How to Gag Journalism in Hungary: Use GDPR
Forbes Hungary was forced to withdraw an issue of the magazine following a complaint from a wealthy business group. The Hungarian Data Protection Authority concurred and fined Forbes, setting a highly dangerous precedent for the country’s independent news media.
By Zsuzsa Detrekői
In January, a Hungarian court ordered the local publisher of Forbes, an American business magazine, to recall from newsstands, due to privacy reasons, the issue of the magazine featuring the list of the richest Hungarians.
Forbes publishes the list of the wealthiest Hungarians every year. This year’s list, published last January, included the owners of Hell Energy Drink, a large domestically owned energy drink manufacturer. Their wealth was estimated based on publicly available company data and reports.
Nevertheless, Hell Energy Drink’s owners were annoyed by their appearance on the list. They argued that Forbes breached their privacy and, in addition to lodging a legal suit, they also approached the Hungarian Data Protection Authority with a complaint.
The Authority imposed two fines on Forbes worth €5,780 (HUF 2m) and €7,225 (HUF 2.5m) for failing to run a proper balancing test and comply with the proper information obligation, respectively, according to the General Data Protection Regulation (GDPR), EU’s directive aimed at protecting personal data.
GDPR and Journalism: Are They Compatible?
According to the GDPR, all personal data processing requires a legal basis. Articles of newspapers usually contain many sorts of personal data such as names, ages or profession, which means data processing is necessary, as required by GDPR.
Article 85 of GDPR requires European Union Member States to provide exemptions or derogations to reconcile data protection with freedom of expression and information. However, Hungary has thus far failed to adopt such rules. Since there is no law to govern data processing in journalism, newspapers have to rely on the six possible legal bases provided by the GDPR (consent, performance of a contract, compliance with a legal obligation, protection of vital interest, public interest or legitimate interest).
Three of the above-mentioned legal bases (performance of contract, compliance with a legal obligation and protection of vital interest) are out of question. As people criticized in articles are highly unlikely to give their consent to publication, consent can’t serve as legal basis either. So only two possible legal bases remain.
The Authority has recently decided that public interest can’t be used as legal basis for data processing in case of economic journalism. Referring to Article 6 (1) (e) of the GDPR, the Authority wrote that the legal basis “may relate to a data processing activity related to a public task classified as such by law.
Although economic journalism is an activity in the public interest, it is not a public task
[…], [and] a journalist cannot be considered a person performing a public task.”
Only legitimate interest remains as a possible legal basis, but the Authority thinks that Forbes failed to carry out a proper balancing test and to comply with prior information obligation, as “it did not provide information on the purpose and legal basis of the data processing, the legitimate interests pursued by the controller or by a third party and the outcome of the balancing test, the expected consequences of profiling, the rights of the Applicants as data subjects and the right of the Applicants to lodge a complaint.”
Forbes appealed the verdict.
What Can Journalists Do?
Hungary, where journalism is in a dire situation, failed to adopt legislation to balance data protection and freedom of expression. Now it seems that public interest can’t be used by newspapers as a legal basis to process personal data, for example, by writing about influential businessmen.
Therefore, legitimate interest remains the only possible legal basis allowing newspapers to publish articles containing GDPR-protected data. According to the recent decisions of the Authority, for every article that contains personal data, news media have to carry out a balancing test: the data subjects should be informed, before the publication of a news piece, about their own interests and the legitimate interest of the public as well as the results of the comparison with the interest of the data subjects.
If the data subject, that is the person included in the article, doesn’t agree to appear in the article, then a second, individual balancing test is necessary. But that requires the cooperation of the person covered in the story. Without his or her cooperation, the newspaper is not able to make a second evaluation of the data processing impact.
As a result, the person in the article can block publication by simply not agreeing with his or her personal data being processed by the journalist, which is going to make journalistic work totally impossible. Carrying out a balancing test for all the articles that it plans to publish is a huge administrative task for all media outlets, requiring immense human and financial resources, which they do not have, especially given the dismal state of independent media in Hungary.
The two decisions of the Authority in the Forbes case thus pose an existential threat to journalism, making publication of any kind of articles that contain personal data dependent on the goodwill of any person mentioned in the article, especially those criticized in the article. As most independent media outlets in Hungary don’t have the resources to comply with the administrative requirements needed to be fulfilled before publishing such articles, that basically means the end of independent journalism in Hungary.