Given that personal information and stories about natural persons are the basic raw material for journalism, the GDPR has major implications for the work of the press. Potential tensions between freedom of expression and privacy are not a novelty, and the collisions are balanced in well-developed standards under domestic constitutional law and international human rights law (regionally, the European Convention on Human Rights). With the new EU data protection regime coming into force in May 2018, however, it is unclear how freedom of press will be protected from the potential abuse of data protection rights.
The GDPR basically leaves the handling of the potential conflict to be resolved in national legal frameworks. In Article 85, it provides that “Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes.” For instance, Member States are authorized to provide exemptions and derogations from the principles and rights of the data subject in order to reconcile the conflicting interests. Additionally, Article 153 of the Preamble declares the goal that the right to the protection of personal data be reconciled with the right to freedom of expression and information, as enshrined in Article 11 of the EU Charter of Fundamental Rights. Consequently, member states have the duty to protect freedom of expression from the abusive enforcement of GDPR rights. The safeguards of the GDPR shall not be used with the aim or effect of compromising free press. Unfortunately, recent decisions by Hungarian courts and of the National Authority for Data Protection and Freedom of Information (hereinafter: Authority – the national data protection authority authorized to enforce the GDPR in Hungary) undermine the freedom of press and put extreme burden on the daily work of journalists and the press.
The legal aid service of the HCLU provides legal representation in several different – albeit connected – cases. In none of the cases has a final decision been reached yet, but it is already clear that the GDPR can be effectively used to silence journalistic reports that rely on or include personal data. Hereunder, we summarize each case by presenting the factual and legal background of the procedures and the current decisions and rationale reached by the courts and the Authority.
Three kinds of procedures are used by data subjects to block or sanction the publication of reports featuring their personal data: A. preliminary injunction prior to initiating a lawsuit under civil law; B. initiating a lawsuit under civil law to finalize prior restraint by injunction; C. initiating the investigation of the national data protection authority. Legal strategies, stakes of the procedures for free press, as well as specific case descriptions are described below in this order.
A. Prior restraint by means of preliminary injunction (interim measure)
a) What is the alleged legal basis and SLAPP-strategy?
Data subjects request a civil court to issue an injunction (interim measure) according to 108. § of the Hungarian Civil Procedure before initiating a lawsuit against the publisher of a press organ which is preparing a report featuring the data subjects’ personal data. Data subjects typically learn that such a report is in preparation by receiving questions from the journalists involved. Preliminary injunctions primarily serve to maintain a state of affairs any change to which would likely result in irrecoverable harm for the future plaintiff without an interim measure prohibiting the future defendant to pursue or continue to pursue some activity. Data subjects claim that the publication of their personal data would be such activity, as it poses an imminent threat to their rights to be vindicated in a future lawsuit. More broadly, they typically ask for a prohibition to process personal data. If granted, such an injunction blocks not only publication but also investigative journalistic research and content production.
In deciding on the petition for an injunction, the court has to consider whether ordering the measure is likely to cause greater harm to the applicant’s adversary by comparison to the extent of harm the applicant is likely to suffer if the measure is not ordered. The injunction remains in force until the time it is repealed by a court ruling, or in a judgment or other decision concluding the proceedings.
Would-be plaintiffs have approximately a month to launch the lawsuit if they do want the interim measure to stay in effect. With some procedural tricks, such as filing a lawsuit with missing information that will not lead to dismissal without prejudice but will result in a court request for more information from the plaintiff, further time may elapse before the actual lawsuit begins – or before the interim measure loses effect.
b) How have courts decided?
Courts have explicitly disregarded defendants’ claims based on their freedom of expression and press freedom. The only disadvantage courts were willing to take into consideration of the defendant publishers’ side was material in kind: expected losses in sales and advertisement income. The currency of reports – the very fact that they would lose relevance with the passing of time – was not taken into consideration, nor was the public interest in access to information that is of general interest. At the same time, petitioners’ abstract disadvantage of losing control over the publication of their personal data was taken into account. Without adequate balancing between freedom of expression, freedom of the press and freedom of information on one side, and the right to data protection on the other side, the latter prevailed to some extent in all cases. No case ended without the court granting an injunction, albeit sometimes more limited than the petitioners’ request.
c) Why are these decisions alarming for the freedom of the press?
