- 110/111 -
There was a special aspect of development of data protection and privacy policy in the early 1990s. On the one hand there was no basis for this (law)area in the rules and practice, on the other hand the legislator had to produce new institutions of democracy.[1] At first the new and democratic Parliament had to declare the principles of human rights, civil and political liberties, despite the fact that legal continuity between socialism and the new democratic legal system was disclosed by the decision of the new Parliament. This meant that the socialist acts had not been overruled, but were kept enforced and were changed step by step. The deficit of data protection and privacy policy was caused by the fact that the primacy of human rights and the importance of privacy had not been accepted by the socialist legal order. In addition, to keep the legal continuity (between socialism and the transition to a democratic system) the legislator had to pass into law a few new acts (about data protection and privacy policy) and modify the old act (e.g. Civil Code), and the importance of data protection and privacy policy became more and more important as information technology developed in the 1990s. We can observe three effects of the establishment and development of data protection and privacy policy in Hungary. Additionally, the new offices (especially the Constitutional Court of Hungary, and the Ombudsman) had not enough experience and practice about this area, keeping in mind that Hungary would be member of the European Union in the immediate future.[2] The legislator had to be attentive to the directives and legal practice of the European Union. There was another problem: the hiatus of knowledge and practice of new institutions concerning privacy policy. This area was considered unnecessary and therefore did not exist in the socialist law; it caused the deficit of acts, decisions and judgements about data protection and privacy policy. The courts and other offices had to start to create the real content of these by new acts without adequate theoretical and practical history and basis. The only source being the European Union's point of view on this matter.
At first I will show the development of this (law) area and acts in Hungary. Secondly I will present the new direction of data protection and privacy policy according to the specifically new Civil Code and judgements of courts of the European Union. Finally, will I try to analyse the reason and consequence of contradictory decisions handed down in connection with a concrete incident.
- 111/112 -
I would like to show the development of the system of data protection and privacy policy from the early 1990s to the present in Hungary. It was very interesting because the new tendencies caused difficulties in dealing with cases in all law areas (e.g. labour law, civil law, compensation for non-material damages and injury cases). We could see the effect of legislation to practice and the practice to acts. The outcomes of several litigations and legal disputes were not too satisfactory because courts had not enough experience to the area of privacy policy, so lots of defendants and plaintiffs went to superior courts (High Court of Justice) and the Constitutional Court of Hungary. The first in this line was Act LXIII. 1992 on protection of personal data and publicity of data of public interest[3] which tried to subsume the privacy policy and data protection. This aspiration was not too successful, because the proportions being enormous, it was not possible to rule it within one act. On the other hand, it had effect on another law area, i.e. the civil law in particular. But in fact, the Civil Code did not contain the solutions to problems of data protection and privacy policy despite the fact that the courts had to implement the Civil Code in most cases. They had to try to use the old legal institution, the compensation for non-material damage. The claim to create new solutions and institutions were caused by the development of this field and the effect of the principles of the European Union. Firstly, when realizing that the old point of view, better to say thinking regulated all parts of this area, the legislator enacted new acts on several fields of data protection and privacy policy. Secondarily, step by step new acts entered into force instead of old judgements and this process accelerated as the entry to the European Union approached. There were significant examples of these, in respect to various fields of law: defence of health data,[4] contract on defence of the person.[5] We must not forget lots of acts, which modified the rules of a field of law.
After Hungary entered the European Union, the development of the area of public person accelerated. This had two reasons. First, there were the obligations of the European Union; second, the institutions, offices and courts were able to gain adequate knowledge and practice about this field of law and they could refer to the directions and decisions of the European Court of Human Rights.
The most significant change was the new act on privacy policy[6] and the rules of a new Civil Code[7] about the consequences in case of privacy violation, particularly in opposition with more lenient provisions of old acts.
- 112/113 -
Other fields of private security and data protection were realized by the practice and direction of the European Union. The legislative thinking changed and developed, so the will of the legislator was able to give adequate answers to acute questions of practice. On one hand, the legal term and jurisprudence were developed by the effects required by practice, on the other hand the system of data protection and privacy policy became relevant and modern, containing relevant European Union regulations in the field of law in Hungary. We can conclude that the relationship between legal theory and practice in Hungary were beneficial for each other.
