of the European Convention on Human Rights (hereinafter "the Convention").
He also stressed that Article 8 of the Convention also includes a form of right to informational self-
determination, whereby individuals may oppose the collection, processing and disclosure of their
data, even if it is neutral and not value-judgmental, but which nevertheless affects their rights to
privacy under Article 8. In the present case, the criterion of "neutral, non-relevant" is not fulfilled
either, and therefore the fact that the photograph taken with the permission of the Applicant for the
original disclosure was previously disclosed with the consent of the Applicant does not render the
processing of the data by the Respondent lawful.
(91) In summary, the Respondent has used the image of the Respondent in Article 1 without the consent
of the Applicant and has thereby infringed Article 6(1)(a) of the General Data Protection Regulation.
IV.5. Legal basis for processing
(92) The web.archiv.org interface of the www.hírportál.hu news site, as of 30 March 2019, contains the
data protection notice of the Data Protection Officer of the Applicant (hereinafter the "Notice")
[https://web.archive.org/hírportál/info-adatvedelmi-tajekoztato], effective as of 22 May 2018. The
Notice identifies the operator of the news portal as the data controller. The scope of the Notice
covered the publication and dissemination of the Applicant's press products, which set out the
following
"data management and protection principles", such as purpose limitation and data minimisation, and
accountability. The Notice lists all the legal grounds for processing under the General Data
Protection Regulation and details the rights of users (data subjects); it imposes a burden of proof in
the exercise of the right to object, by balancing the compelling legitimate interest justifying the
processing against the interests of the data subject. It also regulated the procedure to be followed
by the Respondent in the process of exercising the data subject's rights.
(93) In point 4(b) of the Prospectus, effective from 1 October 2019, the following information relating to
editorial content processing részleteit details
of the editorial content. [https://Kérelmezett/adatvedelmitajekoztato20211001.pdf]]
The purpose of the processing, as stated in the referenced point of the Notice, is: media services,
public information (this includes, for example, the publication of a photograph provided by the Data
Subject in a printed media product or on a website, provided that the Data Subject or, in the case of
a Data Subject under 16 years of age, the Data Subject's legal representative has given his or her
consent). Legal basis for processing: consent; legitimate interest (e.g. in the case of a public figure
or participation in a public event). Legitimate interest: freedom of the press, freedom of expression,
public information. Duration of processing: the content published in printed and digital media
products is archived by the Respondent and deleted only if it is deemed necessary as a result of the
exercise of a right of the Data Subject.
(94) In its statements in the present case, the Respondent, without fully disregarding the foregoing, relies
solely on the Fundamental Law and the Smtv.
15
10 of the General Data Protection Regulation, in no case did it provide a legal basis under Article 6
of the General Data Protection Regulation.
(95) The Authority has consistently taken the view that the legal basis for the processing of data related
to journalistic activities, unless it is voluntary, is the General Data Protection Regulation
legitimate interest within the meaning of Article 6(1)(f). The practice of the authorities in favour of the
application of the legal basis was also confirmed by the Curia in its judgment no. Kfv.
37.978/2021/10. Section 10 of the Smtv. establishes the right of the public to be informed, i.e. their
right to be informed about local, national and European public affairs and events of importance to
the citizens of Hungary and the members of the Hungarian nation, and states that the press is
responsible for providing authentic, prompt and accurate information about such affairs and events.
In that regard, the court stated in the judgment cited that that provision of the Smtv. does not require
the press to perform a task of public interest, and therefore the journalistic activity carried out by it
cannot be classified as a task of public interest or as a public task in the meaning of Hungarian
national law. The court also pointed out that the activity of journalists is linked to the fundamental
right to information and the right to be informed, as laid down in the Fundamental Law. According to
those provisions, the task of the press is necessary and must be protected in order to safeguard the
fundamental constitutional rights protected by the Fundamental Law, and the processing of data
necessary for the performance of that task is therefore indispensable for the press to be able to fulfil
its task as laid down in the Smtv.
(96) In the statements of the respondents in the course of the official procedure, which can be assessed
as a weighing of interests, the Respondent explained that the complained news articles and the
personal data of the Respondent contained therein were published in one of the most widely
publicised and highly relevant public debates of our time in order to form an opinion and inform
public opinion.
