The government in Hungary has taken the controversial decision to suspend the rights of data subjects under the General Data Protection Regulation (GDPR) during the COVID-19 pandemic and has eased other GDPR restrictions for the duration of the COVID-19 state of emergency.
In addition to the suspension of data subjects’ rights such as the rights to access personal information and have that information erased, the requirement for public agencies to notify data subjects when their personal information is being collected have been relaxed, and the time frame for processing freedom of information requests has also been increased. Data subjects who wish to file a complaint or seek judicial remedy over a GDPR violation will now have to wait until the state of emergency is over.
The temporary changes to the requirements of the GDPR are lawful. Article 23 of the GDPR permits the protections and freedoms afforded by GDPR to be temporarily restricted if doing so is required to protect public security. The move has attracted considerable criticism from several privacy proponents.
Andrea Jelinik, Chair of the European Data Protection Board (EDPB), the EU’s data protection watchdog, voiced her concerns about the decision by the Hungarian authorities to exercise their right to suspend GDPR requirements due to the COVID-19 state of emergency when speaking to reporters following the publication of the 2019 EDPB annual report.
“I am personally very worried at the suspension of several articles of the GDPR by the Hungarian government,” said Jelinek, also saying such a move during a public health crisis was “not recommended”. EDPB is now planning to publish official guidance on how Article 23 of the GDPR should be interpreted.
The Civil Liberties Union for Europe, Access Now, and the Hungarian Civil Liberties Union write to EDPB about the move by Hungarian authorities to temporarily suspend some of the requirements of the GDPR. In their letter, they said, “The decision by the Hungarian government to limit the application of data subjects’ rights is disproportionate, unjustified, and potentially harmful to the public’s response to fight the virus.”
The COVID-19 pandemic will not be resolved soon. While the outbreak has been brought under control throughout Europe, there are likely to be further outbreaks over the coming months. Until a vaccine is developed and a significant proportion of the population in Hungary are vaccinated, COVID-19 will remain a major health risk. Since the Hungarian government makes the decision on when the state of emergency is over, GDPR rights and protections could conceivably be suspended for many months or even years to come.