Formation of numerous acts[8] took place as a result of the cooperation of legal practice and theory.
Recently, the principles and requirements of data protection have started to predominate in the field of administration in Hungary. They are regulated by a new act.[9]
This law is very interesting, because it contains some new obligations for offices; it is responsible for the appointment of personnel for electronic information system security, for the issue of information security policy (regulation), for ensuring the training of employees (i.e. civil servants) for the knowledge of information system security duties and responsibilities, systematic risk assessment and the control of compliances with laws and risks.[10]
This act governs the new national authorities which are responsible for the inspection of security of electronic information systems.[11] This authority must supervise the offices, and if one of them does not comply with the obligations or rules of the procedure, they must call on them to do it, then they must appeal to the information security inspector, commissioned by the Minister (who is responsible for the e-government).[12]
We can see the continuous and fast development of the field of data protection and privacy policy in the administration, as well. Similar developments can be observed in the field of the labour law, the special rules concerning professional persons (policemen and fire fighters),[13] particularly.
- 113/114 -
In spite of the fact that the rules and law and the legal practice are coherent and adequate and they correspond to the rules of the European Union, there are some questions - in the area of data protection - raised by practice. These are minor problems, but if we examine their results and effects on the national economy (i.e. on the budget of Hungary), we come to realize that, on one hand these cases are significant and on the other hand suitable for the development of legal practice and theory of data protection and privacy policy. One of them is the question of the use of photographs, taken of professional staff at work. These photos can be used by the media without the consent of the subjects of (persons in) the photos according to one point of view, but according to the other viewpoint, these photos can only be used if the people (appearing on them) consent to it. The relevance of this problem is partly caused by the change of acts, because with the new acts, there would be more sanctions now than in the past in the case of violation of personal rights (the use of photos means a violation of the right of personal data). The violation fee is the new sanction, which is to be paid by the violator.
I would like to show the development of Hungarian data protection and privacy policy by the analysis of the above case. First, I analyse the rules of the old Civil Code, then the new sanctions of the new Civil Code parallel with the old and new information acts. Secondly, I mention the uniformity decision of the Curia, then the decision of the Constitutional Court of Hungary, which eliminated the uniformity decision of the Curia. Thirdly, I show the new uniformity decision of the Curia. Finally, I analyse a rule of the Appeal Court, which opposes the point of view of the Constitutional Court of Hungary.
These acts had not contained the detailed rules of privacy policy and data protection about the use of photos of professional people who participated in an intervention. The courts had to make decisions based on underlying principles; this problem was solved by the practice of law. But this problem did not arise among the judges, only the Informational Ombudsman had to deal with the questions of personal data of civil servants in the light of petitions about the financial position of public figures. The main question was the following: Should they be regarded as civil servants in their public operations, like politicians are? If the answer is yes, the salary of civil servants is knowable to everybody, if not, it is not knowable. By both the old Civil Code and Act LXIII. 1992 on protection of personal data and publicity of data of public interest, the civil servants were not qualified as public
- 114/115 -
persons. This viewpoint gradually changed over time, because lots of law philosophers thought that all civil servants were qualified as public people when working. But this appeared only in the old acts.
On the other hand, the general rules enabled the vindication of compensation in the case of violation of data protection and privacy policy by the old Civil Code based on the old informational Act.
There was one way of compensation in the old Civil Code of Hungary, and that was the non-pecuniary damages. If the privacy of a person was violated, he could require non-pecuniary damages from the contravener. The problem of this system was the following: the insulted person had to prove the damage and the extent of it. The fact of the violation of privacy policy was not enough to validate the non-pecuniary damages. This meant that the data protection and privacy policy were not affirmed as a value per se. Furthermore, the violation of the privacy policy and personal data did not mean damage and did not eventuate in compensation per se.
We can see that all three main acts have changed, which has determined the question of privacy protection of public people.
