Skip to main content

Advertisement

Log in

Hungary’s unorthodox approach to personal privacy

  • Original Paper
  • Published:
Health and Technology Aims and scope Submit manuscript

Abstract

Hungary’s special approach to political and social questions is frequently analysed by the media. Taking a closer look at the details of the privacy regulations, we can also identify several unique features. For Hungary, the era of socialism ended with the proclamation of the new Republic of Hungary on 23rd October, 1989. The substantially renewed constitution was entered into force on the same day. The fundamental rights defined in the European Convention of Human Rights were included in it and, in addition, the right to the protection of personal data. The main characteristic of the legal system is that politicians understand the constitution so that it would always require passing a new law whenever they want a public authority to collect personal data for some purpose. By now, Hungary has several hundred laws and decrees in effect on the obligatory collection and transfer of personal data. The nature of such types of regulation ab ovo excludes the possibility of objection and challenging a regulation before the court. Turning our attention to healthcare, we see that medical authorities and researchers are authorized by the law to collect personal medical data without providing information and the right to object to data subjects. The author has been studying the changes in the medical privacy regulations since 2004. Here, he gives an account of the key characteristics of the Hungarian legislation and provides a comparison with the relevant European Union legislation in relation to medical data. When the EU General Data Protection Regulation came into force, the conflict between the two became obvious. This paper gives the reader an expert’s view of the Hungarian data protection policy, while attempting to pave the way to stimulate social debate concerning the necessity for better, and more privacy aware legislation.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1

Similar content being viewed by others

Notes

  1. In the People’s Republic of Hungary, workers and their families were entitled to receive a voucher for a one-week holiday, at a resort hotel, with full board, by paying a symbolic nominal price. This could never have been fully realised as the whole population could never have been catered for in this way. However, with this social programme, many in Hungary were able to go on vacation for the first time in their lives.

  2. In fact, the author can mention one exception. The Ombudsman of Hungary filed a successful complaint in the case of medical certification given to the prostitutes stating that they do not suffer from STDs, decision number 1/2011. The certification contained the word ‘prostitute’ and the Ombudsman claimed that it violated the New York Convention on Exploitation of Prostitution.

  3. http://hunconcourt.hu/rules/fundamental-law

  4. Within the Republic, there are now roughly 200–300 laws and 300–400 decrees in effect, according to the national legislation database (the exact numbers vary from day to day) that has instructions related to the obligatory processing of personal data – even minimally, not only in medicine, but in the course of routine actions in public administrations, schools, universities, insurance companies, banks, public services, transportation, and other commercial activities. In medicine, there are 10 laws, and at least 30–40 decrees on obligatory personal data processing – mainly on reporting health data to an authority, or on documenting some type of examination.

  5. Bundesverfassungsgericht, Urteil vom 15. Dezember 1983, 1 BvR 209/83, 1 BvR 484/83, 1 BvR 440/83, 1 BvR 420/83, 1 BvR 362/83, 1 BvR 269/83 (Volkszählungsurteil). An English translation of the decision can be found here: https://freiheitsfoo.de/census-act/

  6. Alfred Kobsa a privacy researcher at the University of California in Irvine saved the English translation of the Data Protection Act of 1992, which he obtained from the Office of the Hungarian Parliamentary Commissioner for Citizens’ Rights [10].

  7. The new Data Protection Act of Hungary allows collecting personal data revealing racial origin or nationality, political opinions and any affiliation with political parties, religious or philosophical beliefs or trade-union membership, and personal data concerning one’s sexual life only when data subject consents.

  8. Before Hungary’s accession to the EU, the European Parliament passed a decision that Hungarian law provided adequate protection of personal data in 2000 [12].

  9. C.f. the old Data Protection Act, Section 3: “Personal data may be processed if the person concerned agrees thereto, or it is ordered by an act or a local government decree on the basis of the authorization of an act, within the limits defined therein.” [10]

  10. Data subjects may object to the sale of their name and address records to companies for marketing purposes by the Hungarian population registry, the transferring of their archived prescription data to a pharmacist by the National Health Insurance Fund, or the transferring of their medical care data to their GP or the treating physician by the National Health Insurance Fund.

