Human Rights Watch has published a politically highly biased report on the state of personal data protection in Hungary

However, contrary to the claims of the NGO’s report, the legal protection of  these rights has been even stronger in Hungary since 2010, and the National Authority for Data Protection and Freedom of Information (NAIH) is performing its task well in terms of effective data protection. In Hungary, the possibility of fair access to the media is also ensured, and the Hungarian legislator endeavors to ensure the transparency of campaign revenues and expenditures more and more effectively. Furthermore, the National Election Commission and the State Audit Office also act as independent bodies, contributing in an appropriate way to the democratic control of public power.

The Hungarian regulation seeks to enforce rigour in a modern way on the content appearing on social media that is also political advertising in nature, in connection with which legal requirements must be enforced during the campaign period.

The thrust of the report is in line with the rule of law attacks against Hungary

One of the tenets of the report is that the European Union has been restrained for too long in terms of “Hungary backsliding from the rule of law”, the EU has refused to take note of the “systemic erosion” of democratic institutions and human rights, or speak out against it. Therefore, according to the  document, the EU urgently needs to assess whether the use of personal data collected by the Hungarian government for political campaign purposes is in line with EU law. In particular, the EU must ensure, the report says, that EU funds allocated to support the digitalisation of public services in Hungary do not violate the EU general data protection regulation and other EU legislation. The European Commission shall also initiate infringement proceedings against Hungary for violating EU law.

The main platforms, including Facebook  – which the report describes as the most widely used platform for online political advertising in Hungary – “provided a degree of transparency in campaign spending” by providing limited insight into spending on political advertising with their ad libraries. However, many of the platforms’ methods, which enable parties in Hungary to target political ads are inherently opaque, according to the report. Thus, it is not clear, Human Rights Watch writes, whether the targeting of users in online political ads was discriminatory or excluded someone by relying, directly or indirectly, on confidential data.

Data  sharing and profiling in relation  to the targeting of advertisements also raises increased data protection concerns in general, although, in addition to regulating data protection at EU level, we should add to the relevant findings of the report that this is not basically the responsibility of nation-state legislation.

The report specifically “focuses” on Hungary’s political situation during the 2022 election campaings, where it identifies concerns about the incrased dependence on data and increasing digitalisation of public services during election campaigns.

Human Rights Watch states “the effective control over most of the media” by Fidesz and “the undermining of the independence of the judiciary and public institutions” as a fact, and also highlights the curbing of civil society efforts. With this, the authors of this document have joined the long list of those who in recent years have addressed Hungary with professional (although often more political) statements of criticism of the rule of law. However, according to the 85-page report, “the abuse of people’s personal data — which helped the party reach voters through new, opaque paths — has been the subject of relatively little investigation.” However, the report was unable to substantiate these blunt statements on the basis of sufficiently systematic knowledge and related convincing arguments, included in an appropriate professional unit.

The protection of personal data has been strengthened in Hungary since 2010

According to the report, it is necessary to ensure that the legal and institutional framework, including  Act XXXVI of 2013 on the Electoral Procedure and the administrative  and judicial bodies that supervise it,  clearly prohibit the abuse of administrative resources, including personal data collected from citizens, in order to ensure a level playing field in election campaigns.

Furthermore, it is necessary to ensure that personal data collected by government bodies and institutions in Hungary comply with data protection regulations, bearing in mind the principle of purpose limitation and delete personal data collected without proper purpose limitation, together with data that poses a risk of reuse for the purposes of any political  campaign.

The report’s claims are grossly exaggerated, as the protection of personal data by the authorities in Hungary is adequately ensured, and after 2010 significant legislative steps were taken to strengthen the protection of the authorities. For example, NAIH, as an independent administrative body with authority, has been given the competences of the former  Data Protection Commissioner, and its powers have been  broadened with other important rights (e.g.  the  right to impose fines). The protection of personal data is still regulated by Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Privacy Act), and  domestic legislation  has been  amended on the necessary points following the  introduction of the General Data Protection Regulation  (Regulation 2016/679 of the European Parliament and of the Council, GDPR). It should be emphasised that the domestic Privacy Act contained epoch-making provisions even at the time of its creation, given that it included the results of research carried out during the multi-year legislative preparation of the GDPR and the new legal institutions thereof in the Hungarian legal provisions effective as of 2012.