At first, we have to write about the main basis of privacy policy, the rules of the Fundamental Law of Hungary.[15] The right of personal data protection and the right to cognition of data of public interest are authenticated[16] by this act; and the emergence of the law of personal data protection and cognition of data of public persons are ensured by the Hungarian National Authority for Data Protection and Freedom of Information.[17] Secondarily, other rules about privacy policy have entered into force, so the system of data protection of the new Civil Code has gradually built the basis of the main acts in this area. The new Civil Code partly contains the principles about privacy policy, the sources of these rules are in these acts cumulatively.
The new Civil Code regulates the protection of individual rights on two levels. One of them is the enumeration of individual rights, though it is not complete, only illustrative.[18] One form of violation of the individual right is the violation of the right to privacy and the protection of personal data. The other is the exact regulation of the consequences of their violation.[19]
According to the legislator, the consequences of the violation of the individual rights in the Civil Code show the importance of this area. On the other hand, a new legal instrument
- 115/116 -
is instituted by the Civil Code. This is the violation paid.[20] Instead of the rules of the old Civil Code of Hungary, according to the violation paid, the damnification of personal rights means damage per se, and the contravener has to pay due to the action itself. "The violation paid is an indirect consideration of damnification of personal rights to property in satisfaction and private legal punishment at the same time".[21]
The new system of data protection and privacy policy is very interesting, because it is partly based on the old system. The legal continuity is guaranteed, because in the case of damnification of privacy policy, the injured person can require violation paid, and then if he has damage to property by the damnification of privacy policy, the injured person can demand non-pecuniary damages.
The new Civil Code of Hungary and Act CXII. 2011 on the right to informational self-determination and freedom of information contains the options of injured people. The main elements of the system of data protection and privacy policy are determined by these acts.
The act on the right to informational self-determination and freedom of information[22] provides the following options to those harmed: protest against personal data management, turning directly to the court to ask for the stopping of infringement; restore the original state, turning directly to the Hungarian National Authority for Data Protection and Freedom of Information to ask for the data protection authority procedures. Anybody can initiate the procedure of the Authority for free, due to a violation (or imminent danger of violation) of personal data, or the right to the knowledge of public interest items. The Authority has the right to inspect documents, enter rooms; anyone may request information orally and in written form, and initiate the procedure.[23] Depending on the result of the procedure, the Authority can do the following: call to remedy the injury or eliminate it, make recommendations to the supervisor of the offending organ and to perform an official data protection procedure.[24] Finally, the Authority is able to bring about an action to follow the procedure of writ of the Authority.[25]
The main possibilities of victims, provided by the new Civil Code of Hungary, are the violation paid and the non-pecuniary damages. There is a new element in the privacy policy which I consider very important - a special rule of the procedure of the prosecution. In case of violation of individual laws, which are contrary to public interest, the prosecutor is able to enter into action with the victim's consent.[26]
- 116/117 -
Parallel with the rules of the Civil Code, the Criminal Code of Hungary[27] contains many elements of personal data protection. For example, it specifies the misuse of personal and public data.[28]
Eventually, Act CXII. 2011 on informational self-determination and freedom of information brought about changes in the question of the use of photos of performing professional service personnel. Policemen started to argue that their photos (on which they were recognizable, taken while in action) were not publishable in the news. As they did not qualify as public persons while in action, (since there was the law of personal data), their portraits counted as personal data, which were protected by acts. At first, the Curia of Hungary made a uniformity decision, and then another decision was made by the Constitutional Court of Hungary contradicting the previous one. What were the results of these conflicting decisions?
All courts must follow the uniformity decisions of the Curia of Hungary.[30] The Curia's principle has caused some interesting actions. Along this, "The persons who work in public service at public places are not public actors while performing these activities, therefore the images or audio recordings taken of them (suitable for identification), may not be disclosed without their consent."[31] A lot of policemen started to demand the compensation of violation paid, if they portraits - taken during action - were recognizable. The courts had to comply with the application of the uniformity decision of the Curia.
The courts started to inflict injury fees in their judgements along this uniformity decision of the Curia. It meant a deficit of budget to Hungary, because the law enforcement authorities are financed by the state.