  11. Later the Court of Justice of the EU (CJEU) condemned Hungary in case C-288/12, because it violated the 95/46/EC Directive, Article 28. This requires that the position of the Data Protection Commissioner must be independent of the government in power.

  12. The Government of Hungary sent a questionnaire to all adults, which had asked each recipient to fill them in, and then to return their opinions. The national population registry provided the necessary data, the list of names and addresses. This was the so-called “Social Consultation” (Társadalmi konzultáció). Each questionnaire contained a unique barcode that established an indirect connection with a specific natural person. During processing the questionnaire answers were recorded together with the barcodes. For a second step, the Government had planned to create a database of their politically active supporters, (Case number: ABI-1642-4/2011/H) http://abi.atlatszo.hu/index.php?menu=aktualis/allasfoglalasok/2011&dok=ABI-1642-4_2011_H.

  13. First, the data controller decides according to its points of view, whether obtaining consent requires a disproportionate effort or not. If a data controller chose the legitimate interest as the reason for the personal data processing, then it should give a preliminary explanation to the data subjects, and they may object to the processing of their data. Ultimately, data subjects may turn to the competent national court. This should not be a kind of obligatory processing of personal data.

  14. The Data Protection Commissioner of Hungary declared, first on 31st May 2011 (case no: ABI-2136-3/2010/K), that there is no legal possibility to record “street views,” by GSV, see http://abi.atlatszo.hu/index.php?menu=aktualis/allasfoglalasok/2011&dok=ABI-2136-3_2010_K). After the Hungarian Parliament passed the amendment, the newly appointed commissioner issued another statement in which he acknowledged that GSV could begin to operate (case no: NAIH-5711-16/2012/B), http://naih.hu/files/Adatvedelem-NAIH-5711-162012B-Google-SV.pdf.

  15. http://hvg.hu/gazdasag/20140423_Mire_kell_Matolcsyeknak_a_nagy_adatbank

  16. Sections 52–54 of the Act II of 1972 on Healthcare required written consent in the case of living donor transplantation, from the donor and the recipient, and in the case of a cadaver transplantation from the recipient. Section 47 requested written consent before medical operations.

  17. In Hungarian it is called TAJ (Társadalombiztosítási Azonosító Jel). It is a nine-digit number in which the last digit is a check digit. See Act XX of 1996 on the Identification Methods Replacing the Universal Personal Identification Number, and the Use of Identification Codes.

  18. http://www.oep.hu

  19. https://www.onyf.hu

  20. Such as the National Cancer Registry, the Hungarian Congenital Abnormality Registry, the National Tauffer Registry of Live Births, and the Itemized Medical Database of Subsidized Care Events.

  21. The National Health Insurance Fund collects data about patients treated by novel and innovative methods (there are about twenty of them) in order to monitor the effectiveness and success rate of the procedure.

  22. The Heart Infarct Registry, the National Registry of Implants and Prostheses, and the Stroke Register (planned).

  23. For example, Hungarian Civil Liberties Union, http://www.tasz.hu, the Ombudsman of Hungary (cases: 1/2011, 17/2014), and the Data Protection Commissioner (36/2007).

  24. The CODICES is a database on the Constitutional Case Law of the Venice Commission at the Council of Europe. It collects English and French translations of constitutions and Constitutional Court decisions from many countries, http://www.codices.coe.int

  25. The Supreme Court (Case no: 2029/2009.) decided that the parents who have hindered vaccination of their child are not guilty of the crime of endangering minors. The Chief Prosecutor proposed to sentence them for up to five-year imprisonment based on the Act IV of 1976 on the Penal Code, Section 195. According to the court’s decision, parents only committed an administrative offence and could therefore be fined. The public health authority denounced these parents to the prosecutors’ office. See http://www.lb.hu/hu/elvhat/20292009-szamu-bunteto-elvi-hatarozat

  26. Paediatric Clinic Number 1 at the Semmelweis Medical University of Budapest and the Paediatric Clinic at the University of Szeged

  27. The Act C of 2012 on the Hungarian Penal Code, Section 213 says that unauthorized changing of family status of a child is a qualified crime and carries up to a five-year prison sentence when it is committed by a healthcare professional.