(97) The Respondent has identified as a matter of public debate the family tragedies involving the deaths
of infant children and the subsequent prosecutions. It referred to the Applicant's active public and
political role, which it had supported with three press articles, and to the fact that the Applicant's
related midwifery activities had been covered by several media outlets in the recent past. However,
the Respondent did not indicate in its statements to what extent the processing and disclosure of
the Applicant's personal data is necessary to achieve the stated purpose.
(98) According to the consistent practice of the Authority, in the case of the receipt (viewing) of a
newspaper article, the data management activity of the source publisher - thus the fulfilment of its
data protection obligations, the performance of a balancing of interests - has no direct impact on the
data management activity of the subsequent press organisation, nor on its liability as data controller,
since the news item in question must, by virtue of Section 21 (1) of the Smtv, comply with the data
management requirements per se. The media content provider decides independently on the
publication of media content within the framework of the law. It follows, therefore, that if a media
organisation publishes or "adopts" an article containing personal data, it is not exempt from the
obligation to examine individually whether the adopted article or information can be lawfully
published with the same content. [NAIH-2926-8/2021.]
(99) In the Authority's view, both the source and the media outlet are independent data controllers, and
they take their own decisions as data controllers in relation to their data processing activities, and
are therefore also separately liable for those decisions. "[T]he fact that content has been previously
published does not relieve the republishing controller from lawfully carrying out its own processing.
The content provider, in publishing the details of the report through its own media content, is an
independent data controller and the lawfulness of its processing must be assessed independently of
all other data controllers, including the Respondent."[NAIH-68-3/2021.]
(100) The Authority finds that the Respondent has disclosed the personal data of the Applicant
referred to in paragraph 81 of the present Decision without a proper legal basis in the articles
complained of, in breach of Article 6(1) of the General Data Protection Regulation.
IV.6. The legitimate interest of the Respondent, balancing of interests
(101) In the application of the legal basis of legitimate interest, the processing of the data subject's
personal data takes place without the data subject's consent, and it is therefore of guaranteed
importance that the controller carefully maps the impact of the envisaged processing on the data
16
subject's right to informational self-determination.
17
will have an impact, especially on online publicity. The balancing of interests must be carried out
before the envisaged processing and, where the data subject objects to the processing in the
exercise of his or her rights as a data subject, the controller is obliged to respond by carrying out a
further individualised balancing of interests, specifically tailored to the data subject.
(102) The Applicant contacted the Respondent on 15 December 2021 to exercise its right of access and
to object to data processing, with a request for erasure. In her objection to the processing of the
data, the complainant explained that her husband is a politician, but that the central theme of the
articles complained of is that the applicant is responsible for the death of an infant in breach of the
rules of his profession. In addition, the articles allude to his criminal liability and report on the role of
the Applicant in the death. The Applicant has further submitted that the contested data processing
relates to its professional activities, which do not constitute public or political activities, nor
information relating to the Applicant's public role. Information relating to the Applicant's testimony in
a criminal case and his professional qualifications does not constitute a public matter. In the course
of the objection, she pointed out that both her training as a midwife and the tragic deaths occurred
before her spouse's political career. She also pointed out that a final judgment states that the
processing of personal data relating to her professional activities is not necessary for the
performance of the functions of the press, and that the Respondent cannot therefore rely on Article
17(3) of the General Data Protection Regulation as a basis for the deletion of the data complained
of.
(103) In its reply to the letter sent by the Applicant on 10 January 2022 in the exercise of its rights as a
party concerned, the Respondent justified the disclosure of the Applicant's data solely by reference
to legal provisions. In his letter, he stressed his position that the purpose of the publication of the
contested article was to form an opinion in a public debate of high interest and importance, in which,
in his opinion, no unlawful processing of data had taken place.
(104) In the present proceedings, the Respondent has not made any statement regarding the preparation
of the balancing of interests test. From the answers to the Authority's fact-finding questions, the
Authority has at its disposal the Respondent's opinion on the nature and topicality of the public
debate on the articles complained about, as well as the Respondent's public and political
involvement [Statement 4, Statement 5], which enabled the Authority to identify some of the aspects
that the Respondent should have taken into account, among others, in the balancing of interests.