Petitioners successfully delayed or prevented the publication of information of general interest. By abusing the GDPR and civil procedural entitlements, they have exercised prior restraint on the press. Even if the petitioners for an injunction ultimately decline to initiate a lawsuit in the wake of the interim measure, the injunction in and of itself is sufficient to delay publication by 1-2 months, without any judicial consideration of what such delay would mean for the exercise of the freedom of the press, and for the right to information of the general public.
d) Specific case descriptions
1. The Hungarian Forbes list
The owners (four family members) of Hell Energy Ltd. – an energy drink manufacturer – were informed by the journalists of Forbes Hungary that they would appear on the annual lists presenting the most successful family owned companies and the richest Hungarians. Such lists are complied locally, following the unified methodology of the global Forbes brand. The owners objected to the data processing that the compliation and publication of such lists involved, and demanded the restriction of the processing and the erasure of their personal data from the publisher. Additionally, they requested information on the processing, based on Article 14 of the Regulation. The editor-in-chief provided detailed answers by pointing out that the source of the data processed for journalistic purposes was the publicly accessible, official company register, and that these data could be used for journalistic purposes.
The data subjects petitioned the Metropolitan Court of Budapest for an injunction to block any publication of their personal data by Forbes Hungary. The petition for injunction was presented and decided on months before the applicants initiated a lawsuit against Forbes Hungary.
The courts granted the injunction for the data subjects in its ruling on 19th December 2019, prohibiting Forbes to publish any personal data related to the petitioners. The decision was upheld by the Court of Appeal and the Curia (Supreme Court). Basically, the courts found that the sole duty of the petitioners is to present potential harm that they would be exposed to. HCLU – representing Forbes – did not contest that the publication of wealth (personal data calculated on the basis of publicly available company registry) amounts to the processing of personal data, therefore it is a restriction of the rights of the data subject. Our claim to reject the injunction emphasized that i.) the calculation of the wealth is based on publicly available data; ii.) the company exclusively owned and ran by the petitioners is beneficiary of state subsidies amounting to millions of euros; iii.) the Forbes lists are to be seen as context to provide timely information on the activity of business actors. (In the present case, the brief entries below the name of the petitioners referred to the fact that a major investor with close ties to the government had intention to buy the company, furthermore it also informed the readers that the company opened its new plant, which was funded partly by a state subsidy, and also that Bruce Willis advertises its products.)
The final decision by the Curia (24th of August 2020) pointed out that in deciding upon an interim measure, it is not possible to balance between the freedom of press and data protection, because would amount to prejudge the merits of the (would-be) case. According to the Curia, the framework of the proportionality test to balance right to data protection and freedom of press is within Article 6 (1) f) of the GDPR. Hence, performing this balancing exercise would result in deciding upon the merits of the case, therefore it is not permissible, because in the present procedure, the courts does not have authority to do so. The courts basically excluded freedom of press as such from the scope of their consideration, and they have merely taken into account “technical”, factual, and even more restrictively, mostly pecuniary harms on the publisher’s side, such as the costs of reprinting the edition already on the shelves, to be balanced against the petitioners’ alleged harms.
HCLU brings the case to the Constitutional Court, because the injunction has blocked Forbes from producing and circulating information in the public interest for more then 9 month now – given that a civil lawsuit is in progress, see below – without any proper consideration of the rights of the press. Since the injunction is in force until the final judgment in the merits, it can be expected to take up to 2 or 3 years to exercise the rights enshrined in the Basic law, in Article 11 of the Charter and in Article 10 of the European Convention of Human Rights. It is to be noted that the brief report whose publication is at stake was intended to form part of Forbes’s Hungary’s 2019 compilation, and hence will necessarily lose all of its relevance, newsworthiness and interest by the time it may be allowed to be published.
2. Magyar Narancs’ investigative reporting
Magyar Narancs, a political weekly distributed nationally in Hungary, intended to publish an in-depth report on Hell Energy Ltd. and its owners. The article would publish personal data showing criminal convictions of two members of the family. In one case, the fact of the conviction for attempted murder by the Romanian state was commented by the data subject in an article published in 2007. The other data related to criminal conviction is about a tax fraud case. Both criminal convictions were final decisions, without further potential to appeal. The article would also publish personal data on the wealth and business activity of the data subjects.
The data subjects were granted an injunction by the Metropolitan Court of Budapest with regard to the personal data on criminal convictions. As a consequence, Magyar Narancs had to publish a curtailed, severely edited version of the report that was in preparation during the first-instance procedure. Practically, by issuing the injunction, the court stepped into the role of editing journalistic content. Both Magyar Narancs and the petitioners’ appealed the injunction, the former to have standing prohibitions removed, while the latter to extend the injunction to the personal data not covered by the injunction.