  28. Decree 33 of 1998 (24th June) originally issued by the Minister of Social Welfare.

  29. The decision of the Constitutional Court No. 3201/2013 is on the homepage of the Court: http://public.mkab.hu/dev/dontesek.nsf/0/01BF09BD60225F1BC1257ADA00524D92?OpenDocument

  30. People who don’t go for medical screening will pay more (János Lázár, Minister of the Cabinet, 17th June 2016.), http://aktiv.origo.hu/gazdasag/20160617-tobb-tb-t-fizethet-aki-nem-jar-szuresre.html

    National Medical Screening Programme: We must visit doctors regularly (28th May, 2013), http://www.vg.hu/vallalatok/egeszsegugy/nemzeti-szuroprogram-rendszeresen-orvoshoz-kell-majd-jarni-404479

  31. It was later revealed that the entity that compromised the information of patients might have been the newly founded Fejér County Office of the Government, Public Health Body.

  32. The Public Health Body has not been authorised (i.e. obliged) to transfer screening data to GPs, and patients apparently did not give their consent to the data transfer.

  33. The practice was first mentioned in the Report on the Financial and Subsidisation System of Medicines and Consumption by the State Audit Office, October 2004, page 70, https://asz.hu/storage/files/files/%C3%96sszes%20jelent%C3%A9s/2004/0448j000.pdf?ctid=758. The complaint was mentioned in the Annual report of the Hungarian Data Protection Commissioner 2004, page 66, case number 267/A/2004, http://naih.hu/files/Adatvedelmi-biztos-beszamoloja-2004.PDF

  34. The decision number is 29/2009. (20th March).

  35. Decree 53 of 2007 (7th December) on Accreditation Rules for Medical Prescribing Software

  36. http://www.unesco.org/new/en/social-and-human-sciences/themes/bioethics/bioethics-and-human-rights/

  37. http://www.cioms.ch/publications/guidelines/guidelines_nov_2002_blurb.htm

  38. Unfortunately, Act XLVII of 1997 has no English translation. The up-to-date Hungarian text in force can be retrieved from the National Legal Repository: http://www.njt.hu

  39. In 2009, two companies approached the Clinical Centre at the University of Szeged and offered money for the pseudonymised prescription data. The author as a member of the Research Ethics Committee recommended not selling data and sent in a complaint to the Data Protection Authority, but it failed to act against the companies. The requested ‘pseudonymous’ data contained the prescription numbers and demographic data (date of birth, ZIP code of the resident address and gender).

  40. The prescription number is an 18-digit number, the first two digits are 21, then comes the last two digits of the year of printing (2015 is coded as 15), a reserved digit (zero), a 5-digit licence number of the prescriber, 6-digit serial number, one-digit prescription type (1 - normal, 2 - pro familia, 3 - ophthalmologist, etc.) and a checking code. Licence numbers are public data, hence available to everyone.

  41. The English translation of the law can be found on the homepage of the Constitutional Court: http://hunconcourt.hu/rules/act-on-the-cc

  42. http://www.venice.coe.int/webforms/documents/default.aspx?pdffile=CDL-REF(2012)021-e

  43. The official translation of the Act CLI of 2011 on the Constitutional Court can be found on the homepage of the Court: http://hunconcourt.hu/rules/act-on-the-cc

  44. See Article 99, Paragraph 1: This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

  45. The institution of a living will exists in Hungary. Nevertheless, the formal criteria of a living will make it difficult to apply. Patients ought to express their will – before a notary public in advance, and they should hand it over when being hospitalized. If patients are unable to present their living will to the doctor in the hospital, then their only hope is that they have given a copy of the living will to the family doctor previously, and the family doctor will notify the hospital. A living will can be elaborated only after the lethal prognosis is communicated, but the patient still has the capacity to understand the consequences of his/her decision. A committee of three physicians (the treating physician, an independent specialist, and a psychiatrist) should approve the living will. See Act CLIV of 1997 on Healthcare, Section 20.

References

  1. Cartledge B. The will to survive, ISBN: 978–1849041126: Columbia University Press; 2011.

  2. Special issue on the Hungarian Constitution, Official Gazette, No. 150/2009, http://www.kozlonyok.hu/nkonline/MKPDF/hiteles/MK09150.pdf (retrieved 31st August, 2016).