(105) In the mandatory balancing of interests, the Respondent should have taken into account all the
factors influencing the balancing, including, in addition to its own interests, the reasons given in the
Applicant's request for a declaration of interest. A superficial balancing of interests, based on criteria
that can be described as general, which does not take into account the impact of the processing on
privacy, does not comply with the requirements of the General Data Protection Regulation and
results in a violation of the right to object. [NAIH/2020/838/2.]
(106) The definition of a legitimate interest requires that the interest identified is clear, so a broadly
generalised legitimate interest is not acceptable. In the Authority's view, when the press publishes
an article containing personal data, the balancing of interests must also take into account the
specific characteristics of the particular communication and reflect them separately. A general
interest assessment that does not take into account the specific personal data and the specificities
of the processing does not comply with the requirements of the General Data Protection Regulation.
[NAIH-3119-21/2021.]
(107) The Authority's position was confirmed by the Curia in its judgment No.Kfv.III.37.978/2021/10,
according to which in the case of legitimate interest as a legal basis, the controller must always
examine the legitimate interest in the specific situation or activity and whether the processing is
necessary to achieve the purpose. After assessing the interests and expectations and analysing the
impact on the data subjects, it must be determined why the legitimate interest of the controller or
third party is a proportionate restriction on the rights of the data subjects.
(108) In its response to the data subject's request, the Respondent did not specify why its processing of
the Respondent's personal data in the course of informing the public in the context of freedom of
expression would constitute a proportionate restriction of the Respondent's right to informational
self-determination. The Respondent also failed to explain to what extent the processing and
disclosure of the personal data of the Applicant was necessary to achieve the stated purpose
18
in order. It also did not explain what the specific subject of the communications complained of was:
to report on a criminal investigation into the death of an infant in which the spouse of a political
public figure was a witness; or to republish the contents of press articles previously published in
connection with the criminal proceedings.
(109) In light of the Authority's established case law on the protection of personal data, the Authority has
held that the mere fact that the Applicant's personal data have been previously disclosed does not
relieve the data controller from its obligation to carry out an accurate and detailed balancing of
interests in relation to the processing of those personal data. [NAIH- 3119-21/2021.] Thus, the fact
that another media outlet has already disclosed the Applicant's personal data does not relieve the
subsequent Applicant from its duty as data controller.
(110) On the basis of the above, the Authority does not accept the position of the Respondent expressed
in the declarations related to the legal basis and purpose of the processing [Declaration 4,
Declaration 5] as a specific balancing of interests supporting the legitimate interests of the
Respondent, because the Respondent took into account only its own interests and misinterpreted
the notion of public figure and public figure in relation to the Respondent. The Respondent wrongly
concluded that the Applicant became an active public figure by assisting her politician husband
during the campaign period. In this regard, the Respondent found that the Applicant's person and
other activities were also of public interest, which, in its view, justified the timeliness of the reporting
of the matter of public interest in the articles complained of, relating to the infant deaths. In the
present case, the Respondent has not carried out a further balancing of interests, including and
assessing the interests of the Complainant.
(111) The issue of out-of-hospital births is a matter of public interest, the press has addressed the issue
on several occasions, and both pro and con arguments have been raised in the course of public
information. In the Authority's view, the articles complained of and the data processing related to
them were not specifically aimed at generating a public debate on the public issue, at shaping public
opinion, since the articles complained of focused exclusively on the tragedies that had been made
public and, in relation to them, on the statements made by the Applicant in the criminal proceedings,
her professional qualifications and her activities as a midwife. In the Authority's view, it is difficult to
rely on information forming an opinion in a social debate where the content and wording of news
articles imply a one-sided viewpoint to the exclusion of the possibility of individual opinion.
(112) In addition to the above, the Authority considers that the Respondent could not base its processing
of Article 2 on the promotion of the expression of opinion on a matter of high public interest as a
legitimate interest, because in the article at issue the Respondent - despite the fact that the criminal
proceedings had already been concluded and according to Declaration 4 the Respondent was
aware of this - selected its content from previous articles which had not been updated.
