We received several reports on our election hotline during the campaign about the improper handling of personal information. If this has happened to you, you can contact the National Data Protection and Freedom of Information Authority (NAIH), the organization responsible for protecting personal data, or go to court.
Unsolicited calls from parties
Political parties may use your information lawfully if you have provided them explicitly for campaigning purposes or if they have been retrieved from the central electoral register (you can disable this option, please see this link for help). Importantly, according to NAIH, personal data may only be used for a specific purpose. Therefore if a party collects signatures and other personal information for a petition but later uses the contact information provided during the campaign, that is illegal, unless your permission for future use has been specifically requested.
If you receive a letter or a call from a party in spite of your ban or they otherwise attempt to contact you but you do not remember ever providing your information for this purpose, you have the right to ask for information about exactly what data is being processed and what source they have it from. You also have the right to delete all information recorded about you, which means that you can prohibit further processing (you can find an email sample here for requesting information and/or the deletion of data). If your data was previously processed with your consent but you have changed your mind, you can disallow further processing and exercise your right of deletion. If the party contact you personally again despite the deletion of your details, you can either go to NAIH or go to court—read more about this below.
Suspicious polls
Many people turned to us reporting that they have been approached by an unknown public opinion polling company to ask about their political preferences. Opinion polls may use the public databases of telephone service providers (these are essentially offline or online phonebooks) but only if the subscriber has explicitly allowed polling requests at the time of the conclusion of the contract. This authorization may also be revoked at any time. And if you don't want your phone number to be included in the public database at all, you can prohibit it. Having done so, it also may not be obtained from other sources, such as your Facebook page, your workplace website, or a professional registry.
Some polling companies operate by calling randomly generated numbers instead of using public databases, claiming that as they know nothing about the person other than a telephone number they do not process any personal information that would make the person's direct identification possible. However, NAIH's position, in accordance with that of the former Data Protection Commissioner, is that this practice is so harmful to privacy that the use of such technology is not permitted at all.
What can you do if your data is misused?
If, based on the above, you believe you have been the victim of unauthorized data processing, there are several remedies available to you.
1. You can initiate the NAIH Data Protection Authority's procedure: Anyone who thinks that their data is being processed illegally can contact NAIH by naming the particular data controller and briefly outlining what happened. If the procedure reveals that an infringement has occurred, NAIH will delete the illegally processed data and may impose a fine on the controller. To initiate the procedure, please find the HCLU form here.
2. By filing a report, you may request an investigation from NAIH: In this case, NAIH will not investigate your specific case, but the controller's general privacy practices. Investigation can be a good tool to uncover systemic problems, moreover, you can initiate it even if your rights were not violated personally. But in case your rights were violated, this process may not lead to the remediation of those violations.
3. You can file a privacy lawsuit: In this lawsuit, the data controller has to prove that they have acted within the law, and if they do not succeed in this, they may be liable to pay damages to you. It is important to note that the courts enjoy more independence than NAIH, whose chairman is essentially chosen by the prime minister and is, therefore, more closely linked to the prevailing government. Should you lose your lawsuit, you will have to pay the litigation costs, which can be some ten thousands forints or, if an appointed expert also needs to be involved, it can go up to a hundred thousand.
At HCLU, we will continue to do our best to ensure that both political parties and companies handling the data of thousands of users are accountable in the campaign and do not illegally influence the will of voters. If you believe your information has been misused during the election campaign, please contact our legal aid service.