  3. Kende T., Nagy B., Sonnevend P., and Valki L. (editors): Nemzetközi Jog (International Law), ISBN: 978–9632953823, Complex Kiadó, 2014.

  4. Gárdos-Orosz F.: The Hungarian Constitutional Court in Transition – from Actio Popularis to Constitutional Complaint, Acta Juridica Hungarica, Vol.: 53, No.: 4, pp. 302–315, Akadámiai Kiadó, 2012, DOI: 10.1556/AJur.53.2012.4.3.

  5. The Fundamental Law of Hungary (25th April 2011), in English on the homepage of the Constitutional Court: http://hunconcourt.hu/rules/fundamental-law (retrieved 31st August 2016).

  6. The Charter of Fundamental Rights of the European Union, Official Journal, No.: 2000/C 364/01, http://www.europarl.europa.eu/charter/pdf/text_en.pdf (retrieved 31st August 2016).

  7. Könyves-Tóth, P.: Az adatvédelmi törvény metamorfózisai (Metamorphoses of the Data Protection Act), Fundamentum – Jornal on Fundamental Rights, Vol. 2002 No. 2, pp. 53–61, In Hungarian, http://www.fundamentum.hu/sites/default/files/10-2-05.pdf (retrieved 31st August, 2016).

  8. Mayer-Schönberger V.: Generational Development of Data Protection in Europe, in Technology and Privacy: The New Landscape, (eds.) Agre, Phillip E. and Marc Rotenberg, pp. 219–242, ISBN: 978–0262511018, Cambridge, MA, MIT Press (1998).

  9. Decision 15/1991. (13th April 1991) on the applicability of the personal identifier of the Hungarian Constitutional Court, Council of Europe, CODICES database, in English, Id.: HUN-1991-S-001, http://www.codices.coe.int/NXT/gateway.dll/CODICES/precis/eng/eur/hun/hun-1991-s-001?fn=document-frameset.htm$f=templates$3.0 (retrieved 31st August 2016).

  10. Act LXIII of 1992 on the Protection of Personal Data and the Publicity of Data of Public Interest, in English, https://www.ics.uci.edu/~kobsa/privacy/Hungary.htm without subsequent amendments (retrieved 31st August 2016).

  11. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Official Journal L 281, 23/11/1995, pp. 0031–0050, http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML (retrieved 31st August 2016).

  12. Adequacy Decision 2000/519/EC, Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Hungary, http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0519 (retrieved 31st August 2016).

  13. Council of Europe, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, ETS-108, URL: https://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/108 (retrieved 31st August 2016).

  14. Act II of 1972 on Healthcare, Tanácsok Közlönye (Municipality Gazette), No 20/1972, Library of the Hungarian Parliament, 357–373.

  15. Alexin, Z.: Az orvosi vények adatvédelmi problémái, (Data protection questions concerning medical prescriptions), Orvostovábbképző Szemle, Vol.: XIX. 6, 65–70 (2012).

  16. The Hungarian Parliamentary Commissioner for Citizens’ Rights: Report in the case AJB 6790/2010 on the practice of the school medical examinations, in Hungarian, https://www.ajbh.hu/documents/10180/105926/201006790.rtf/d4acf2e1-a8fa-438f-b6fa-1cf077e4eacb?version=1.0 (retrieved 31st August 2016).

  17. Hanti, P.: Kommentár az egészségügyi és a hozzájuk kapcsolódó személyes adatok kezeléséről és védelméről szóló 1997. évi XLVII. törvényhez (Commentaries to the Act XLVII of 1997 on Health Data Processing and Protection), ISBN: 978–9632952703, Wolters Kluwer Ltd. (2013).

  18. Németh K. Fertőző betegség és emberi jogok (Transferable disease and human rights). Med & Jur. 2014;5(3):14–7.

  19. WMA Declaration of Helsinki - Ethical Principles for Medical Research Involving Human Subjects, version October 2013, http://www.wma.net/en/30publications/10policies/b3/index.html (retrieved 31st August 2016).

  20. Council of Europe, Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine: Convention on Human Rights and Biomedicine, CETS-164, URL: https://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/164 (retrieved 31st August 2016).

  21. Alexin Z.: Protecting Privacy in Medical Research, in Lege Artis Medicinae, Vol. 16, No. 6., 594–597, ISSN: ISSN 0866–4811, in Hungarian (2006).