(113) On the basis of the above, the Authority concludes that by failing to carry out an adequate
balancing of interests in relation to the processing of the data relating to the contested
articles, at the request of the data subject of the applicant, and by failing to delete the
personal data of the applicant that were unlawfully processed, the respondent has infringed
Article 17 of the General Data Protection Regulation
(1) and (3) and Article 21(1) of the General Data Protection Regulation.
IV.7. The principles of purpose limitation and data economy
(114) The purpose of the data processing by the Respondent was to inform public opinion, by which it
contributed as a press body to the substantive assessment of the public debate of high relevance,
thus contributing to the formation of public opinion. The applicant's professional activities are linked
to the public debate on the issue of home births, which has been and continues to be a subject of
heated debate. The publicity given to the news of tragic home births has kept the issue at the centre
of attention.
(115) With regard to the articles complained about, however, it is clear that the journalist does not present
his pro- and con-arguments in relation to the public issue of home birth, which - as a thought-
provoking
19
would really help to shape public opinion. Nor can the articles be said to cite tragedies as an
argument in favour of the choice of supervised births in hospital.
(116) The articles complained of are exclusively about the Applicant's testimony in criminal proceedings
and the widely publicized family tragedies involving the Applicant's person in the home birth.
(117) It can also be established from the statements of the Respondent that the main purpose of the
public disclosures is to re-disclose previously disclosed information from other sources concerning
the Respondent, who is already known to the public as a witness in criminal proceedings, and to
keep the information disclosed concerning the Respondent in the public domain, with the
consequence that the Respondent's person - and through him the spouse of the public figure - is
cast in a negative light.
(118) The offending articles and the search terms leading to them also name the husband of the politician
in question. Article 2, which was published in August 2021, clearly refers to the current political
situation: the primary election, the first round of which took place on 18 September 2021.
(119) The Authority is consistent in its view that, where there is a genuine public interest in criminal
proceedings, any information provided by a press body in relation to such proceedings must seek to
limit the processing of personal data to the extent necessary and to respect the principle of data
economy, in particular where the information can serve its purpose without disclosing personal data.
This applies in particular to secondary participants in the proceedings (e.g. witnesses, experts) and
is not relevant if the person concerned is a well-known politician and is not a close relative.
(120) Referring to the opinion of the Constitutional Court expressed in its decision 3209/2020 (19.VI.) AB,
according to which
"[p]ublic curiosity and gossip alone do not establish the public interest nature of an issue." it can be
concluded that the Respondent in the present case has failed to convincingly demonstrate the
legitimate purpose of the processing of the personal data disclosed, the need to provide credible
and accurate information and the "public interest" justification.
(121) On the basis of the above, the Authority finds a breach of purpose limitation under Article
5(1)(b) of the General Data Protection Regulation and of data minimisation under Article
5(1)(c) of the General Data Protection Regulation in relation to the articles complained of.
IV.8. The principle of fair processing
(122) The inclusion of the Applicant's personal data in the same article as the named infant deaths
constitutes a (fundamental) breach of the principle of unfair processing.
(123) The articles do not actually contain any explicit journalistic "added value" or opinion, but only
collated content taken from other articles and put into a news article. The focus of the articles
referred to - and hence the contested Article 2 - is not on infant deaths or information about criminal
proceedings, but on the person of the Applicant, which is particularly striking in the case of the "[...]
child".
(124) With reference to the cited Constitutional Court finding, the personal data processed in the articles
under examination had real relevance to the case at the time of the Applicant's testimony in the
criminal proceedings (4 January 2019). In this context, the Authority cites the statement, also
recognised in the case-law of the European Court of Human Rights (hereinafter: ECtHR), that "news
and reports in the press are perishable goods, i.e. any delay in their publication, even for a short
period, may deprive them of their value and the interest that surrounds them (Kablis vs. Russia, no.
48310/16 and 59663/17.91.S), are capable of shaping democratic public opinion, contributing to its
actuality and informing citizens if their communication is timely, i.e. if it is adapted to the actuality of
public life, and not delayed." In comparison, Articles 1 and 2 are currently available to the public with
modified content.
