“We were not on the side of the ban.”

Facebook is interfering with the constitutional rights system of an independent country, Hungary, says Attila Petrvalfi, head of the Data Protection Authority.

We know nothing about the distribution of infections by age and region, or about hospital capacity, for example, the Freedom Association (HCLU) recently drew attention to. Can the government do this legitimately to hide basic epidemiological data?
It is clear that basic epidemiological data cannot be kept secret.

Is this not what is happening?
The tricky question is when and what could be the consequences of publishing a piece of data. In Italy, in the spring, when it became clear which areas were the least affected, the crowds set out. Serious measures had to be taken to prevent entry of the virus. The pandemic also has implications for data protection, but the viral situation needs to be addressed first and foremost, which, in turn, is the responsibility of epidemiologists. Public health is critical, and for this, we need to look at what is going on with data protection.

Withholding information makes it difficult for individuals to defend themselves against the virus, which a truly working tribe expects from the people anyway. Aren’t you worried about it?
In some cases, it can be seen if there is a constitutional and justifiable reason for withholding data regarding pandemic management, but in general I do not share HCLU’s position. I do not think that current information exercise infringes freedom of information.

Referring to the virus situation, ministries and government agencies can take up to 90 days to respond to requests for public interest data. Quoting media researcher Agnes Urban: It is difficult to imagine a pandemic issue that will be answered within three months. Is it as good as this?
Mention of 90 days is considered a delay, as it is a 45-day deadline that can be extended by 45 days. This option can only be used by those agencies working on the “front line”, and fulfilling the data request would impede the performance of their primary mission, which is to protect against the epidemic. It must be considered on a case-by-case basis to the institution to which the data request is submitted. If there is a specific complaint, we will of course investigate it. So far, we’ve only received one request for which we haven’t found a good basis.

I note that even if there is an answer, there is often no thanks in it.
I am very old, a large part of my work as a data protection commissioner occurred during the period of socialist rule. Even then, a problem arose that some ministries were willing to speak only to the left press, not to the right. There is nothing new during the day. Both political sides are staunch supporters of freedom of information when in opposition and are trying to narrow it down when it comes to government. I don’t consider this a good thing, it is right that public interest information always and as widely as possible reach citizens.

The European Data Protection Council decision emphasized the need to maintain the protection of personal data even in exceptional circumstances, during the outbreak of the epidemic. Do the measures of the Hungarian government so far meet these requirements?
I think so. In my view, there was no government provision in the spring or during the second wave that would not be constitutional regarding data protection or violate the General Data Protection Act (GDPR), the European Union’s General Data Protection Regulation.

The government is urging as many people as possible to register to get vaccinations. However, the Prime Minister’s Office, headed by Antal Rogan, appears on the site as a data monitor. Do you see a guarantee that our personal data will not be used for partisan political purposes?
There are two purposes for online registration. One is to register to get the vaccine, and the other is to provide your contact details if someone wants to stay in contact with the government. However, you must submit a separate contribution by clicking on the relevant section. In the first case, the Prime Minister’s Office deals with the data in encrypted form, cannot access it, or does not see it. In the second case, only the names and contact details of those requesting a consultation will be sent to the Cabinet Office. There is no passage between the two. We also commented on the construction, and we did not find that a concern. I can assure you that neither Antal Rogan nor anyone else unauthorized can access anyone’s health data – if your question is implicitly covered.

Not necessarily just for that, but to build a database, for example.
This can only be done legally, for the specific purpose mentioned in the second case, with the consent of citizens.

Can they keep workplace records of those infected or those who have applied and been vaccinated? Can vaccination be mandatory if the state does not make it so?
Although we also have decisions on this topic, again I can only say that these are mainly questions of epidemiologists.

The government will subject access to certain services to a certificate of vaccination. What are the conditions that must be met for this?
We have already had a quick consultation with the Home Office about whether we have any objections in principle to the vaccination certificate. We have no objection in principle. Member state legislation will likely be introduced elsewhere, but I am convinced that there is no truly national solution. International rules should be adopted at the European Union level. This cannot be the case for someone who has a vaccination card in one country and not in another country. What if one airline allows you to travel because it does not ask for the vaccination card and the other airline does not bring it home because it insists on the vaccination card? It is true for the entire epidemic that this is a cross-border public health problem, so action must be coordinated.

Another topic: Tightening the drone law makes it impossible to make exposed footage of the luxury properties of “entrepreneurs” enriched by billions of public funds. Although you previously considered it legal for the press to publish recordings of non-invasive drones.
From a data protection point of view, the principle of accountability is important. In order to obtain compensation in the event of an injury, we need to know who flew the drone. This is why registration is required. We were not on the side of the ban, we said it needed to be organized. The fact that the Legislative Council chose to ban is another matter. There will be some case law in specific cases.

Can we agree that tightening drones did not serve press freedom?
Judging this is not my case. From a privacy standpoint, all I can say is that I find flying drones a particular risk to the private sector.

He suggested creating a Hungarian authority to exercise control over social media. Is there any development in this matter?
Be clear about what you are talking about. I assumed that operating social media sites raises serious data protection issues. Facebook is an American company with European headquarters in Ireland. A Hungarian user’s complaint will not be considered by us, but by the Irish data protection authority. We have no room to maneuver. If you reprimanded the government in one of your posts and Facebook deletes your post or even your entire page based on an unknown algorithm, on any grounds. Under Hungarian law, you have the right to freedom of expression, except for some criminal cases.

Is opinion data?
Well, right. What does Facebook do? It restricts your right to have an opinion. The outcome of selection can also be affected by what opinions are allowed to appear. So a US business that is in reality in a monopoly position obstructs the constitutional law of a sovereign state by interfering with the constitutional rights system of an independent state. My suggestion was that the decision should be in the hands of a Hungarian authority on such complaints.

How do you imagine?
The question is exactly how Facebook could be included in the Hungarian judiciary. I have no information if they are working on any concept in government. The Poles are trying to exact hefty fines, so let’s wait until they go with it. No matter how misrepresented my words were, I drew attention only to the nonsense that the practice of that country could not prevail in an independent state because an American company would not allow this to happen. I would have thought the same way if no Russian or Chinese company had left. It doesn’t matter. This is a Hungarian question.