  22. Sweeney, L., Simple Demographics Often Identify People Uniquely. Carnegie Mellon University, Data Privacy Working Paper 3. Pittsburgh 2000. URL: http://dataprivacylab.org/projects/identifiability/paper1.pdf (retrieved 31st August 2016).

  23. Alexin, Z.: Does fair anonymization exist?, International Review of Law, Computers and Technology, 28, 1:21–44, DOI: 10.1080/13600869.2013.869909, Taylor & Francis Publishing (2014).

  24. Office for Civil Rights, Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule November 26, 2012, URL: http://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/ coveredentities/De-identification/hhs_deid_guidance.pdf (retrieved 31st August 2016).

  25. Rothstein, M. A.: Is Deidentification Sufficient to Protect Health Privacy in Research, The American Journal of Bioethics, Vol. 10, No. 9, pp. 3–11, Taylor & Francis Group (2010).

  26. Alexin, Z.: Az EESZT adatvédelmi problémái a jogi szabályozás tükrében, (Privacy questions concerning the Electronic Health Cooperation Service Space in the light of the legal regulation), in Hungarian, Interdiszciplináris Magyar Egészségügy, Vol. XV. No. 5, pp. 56–60, Larix Kiadó Kft. (2016).

  27. Article 29. Data Protection Working Party: Working document on the processing of personal data relating to health in electronic health records (EHR), http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2007/wp131_en.pdf (retrieved 31st August 2016).

  28. Spokeo Inc. vs. Robins, case no: 13–1339, US Supreme Court, https://www.supremecourt.gov/opinions/15pdf/13-1339_f2q3.pdf (retrieved 31st August 2016).

  29. De Hert, P., Gutwirth, S.: Data Protection in Case Law of Strasbourg and Luxemburg: Constitutionalisation in Action, pp. 3–44, Reinventing Data Protection, ISBN: 978–1–4020-94972, Springer (2009).

  30. Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information, in English http://naih.hu/files/Act-CXII-of-2011_EN_23June2016.pdf (retrieved 31st August 2016).

  31. Consolidated versions of the Treaty on European Union and the Treaty on the Functioning of the European Union - Protocols - Annexes - Declarations annexed to the Final Act of the Intergovernmental Conference which adopted the Treaty of Lisbon, signed on 13 December 2007 - Tables of equivalences Official Journal C 326, 26/10/2012 P. 0001–0390, http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12012E/TXT (retrieved 31st August 2016).

  32. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Official Journal, 4.5.2016 L 119/1, http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=en (retrieved 31st August 2016).

  33. Regulation (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, Official Journal 4.5.2016 L 119/89, http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016L0680 (retrieved 31st August 2016).

  34. Csáky-Szunyogh M, Vereczkey A, Gerencsér B, Czeizel AE. Maternal hypertension with nifedipine treatment associated with a higher risk for right-sided obstructive defects of the heart: a population-based case-control study. Heart Asia. 2014 Jan 23;6(1):3–7. doi:10.1136/heartasia-2013-010331.

    Article  Google Scholar 

  35. Vermes G, László D, Mátrai Á, Czeizel AE, Ács N. Maternal factors in the origin of isolated anorectal malformations – a population-based case-control study. Journal of Maternal-Fetal & Neonatal Medicine. 2016;29(14):2316–21. doi:10.3109/14767058.2015.1085014.

    Google Scholar 

  36. Julesz M. Passive euthanasia and living will, in orvosi Hetilap (Medical Weekly), 1057–1062, 155, 27. In: Hungarian 6th July; 2014. doi:10.1556/OH.2014.29950.

Download references

Acknowledgement

The author wishes to express his thanks for the valuable support received from the COST IC1206 “De-identification for privacy purposes of multimedia content” project of the European Union.

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Zoltán Alexin.

Ethics declarations

Conflict of interest

The author declares that he has no conflict of interest.

Additional information

This article is part of the Topical Collection on Privacy and Security of Medical Information

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Alexin, Z. Hungary’s unorthodox approach to personal privacy. Health Technol. 7, 423–440 (2017). https://doi.org/10.1007/s12553-017-0181-7

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s12553-017-0181-7

Keywords

Navigation