(125) The Authority also considers as unfair the fact that the Respondent named and focused exclusively
on the Respondent in the articles complained about the tragedy, despite the fact that his secondary
role in the criminal proceedings in question was well known and the outcome of the criminal
proceedings establishing the criminal liability of other persons was also known. The fact that the
20
The Respondent continues to provide access to the meanwhile modified content of Articles 1 and 2
on its website, demonstrating that the Respondent does not intend to contribute to the public debate
it has indicated with the content complained of.
(126) The Authority further notes that the Respondent could not base the disclosure of either Article 1 or
Article 2 on the active political activity of the Respondent that it claims to have carried out, as the
news articles relied upon in support of its claim were published only in 2022 and the Respondent did
not rely on any other statement, public event or social media post in this regard. On the basis of the
above, the Authority is of the opinion that the Respondent has committed a breach of Article
5(1)(a) of the General Data Protection Regulation in relation to the articles complained of.
IV.9. The principle of transparent processing
(127) The transparency requirement is intrinsically linked to lawful data management. Chapter III of the
General Data Protection Regulation clearly sets out the expectation that the process and
documentation of data processing should be made known to the outside world, but most of all to the
data subject. The principle of transparency therefore presupposes communication between the
controller and the data subject, so that the data subject is aware of the essential elements of the
processing concerning him or her. The data controller must therefore make compliance with data
protection rules part of his general practice and must ensure that all his processing activities comply
with data protection standards.
(128) The Respondent is in possession of the detailed privacy notice described in paragraphs (92) to (93),
but the clarification of the facts revealed that it either negligently failed to know its content or
deliberately disregarded it.
(129) The Authority also considers that the date of publication of the news articles published by the
Respondent is difficult to determine, as the Respondent did not indicate the exact date of publication
or the author of the articles on its news area. The Authority was only able to identify the year and
month of publication of the articles (Article 1: 25 February 2019, Article 2: 10 August 2021) from the
path of the articles, in addition to the Applicant's statement. The infringing situation is still present
with modified content from the date of publication of the articles.
(130) On the basis of the above, in the present case, the Authority finds that the data processing by the
Respondent in relation to the disclosure of Article 1 and Article 2 infringed Article 5(2) of the
General Data Protection Regulation.
IV.10. Enforcement of the rights of persons concerned
(131) In several cases, the Authority requested a statement from the Respondent on how the Respondent
ensured the exercise of the data subject's rights in relation to the processing at issue. The
Respondent has not provided any statement on these issues, and therefore only the request for
erasure and the Respondent's reply to it, as submitted by the Respondent, are available to the
Authority.
(132) The Applicant has submitted a request for erasure to the Respondent in order to exercise its right of
access and to object to data processing. The Applicant specified the contact details of the articles
complained about and requested that the Respondent grant the Applicant's right of access; uphold
its objection and cease the processing and delete the Applicant's personal data. In connection with
its objection, the Applicant also referred to and attached the judgment of the Metropolitan Court of
Appeal No 2.Pf.20.757/2020/6, which found that the Applicant's reputation had been infringed. The
Applicant requested the erasure of its personal data relating to its professional activities on the basis
of Article 17(1)(c) and (d) of the General Data Protection Regulation.
(133) The Respondent has formally complied with its obligation to inform the data subject of the request
by responding to the Applicant's request within 30 days. However, in its reply, the Respondent did
not provide information on the legal basis, duration and source of the personal data it processes in
relation to the Applicant. Nor did the Respondent, despite the explicit request of the Applicant,
provide information on how it complied with the general
21
the balancing of interests under Article 14(2)(b) of the GDPR. In this way, in the exercise of the data
subject's rights, the Respondent did not ensure the right of the Respondent to be informed of the
processing of his personal data by the Respondent and thus of the compliance of the processing
with the principles of the General Data Protection Regulation (transparency). The Respondent also
sought in his data subject request to know the data concerning him which the Respondent processed
but did not disclose in any of the articles complained about (Article 15(3) of the General Data
Protection Regulation). The Respondent did not respond to the Respondent's request, but stated in
a declaration [Declaration 2] made in the present Authority proceedings in response to the
Authority's request that it does not process any personal data relating to the Respondent other than
the personal data used in the articles complained about.