B. Civil law litigation to finalize prior restraint
a) What is the alleged legal basis and SLAPP-strategy?
Data subjects who have been granted an injunction as detailed above must ultimately initiate a civil lawsuit in order to keep the injunction in effect, and to finalize the effect of the restraint they can enjoy on an interim basis. The central claim asks the court to declare a violation of personality rights under the Civil Code as a result of unlawful data processing. Personal data protection rights can be vindicated as rights relating to personality under the Hungarian Civil Code.
Petitioners of an injunction are not required to Initiate a lawsuit even if the injunction is granted. Data subjects may achieve their aim of silencing the press, or delaying the publication of a material that quickly loses relevance, even without assuming the burdens of pursuing a lawsuit.
b) How have courts decided?
No decision has been reached yet in the only procedure launched so far (see the Forbes case description below). As the lawsuit must be based on rights-claims invoked in the request for a preliminary injunction, we can expect a lawsuit against Magyar Narancs too on the same legal grounds (if any).
c) Why are these procedures alarming for the freedom of the press?
In substance, personality rights-based claims against the press are not new, but they have not been based on unlawful data processing; instead, typically, reputational rights were invoked earlier. The difference is significant because there are content- and style-related limits on what statements of and concerning a particular natural person may qualify as civil defamation. However, unlawful data processing is not inherently limited by similar content- or style-based constraints: any publication of a statement of and concerning a particular natural person – even if demonstrably true and not even offending in tone – may in principle violate personal data protection rights.
Procedurally speaking, if petitioners of the injunction launch a lawsuit, the injunction stays in effect until the first-instance ruling of the court is delivered. This can take several months, if not years. These procedures are general civil courtroom procedures which do not enjoy any priority despite their effect on the opportunities of the press to engage in journalistic research and reporting. Not only do they impose a considerable financial burden on the defendant publisher, but they may also make it impossible for the press organ to publish material while it has any currency or relevance given the contingencies of the news cycle. If plaintiffs win such cases, the judgment finalizes, in effect, the prior restraint on the press organ concerned.
d) Specific case description
1. Forbes
The petitioners for the injunction petitioned the Metropolitan Court to decide the case in merits. (It took them 3 months to present a formally flawless petition.) Petitioners request the court to declare a violation of personality rights under the Civil Code as a result of unlawful data processing. Representing Forbes, HCLU attorneys submitted a counter petition objecting the claim. The court has to decide the following issues: i.) whether Forbes has the right to process data; ii.) whether Forbes can use the data to edit its lists; iii.) what kind of auxiliary obligations burden the press organs if the processing is legal (providing information to the data subjects; demonstrating overriding interest in case of objection). As a result of the complexity of the Hungarian civil procedure, the petition is challenged on procedural bases as well as on the merits.
2. Magyar Narancs
It is yet unknown whether a civil lawsuit will follow the injunction in this case. Petitioners of the injunction have a few more weeks left to decide whether they wish to launch the civil lawsuit.
C. Procedures by the National Authority of Data Protection and Freedom of Information
a) What is the alleged legal basis and SLAPP-strategy?
Data subjects file a complaint with the national data protection authority, based on the Act on the Right to Informational Self-Determination and Freedom of Information against the publisher of the press organ which is preparing a report featuring data subjects’ personal data. Data subjects typically learn that such a report is in preparation by receiving questions from the journalists involved. Complainants so far have made GDPR-based claims of unlawful processing of their personal data – in particular, that their right to be informed about the data processing as well as their right to object to data processing have been violated, and no overriding public interest justifies processing of their personal data without consent or statutory authorization.
b) How has the authority decided?
According to the Authority’s two decisions against Forbes, exercising freedom of the press – especially with the given content – does not amount to performing a task carried out in the public interest, therefore Article 6 (1) e) is not a valid legal basis for data processing in pursuit of journalistic activities. Instead, the legal basis of the journalistic processing of personal data is merely a “legitimate interest”, according to Article 6 (1) f). Therefore, the controller has to balance its own interests against those of the data subject. Pointing to Article 47 of the Preamble, the Authority is of the view that the controller is obligated to carefully assess whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place. Applying the “legitimate interest test” – in the Authority’s view – has to be documented. As Article 13 and Article 14 prescribe the duty to inform the data subjects on purposes and legal basis of the processing, this encompasses the duty of the publisher of a press organ to inform data subjects on the criteria used in applying the “legitimate interest test” as well as its result.
