Bence Tordai – Complaint Upheld (Hungary, 2024)

The data subject is a Hungarian politician, while the controller is a company managing several news websites and newspapers. The controller acquired some images of the data subject’s house in Budapest through a camera installed on a drone. These images were then published on several news websites, along with statements accusing the data subject of having built his house without a building permit. Moreover, the controller also published ob its news outlets the entries of an electronic log about the construction works. The data subject filed a complaint with the DPA. He argued that the controller unlawfully published the data and that he was not provided with the information listed in Articles 13 and 14 GDPR. The controller, at the request of the DPA, did not clarify on which legal basis it was relying for this processing activity. Later on, the controller argued it was relying on Article 6(1)(f) GDPR and provided the DPA with a legitimate interest test. In the latter, the controller pointed out that it needs to perform this processing activity in order to inform its readers, that it constitutes a proportionate restriction and that its purpose cannot be achieved by means of a lesser restriction. In addition, it noted that the processing is not unexpected for the data subject. Moreover, it argued that the data from the electronic log was sent to it by an unknown person in a sealed envelope. First, the DPA noted that the data subject is a public figure, since he is a member of the Parliament and a politician. Secondly, the DPA underlined how the freedom of the press and, more generally, the freedom of speech and expression have a very important role in a democratic country and are protected by the constitution. More specifically, the DPA upheld the controller’s argument that it had a legitimate interest in performing this processing activity, given that the purpose was informing the public about the credibility of a political public figure in the context of a public issue. Thirdly, the DPA analysed if this processing activity was actually necessary to reach this purpose. The DPA held that the recording and publication of the personal data was necessary to inform the public. Moreover, the data subject was not visible in the recordings. Therefore, the DPA was of the view that the necessity requirement was fulfilled. Fourthly, as for the balancing test, the DPA found that the contested data processing operations did not constitute an unnecessary and disproportionate intrusion into the privacy of the data subject. On this point, the DPA stressed the fact that the data subject is not a normal citizen but a politician. Therefore, he could expect that an element of his private life was questioned by public opinion. Therefore, it held that the controller had rightly relied on Article 6(1)(f) GDPR for this processing activity. Fifthly, as for the electronic log data, the DPA found a violation of Article 14 GDPR. Indeed, the controller failed to prove that it had sent the information provided for by this article to the data subject. Sixthly, the DPA found a violation of Article 13 GDPR since the controller did not provide the data subject with the information provided for by that article in connection with the recording and publication of his house’s images. On these grounds, the DPA partially upheld the data subject’s complaint and issued a reprimand to the controller.