Human Rights Watch report calls for extending the powers of the National Election Commission to determine whether a possible  violation of Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information leads to a violation of electoral principles.

According to the legislation, NEC initiates the decision of the competent body in the event of a violation of the law. NEC also decides on objections to the participation of media service providers and the press and cinemas in election campaigns, and on the determination of the duration of the publication of the political advertisements of those entitled to it in the linear media service of the public service media provider. It also decides on all objections that do not fall within the competence of the parliamentary single-member constituency election commission or the territorial election commission (and where  the place of the offence cannot be determined). NEC issues guidelines to election bodies to ensure the uniform interpretation of the legislation related to elections and referendums. In this way, the National Election Commission, as an authority designed to ensure the fairness of elections, is able to contribute to the effective democratic control of public power during the election and campaign periods, to the transparency of public institutions, thus helping to enforce electoral principles.

NAIH is able to adequately fulfill the role of an independent supervisory authority

The NGO’s report  recommends that the National Authority for Data Protection and Freedom of Information (NAIH) be adequately resourced  and  fully independent in order to be able to enforce the relevant legislation on political parties and candidates, without prejudice to the aforementioned  EU General Data Protection Regulation (GDPR) and Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information.

In addition, Human Rights Watch writes that the European Commission  should  initiate infringement proceedings against Hungary over the NAIH, because, in its view, it does not meet the requirements for independent supervisory authorities provided for in Chapter VI of the General Data Protection Regulation. The very fact that it proposes an infringement procedure shows the strong political charge of the report, as well as the fact that the NGO that drafted the report is an ideliologically committed organization and cannot be considered independent at all. Behind the arguments that appear to be legal, Human Rights Watch, which supports neoliberal principles, typically uses fundamental rights issues in its proposals and arguments out of political motivation.

Under the current Hungarian legislation, the NAIH is an autonomous state administration organ with independent legal personality, which, as an independent organ does not have a superior body, may not be instructed, and operates independently from both an organizational and financial point of view. It is an authority that is independent from other authorities, i.e., separate and not connected to others, so that the autonomy of the NAIH is not affected or influenced by other official organizations that also have powers. It publishes a report on its activities by 31 March each year and submits its own official report to the National Assembly. Anyone can initiate an investigation with the authority, either after the infringement has occurred or if there is only a risk of it. Within two months of the notification, the authority shall make a decision and notify the notifier thereof. If it is found to be unfounded, it closes the procedure. If it is justified, it initiates an official data protection procedure or takes other measuers.

In order to effectively and efficiently perform the supervisory authority tasks under the General Data Protection Regulation, the NAIH operates a permanent working group (GDPR working group) within the authority, whose task is to discuss matters of principle and practice arising from the application of the GDPR and to solve emerging data protection problems or make proposals related thereto to the President.

State Audit Office: a truly independent body contrary to the report’s allegations

According to the Human Rights Watch report, it is also necessary to ensure that political parties and candidates for political office – regardless of political ideology – are provided with adequate and equal conditions, in particular as regards to funding, access to resources, and the exercise of freedoms. According to the report, this also includes fair access to the media, and in this regard, it calls greater transparency in campaign revenues and expenditures, as well as greater independence of the National Election Commission and the State Audit Office, a key.

In particular, it recommends that the State Audit Office be reformed to ensure its own independence and strengthen transparency in the campaign spending of political parties and candidates, including online political advertising.

In Hungary, contrary to the claims and suggestions of the report, diverse and objective information is adequately provided in the media as a whole – even if a balanced approach is not necessarily provided by individual media outlets in all cases. Furthermore, opposition  opinions may appear in the public media, and there is no mandatory requirement – or expected practice – for only one type of public narrative to be displayed in public service news and opinion programs.

Regarding the State Audit Office, the organization is independent of all other organizations in its audit activities. It carries out the monitoring of the management of public funds and state and municipal assets with general authority, and also carries out continuous and scheduled monitoring of the management of parties and party foundations receiving funds from public finances. It enjoys the authority of the respective National Assembly and is a controlling body empowered by law. The performance of the tasks of the SAO is well compatible with its own autonomy, rights and responsibilities, and with its official behaviour that has always been demonstrated in the light of reasonableness. In conveying its audit results and values, the SAO implements primary, measured and easy-to-understand communication, and its reports are fully public and accessible to anyone. Finally, it should be pointed out that the SAO has developed its professional rules on audit by itself, taking into account the international standards of audit institutions with such power.