The Authority’s investigation against Magyar Narancs is still in progress.
c) Why are these decisions alarming for the freedom of the press?
In substance, the rulings – if they remain in effect after judicial review – promote an interpretation of GDPR rights and obligations which impose a duty on press organs to conduct highly individualized balancing of data protection vs. data processing interests and to preliminarily and proactively inform data subjects of the criteria and result of such balancing exercises. This way of making authorial and editorial decisions is thoroughly alien to standard practices and goes beyond all reasonable expectations of due care in (ethical) journalism, imposing an immense administrative burden on journalists and editors alike.
Procedurally speaking, the obligation to participate in the investigation of the Authority imposes a considerable administrative and financial burden on the publishers and journalists involved. They have to provide the Authority with a significant amount of factual information requested within short deadlines, derailing editorial and journalistic work flows. If the Authority finds violations as alleged by the complainants, sanctions can involve heavy fines.
Both the substance of decisions so far and the procedural burdens are highly likely to have a chilling effect on journalistic investigative reporting on business life and the interrelations of economic and political influence – and more generally on journalistic reporting which covers specific facts about specific natural persons instead of mere generalities.
d) Specific case descriptions
1. Two procedures against Forbes
The owners of Hell Energy Ltd. – who have also had recourse to a preliminary interim measure and launched a civil lawsuit against Forbes – initiated an administrative complaint procedure with the Authority against Forbes. The complaint raised the same claims as the civil litigation pursued at the same time: unlawful processing of personal data; violation of the right to be informed; lack of justification of overriding public interest. Similarly, another family (owners of Futurama, one of the biggest construction companies in Hungary) filed a complaint with the Authority, objecting to their appearance on the Forbes lists, raising similar questions. The Authority delivered its decisions on 27th of July 2020, and on 4th of August 2020, respectively. The common findings were the following.
The Authority established that the personal data used by Forbes in order to compile its “lists of the wealthy” are data of public interest found in the company registry and they can be processed in order to inform the general public on the financial or commercial affairs of business entities. Importantly, in the view of the Authority, the legal basis of the processing is Article 6 (1) f) of the Regulation whereby the processing is lawful when it is necessary for the purposes of the legitimate interest pursued by the controller or by a third party. The data subjects are influential actors in the regional business, thus their business related activity is part of the public life. The Authority also pointed to Article 153 of the Preamble of the Regulation according to which it is necessary to interpret notions relating to freedom of expression, such as journalism, broadly. Evaluating specifically the “wealth lists” edited by Forbes, the Authority emphasized that this kind of journalism does not amount to the “watchdog” function of the press, and Forbes merely satisfies the public’s need to read gossips.
What the Authority regarded as the “gossip” nature of the content was an especially weighty consideration in declaring that this exercise of the freedom of the press does not amount to performing a task carried out in the public interest, therefore Article 6 (1) e) is not a valid legal basis for data processing in pursuit of journalistic activities. The processing of the personal data concerned was lawful, but the legal basis of the processing was merely a “legitimate interest”. Within the frame of the “legitimate interest test”, the controller has to consider whether its processing performs a watchdog function or merely regarded as “spreading gossip”; the processed personal information is connected to other data which fall under the scope of the freedom of information regime.
Despite the fact that Forbes proactively contacted the data subjects, informing them that they would appear on the lists and requested input on the correctness of the calculations, the Authority declared that Forbes failed to justify its legitimate interest to the data subjects.
Further, Forbes failed to carry out a reasonable “legitimate interest test”, consequently it did not document it properly, nor did it provide appropriate information for the data subjects. For these violations of data protection regulations, Forbes was ordered to pay 3000 EUR fine in each case (6000 EUR combined).
Representing Forbes Hungary, the HCLU petitioned the Metropolitan Court of Budapest for the judicial review of the Authority’s administrative decision. We maintain that the legal basis of the processing is Article 6 (1) e) of the Regulation, therefore the legitimate interest test and the attached proactive duty to inform the data subjects do not burden Forbes. The interpretation of the Authority puts an excessive legal and financial burden on press organs, as carrying out the legitimate interest test -- as well as informing data subjects individually of the reasons for a particular outcome of applying the test -- in each and every case when the press uses personal data undermines timely journalistic reporting. If the mere failure to carry out such tests is fined, that can be expected to result in a severe chilling effect.
2. Procedure in progress against Magyar Narancs
The owners of Hell Energy Ltd. – who have also had recourse to a preliminary interim measure against Magyar Narancs – initiated an administrative complaint procedure with the Authority. The Authority’s investigation is in progress.