One of the judgements of the Appeal Court of the Capital has been eliminated by this decision of the Constitutional Court. By this judgement[33] the portraits of policemen, who acted at political events could not be disclosed, and this principle was violated by the news portals. According to this judgement, the policemen's demand of violation paid was legitimate. This judgement was challenged by a constitutional complaint of the news portal.
- 117/118 -
The Constitutional Court of Hungary predicated that this judgement was unconstitutional and eliminated it.
The Constitutional Court of Hungary settled the questions, and stated the principle that the professional person (policeman, fire-fighter etc.) qualified as a public person when intervening and working. So their portraits are not personal data and they are not entitled to defence, as in the case of individuals. The main demand is the justice of the freedom of press, but it must not harm the human dignity of professional people. For example, the portraits of traumatized policemen or fire-fighters must not be disclosed.
On the other hand, we can see an opinion, claiming that the policemen wearing uniform must not refer to their private sphere because they have power and represent the authority of the state. Though they are private people, when they are in action they visualise the power of the government and the state against the citizens who have the right to identify the professional people. It is a guarantee to prevent abuse, because if people can see e.g. an identification number of a professional, the professional person must comply with the rules when they act.
After the decision of the Constitutional Court, which was contrary to the point of view of the court, the Curia had to make a new decision in this question last year. Since the courts must follow the principle of uniformity decision of the Curia, which was eliminated by the Constitutional Court of Hungary, a significant disagreement emerged. Solving this was very important, undoubtedly.
The 1/2012 BKMPJE uniformity decision of the Curia was eliminated by this new uniformity decision on the basis of the following:
The Curia asked the opinion of the General Prosecutor of Hungary. He said that the work and public appearance of professional staff was a special field and it was necessary to regard them as different from others (civilians). On the other hand, some dispute is caused by the lack of concept of public appearances, persons in public and persons working as the public authority of law, in the opinion of the General Prosecutor of Hungary. He explained the need to modify the new Civil Code.
On the other hand, the Curia investigated the differences between the old rules and the new Civil Code and informational law. The annulment of 1/2012 BKMPJE uniformity decision of the Curia is reasonable along the new principles of new informational act and partly the Civil Code. At the same time with the rules of the new acts it is necessary to define the real content of public appearances, persons in public and persons working as public authority, because there is not enough and precisely adequate concept of these to decide in particular litigations. According to the decision of the Curia, this question is not settled permanently, the legislator must modify the acts.
- 118/119 -
The Appeal Court of the Capital has a surprising verdict in Hungary on 29 October 2015 against the decision of the Constitutional Court. This is not a judgement-at-law and it is very interesting, because it says that the policemen who work in public have personal attributes and these attributes are personal data. The violation of rights to private sphere is realized when personal data (e.g. emotions on one's face) are visible to anyone. The judgement obligated the web site operator (who published the photos) to pay violation fee to the policemen.
The website operator appealed against the judgement; the procedure of appellate is under way now.
Analysing this case, we realize that there are some remaining questions of data protection and privacy policy in Hungary, and solving these is difficult. On one hand the rules are not too exact to give adequate solutions; on the other hand, the points of view of the Hungarian authorities are not unitary. There have been changes in the field of law (new principles and the new Civil Code and informational act), so the development of data protection and privacy policy has happened quickly. There are some particular cases which are examined by the courts and the Constitutional Court of Hungary. Though it causes problems in law enforcement, we can see very significant developments in this field of law because of the disputes. I hope the adequate solution to this problem will be constructed by the courts or the Constitutional Court coincidentally. It is necessary to modify the rules (the Civil Code and the informational act) by the legislator on the basis of legal practice (judgements and decisions of the Curia and the Constitutional Court of Hungary).
At first we can see the result of the appeal against the judgement at the Appeal Court of the Capital, then the procedure of the Constitutional Court of Hungary in the case of constitutional complaint of the defendant or plaintiff. I am sure it will happen and will contain very interesting principles in the field of data protection and privacy policy. In my opinion, this dispute can show the development of this field of law in Hungary.
- 119/120 -
Constitution of Hungary.