Strict Hungarian regulations: in the case of political advertising content on social media, the legal requirements must be enforced during the campaign period

According to the Human Rights Watch, for better transparency, campaign spending on online political advertising should be included in campaign finance spending limits, for example. It says that Act XXXVI of 2013 on electoral procedure should be amended in order to ensure that any advertising activity aimed at influencing voter behavious or the formation of public opinion around elections is classified as political advertising, including online political advertisements. Political parties should also report on their expenditure on online political advertisements and  the SAO should be obliged to take into account the information on publicly available advertising information published by online platforms when monitoring campaign expenditures.

The regulations in force in Hungary can be said to be sufficiently strict with regard to online campaign activities (appearing on social media platforms), even if political edvertising content on social media does not qualify as political advertising under Act XXXVI of 2013 on Electoral Procedure (since their appearance surface can only be a press product or a cinema), and social media platforms are not included in the concept of press products under Act CLXXXV of 2010 on Media Services and Mass Communication. However, according to domestic regulations, their use during the campaign period is considered a campaign activity, as they are capable of influencing or attempting to influence the will of the electorate.

Act LXXXVII of 2013 on the Transparency of Campaign Costs related to the Election of the Members of the National Assembly sets a limit of HUF 5 million on expenditures related to election campaign activities during the campaign period. With regard to the consideration paid for content on social media, individual candidates and nominating organizations using this form of campaign activity therefore have an increased responsibility for preserving the fairness of the elections in terms of compliance with the HUF 5 million budget.

Political bias and insufficient methodological transparency

The political motivation of the report is supported by the fact that it contains a written criticism, the expression of which is usually accompanied by a feeling of hostility and antipathy in connection with the statements and proposals that disapprove of Hungary. The document also proposes against Hungary that the European Commission should assess whether EU funds spent on the digitalisation of Hungarian public services might have resulted in a violation of EU law, including Articles 5, 6, 7 and 9 of the General Data Protection Regulation.

It shows a political bias, perhaps in line with the expectations of the financiers and sponsors behind the NGO, that it recommends the action of the EU institutions. For example, according to the report, EU Member States “should immediately proceed with the Article 7 procedure regarding Hungary, it should be established, inter alia, by adopting specificrule of law  recommendations and by voting that there is a clear risk of serious violation of the values protected by the EU Treaty”.

The issue of political bias may be related to the fact that the report is also problematic in methodological terms. In this connection, the phenomenon of preconception is also worth mentioning, i.e., in such “research”, ideas that were previously thought to be true without substantive information and without conducting investigations with a truly objective intent; a preconceived opinion which, as it is fundamentally political and not legal-professional, has not been examined. There is already a historical example of this, which became famous as the Sargentini Report.

Based on the methodology described in the HRW report, it was prepared  on the basis of research conducted between November 2021 and August 2022 and documents how the data-driven political campaign in Hungary contributed  to “an  already unequal playing field by giving the ruling party an undue advantage and how it undermined the right to privacy and other rights” in the context of the elections of 3 April 2022. This report was thus prepared “with a  combination of office research, interviews with experts and individuals affected by abuse,  and technical analysis”, and court and data protection authority decisions, reports by human rights organizations and legal aid providers, materials of election observers, and scientific articles and media reports were used to support the findings contained therein. At the same time, the report itself does not even seek to define for the reader the objective scientific criteria for the evaluation in a way that clearly presents the professional explanation, the objective essence of the most important findings, but merely to imply and suggest inherently vague statements of fact.

In such a research task, the guiding research methods that are perhaps not even consciously applied give rise to a weak scientific character and results in the given report, even if the methods of collecting the data required for such research tasks can vary greatly from one researcher to another. However, in the case of the seemingly professional report of the Human Rights Watch, there is reason to believe that the real aim was not to make findings and suggestions in an objective and professional work on the subject of the current state of data protection in Hungary but, as the lines reveal, to keep Hungary in check – with reference to the violation of the basic principles of the rule of law – on the basis of the advice of NGOs, especially considering that the protection of the personal data of European citizens is not a Member State but a European Union competence, the exercise of which was amply justified by the EU-US “Privacy Shield” agreement, which was invalidated by the Court of Justice of the European Union after the entry into force of the GDPR.