(134) According to Article 21(1) of the GDPR, the data subject may object to the processing of his or her
personal data at any time on grounds relating to his or her particular situation and in such a case the
controller is in fact obliged to repeat, but now in a more specific form, the balancing of interests test,
which allows him or her to demonstrate that the legitimate interests of the data subject prevail over
the rights and interests of the data subject. The applicant objected to the contested processing in its
application as a data subject. As grounds relating to its own situation, the Applicant submitted that
the contested articles undermine its professional integrity, call into question its qualifications and
make its operations more difficult. These reasons are clearly related to the applicant's own situation,
work and professional activities and there is no question that the articles have had a negative impact
on the applicant's professional image.
(135) In the present case, in the course of the clarification of the facts, the Respondent responded to the
Applicant's request for access and erasure with regard to the exercise of the data subject's rights,
but did not comply with the Applicant's request for access and erasure as indicated in the data
subject's request, or did not analyse and justify in detail its processing based on legitimate interest,
taking into account the interests of the Applicant. The Authority also notes that in the present
procedure, the Respondent has ignored and failed to respond to the questions on how to ensure the
rights of data subjects [NAIH-2809-2/2022, NAIH-2809-4/2022].
(136) On the basis of the above, the Authority finds that there has been an infringement of the data
subject's rights under Articles 14(2) and 15(1) and (3) of the General Data Protection
Regulation in relation to the processing of the data in the complained articles.
IV.11. Request for the imposition of a fine
(137) The application of the legal consequence of the data protection fine does not directly affect the right
or legitimate interest of the Applicant, such decision of the Authority does not create any right or
obligation for the Applicant, therefore, with regard to the application of this legal consequence -
which falls within the scope of the enforcement of the public interest - the Applicant does not qualify
as a customer pursuant to Section 10 (1) of the General Civil Code, and since it does not comply
with Section 35 (1) of the General Civil Code, there is no place for the submission of an application
in this regard, these parts of the submission cannot be interpreted as an application.
V. Legal consequences
(138) The Authority has found against the Respondent under Article 58(1)(b) of the General Data
Protection Regulation for having committed the data protection breach.
(139) The Authority has examined ex officio whether a data protection fine is justified for the Applicant's
infringement. In this context, the Authority has, on the basis of Article 83(2) of the GDPR and Article
75/A of the Info Act, considered ex officio all the circumstances of the case and concluded that, in
the case of the infringements found in the present procedure, a warning is neither proportionate nor
a dissuasive sanction and that a fine is therefore necessary.
(140) The Authority has found serious breaches of principle in relation to the data processing carried out
by the Respondent in relation to the articles complained of.
V.1. Imposition of a data protection fine
22
(141) In imposing the fine, the Authority took the following factors into account as aggravating circumstances:
I. The news articles containing the personal and public personal data of the Applicant have
been continuously available in the online space since their publication [Article 1, 25 February
2019 and Article 2, 10 August 2021] and are currently available with modified content.
[Article 83(2)(a)]
II. The Respondent has also confirmed in its declarations that its processing was intentional.
Despite the fact that the Respondent claimed to have been aware of the judicial press
release concerning the criminal proceedings concerned, it did not disclose the actual data
concerning the Respondent in its post-release communication (Article 2). In both articles
complained of, the Respondent referred to specific cases as public issues, to which it directly
and indirectly linked the Respondent and its professional activities. The Respondent only
focused on the tragic cases and the details of the criminal proceedings concerning the
Respondent in the articles, and the issue of out-of-hospital childbirth is not even mentioned
in the articles. [Article 83(2)(b)]
III. In 2022, the Authority has already investigated the data processing of the Respondent in the
context of a data protection authority procedure [NAIH-3797/2022], in which it found unlawful
processing of the personal data complained about and ordered the Respondent to pay a
data protection fine. [Article 83(2)(e)]
(142) In imposing the fine, the Authority took the following factors into account as mitigating circumstances:
I. The Respondent has amended the content of both articles complained of: in Article 1, it has
deleted the offending likeness of the Applicant, and in the text inserted before the content of
Article 2, it has acknowledged that the content of Article 2.-and, without a proper legal basis
and without a compelling legitimate interest, in breach of the principles of fair processing,
purpose limitation and accuracy, processed personal data and the image of the applicant
relating to his professional activities, his professional knowledge and his testimony as a
witness in criminal proceedings.