Fundamental Law of Hungary.
Act IV. 1959 on Civil Code.
Act XLVII. 1997 on management and protection of medical and personal data.
Act CXII. 2011 on the right to informational self-determination and freedom of information.
Act C. 2012 on Criminal Code.
Act V. 2013 on Civil Code.
Publication of the Contract on protection of individuals in the case of automatic processing of personal data, in Strasbourg on 28 January 1981.
Commentary of the new Civil Code.
1/2012 BKMPJE uniformity decision.
Pf.20.656/2012/7. Judgement of the Capital Appeal Court.
28/2014. (IX.29.) Decision of the Constitutional Court.
MG (2015): Váratlan fordulat a rendőrarcok kitakarása ügyében Available at: http://index.hu/belfold/2015/10/30/itelotabla_rendor_kepmas_meglepo_itelet/
Miklós Polgár (miklos.dr.polgar@katved.gov.hu) graduated as a lawyer at the University of Pécs, Faculty of Law in 2002. He continued his studies as a PhD student (Law and State Philosophy Department) and started to work as a civil servant at the Pension Insurance Office of Baranya County, and the Bureau of Baranya County. He took his administrative exam and bar exam in 2006. He graduated as Master of Business Administration at the University of Pécs, Faculty of Economics in 2008. He has been working as a legal adviser at the Baranya County Directorate for Disaster Management. ■
NOTES
[1] E.g. Constitutional Court, Ombudsmen etc.
[2] 1 May 2004.
[3] It was enforced on 1 May 1993.
[4] Act XLVII. 1997 on management and protection of medical and personal data connected to it.
[5] Publication of the Contract on protection of individuals in the case of automatic processing of personal data, in Strasbourg on 28 January 1981.
[6] Act CXII. 2011 on the right to informational self-determination and freedom of information, entered into force on 1 January 2012.
[7] Act V. 2013 on Civil Code, it was enforced on 15 March 2014.
[8] E.g. Act CLV. 2009 on the protection of classified data, Act CLVII. 2010 on the protection of classified data covered by national data assets, Act CI. 2007 on accessibility to ensure decision of preparation of the required data.
[9] Act L. 2013 on e-information security of national and local authorities.
[10] a) - n) point (1) Section a) 11. Paragraph Act L. 2013 on e-information security of national and local authorities.
[11] (1) Section 14. Paragraph Act L. 2013 on e-information security of national and local authorities.
[12] 16-17. Paragraph Act L. 2013 on e-information security of national and local authorities.
[13] Their status is ruled by the Act XLII. 2015 on the legal relationship of professional staff of performing law enforcement duties.
[14] Act IV. 1959 on the Civil Code.
[15] It is the new Constitution of Hungary, entered into force on January 1, 2012.
[16] VI. Article (2) Fundamental law of Hungary.
[17] VI. Article (3) Fundamental law of Hungary.
[18] 2:42 (2) new Civil Code of Hungary.
[19] XII. Article new Civil Code of Hungary.
[20] 2:52 new Civil Code.
[21] Commentary of the new Civil Code.
[22] 22.§, 52-60.§
[23] (1) 54.§ Act CXII. 2011 on the right to informational self-determination and freedom of information.
[24] op. cit. 55.§
[25] op. cit. 64.§
[26] 2:54.§ (4) new Civil Code.
[27] Act C. 2012 on Criminal Code.
[28] op. cit. 219-220.§
[29] 1/2012 BKMPJE uniformity decision.
[30] 25. (3) Art. Fundamental Law of Hungary.
[31] op. cit.
[32] 28/2014. (IX.29.) Decision of the Constitutional Court.
[33] Pf.20.656/2012/7. Judgement of the Capital Appeal Court.
[34] 1/2015 BKMPJE uniformity decision.
[35] http://index.hu/belfold/2015/10/30/itelotabla_rendor_kepmas_meglepo_itelet/ (Downloaded: 07.01.2018)
Lábjegyzetek:
[1] The author is Legal Adviser, Baranya County Directorate for Disaster Management, miklos.dr.polgar@katved.gov.hu.
Visszaugrás