(143) In determining the amount of the fine, the Authority first of all took into account that the
infringements found constitute a higher category of fines under Article 83(5)(a) of the General Data
Protection Regulation, on the basis of which the maximum fine is set at 20.000.000 or, for
undertakings, up to 4 % of the total annual worldwide turnover of the preceding financial year,
whichever is the higher. The Respondent is a group of companies operating as a media company,
with one controlling shareholder with a controlling shareholding and a controlling influence, as
recorded in the companies register. The net sales revenue of the Respondent was HUF
47,790,082,000 according to the latest available data for the year 2021.
(144) In view of the gravity of the infringements found, the Authority took into account the maximum fine
set out in the General Data Protection Regulation and the 2021 consolidated balance sheet of the
Respondent in determining the amount of the fine.
V.2. Restrictions on access to personal data
(145) In point III(b) of the operative part, the Authority ordered the immediate deletion of the personal data
specified in point I of the operative part from Article 1 and Article 2 as a legal consequence of the
expiry of the time limit for bringing an action against the present decision or, in the case of
administrative proceedings, after the court decision has become final, because the processing of the
personal data complained of was carried out by the Respondent without a proper legal basis and in
breach of the data processing principles laid down in the General Data Protection Regulation.
(146) In point III. c) of the operative part of the present Decision, the Authority temporarily restricted
access to personal data concerning the Applicant disclosed in the complained articles as a
provisional measure pursuant to Article 58(2)(f) of the General Data Protection Regulation until the
present Decision becomes final, as the disclosure of the complained personal data would continue
to cause prejudice to the Applicant.
23
(147) On the basis of the above, the Authority has decided as set out in the operative part of the decision.
VI. Other issues
(148) The competence of the Authority is defined in Paragraphs (2) and (2a) of Article 38 of the Infot Act,
and its competence extends to the whole territory of the country.
(149) The decision is based on §§ 80-81 of the Ákr. and § 61(1) of the Infotv. The decision is based on § 82 of
the Ákr.
(1) shall become final upon its notification.
(150) The rules of administrative proceedings are set out in Act I of 2017 on the Code of Administrative
Procedure (hereinafter referred to as the "Code"). The Kp. Pursuant to Section 12(1) of the
Administrative Procedure Act, administrative proceedings against a decision of the Authority fall
within the jurisdiction of the courts. Article 13(3)(a)(aa), the Metropolitan Court of Budapest shall
have exclusive jurisdiction. Pursuant to Section 27(1)(a) of the Kp.
b), legal representation is mandatory in proceedings within the jurisdiction of the Tribunal. In
accordance with the provisions of Art. According to Article 39(6), the filing of a statement of claim
does not have suspensory effect on the effectiveness of the administrative act.
(151) The Kp. (6) of the Hungarian Civil Procedure Code, if, in the case of a statutorily permissible
multiplicity of actions, part of the claims should be decided according to the simplified procedure
and the other part according to the general rules, the court shall proceed according to the general
rules.
(152) Pursuant to Article 29 (1) of the Hungarian Civil Code and in view of this, the Hungarian Civil Code.
Section 604 of the Act CCXXII of 2015 on the General Rules of Electronic Administration and Trust
Services (hereinafter: E-Administration Act), applicable pursuant to Section 9 (1) b) of the Act, the
legal representative of the client is obliged to maintain electronic communication.
(153) The time and place for lodging the application shall be determined by the Kp. Article 39(1).
(154) The amount of the fee for administrative proceedings is determined by Section 45/A (1) of Act XCIII
of 1990 on Fees (hereinafter: Itv.). Exemption from the advance payment of the fee is provided for
in the provisions of the Act. Article 59(1) and Article 62(1)(h) of the Act exempts the party initiating
the proceedings from the payment of the fee.
Date: Budapest, by electronic signature
Dr. habil Attila Péterfalvi
President, c. Professor
Retrieved from "https://gdprhub.eu/index.php?title=NAIH_(Hungary)_-_NAIH-3977-4/2023&oldid=41455"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki