Skip to main content
Disciplines
Automotive Business IT + Informatics Construction + Real Estate Electrical Engineering + Electronics Energy + Sustainability Insurance + Risk Finance + Banking Management + Leadership Marketing + Sales Mechanical Engineering + Materials
Events
DE
EN
Books
Journals
Topic Page
Marketing
Start single access now
Access for companies
EXTENDED SEARCH
Log in
Top
Health and Technology
Published in: Health and Technology 4/2017

21-02-2017 | Original Paper

Hungary’s unorthodox approach to personal privacy

Author: Zoltán Alexin

Published in: Health and Technology | Issue 4/2017

Log in

Activate our intelligent search to find suitable subject content or patents.

search-config
loading …

Abstract

Hungary’s special approach to political and social questions is frequently analysed by the media. Taking a closer look at the details of the privacy regulations, we can also identify several unique features. For Hungary, the era of socialism ended with the proclamation of the new Republic of Hungary on 23rd October, 1989. The substantially renewed constitution was entered into force on the same day. The fundamental rights defined in the European Convention of Human Rights were included in it and, in addition, the right to the protection of personal data. The main characteristic of the legal system is that politicians understand the constitution so that it would always require passing a new law whenever they want a public authority to collect personal data for some purpose. By now, Hungary has several hundred laws and decrees in effect on the obligatory collection and transfer of personal data. The nature of such types of regulation ab ovo excludes the possibility of objection and challenging a regulation before the court. Turning our attention to healthcare, we see that medical authorities and researchers are authorized by the law to collect personal medical data without providing information and the right to object to data subjects. The author has been studying the changes in the medical privacy regulations since 2004. Here, he gives an account of the key characteristics of the Hungarian legislation and provides a comparison with the relevant European Union legislation in relation to medical data. When the EU General Data Protection Regulation came into force, the conflict between the two became obvious. This paper gives the reader an expert’s view of the Hungarian data protection policy, while attempting to pave the way to stimulate social debate concerning the necessity for better, and more privacy aware legislation.
previous article The choice architecture of privacy decision-making
next article Personal control of privacy and data: Estonian experience

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

inform now
Footnotes
1
In the People’s Republic of Hungary, workers and their families were entitled to receive a voucher for a one-week holiday, at a resort hotel, with full board, by paying a symbolic nominal price. This could never have been fully realised as the whole population could never have been catered for in this way. However, with this social programme, many in Hungary were able to go on vacation for the first time in their lives.
 
2
In fact, the author can mention one exception. The Ombudsman of Hungary filed a successful complaint in the case of medical certification given to the prostitutes stating that they do not suffer from STDs, decision number 1/2011. The certification contained the word ‘prostitute’ and the Ombudsman claimed that it violated the New York Convention on Exploitation of Prostitution.
 
4
Within the Republic, there are now roughly 200–300 laws and 300–400 decrees in effect, according to the national legislation database (the exact numbers vary from day to day) that has instructions related to the obligatory processing of personal data – even minimally, not only in medicine, but in the course of routine actions in public administrations, schools, universities, insurance companies, banks, public services, transportation, and other commercial activities. In medicine, there are 10 laws, and at least 30–40 decrees on obligatory personal data processing – mainly on reporting health data to an authority, or on documenting some type of examination.
 
5
Bundesverfassungsgericht, Urteil vom 15. Dezember 1983, 1 BvR 209/83, 1 BvR 484/83, 1 BvR 440/83, 1 BvR 420/83, 1 BvR 362/83, 1 BvR 269/83 (Volkszählungsurteil). An English translation of the decision can be found here: https://​freiheitsfoo.​de/​census-act/​
 
6
Alfred Kobsa a privacy researcher at the University of California in Irvine saved the English translation of the Data Protection Act of 1992, which he obtained from the Office of the Hungarian Parliamentary Commissioner for Citizens’ Rights [10].
 
7
The new Data Protection Act of Hungary allows collecting personal data revealing racial origin or nationality, political opinions and any affiliation with political parties, religious or philosophical beliefs or trade-union membership, and personal data concerning one’s sexual life only when data subject consents.
 
8
Before Hungary’s accession to the EU, the European Parliament passed a decision that Hungarian law provided adequate protection of personal data in 2000 [12].
 
9
C.f. the old Data Protection Act, Section 3: “Personal data may be processed if the person concerned agrees thereto, or it is ordered by an act or a local government decree on the basis of the authorization of an act, within the limits defined therein.” [10]
 
10
Data subjects may object to the sale of their name and address records to companies for marketing purposes by the Hungarian population registry, the transferring of their archived prescription data to a pharmacist by the National Health Insurance Fund, or the transferring of their medical care data to their GP or the treating physician by the National Health Insurance Fund.
 
11
Later the Court of Justice of the EU (CJEU) condemned Hungary in case C-288/12, because it violated the 95/46/EC Directive, Article 28. This requires that the position of the Data Protection Commissioner must be independent of the government in power.
 
12
The Government of Hungary sent a questionnaire to all adults, which had asked each recipient to fill them in, and then to return their opinions. The national population registry provided the necessary data, the list of names and addresses. This was the so-called “Social Consultation” (Társadalmi konzultáció). Each questionnaire contained a unique barcode that established an indirect connection with a specific natural person. During processing the questionnaire answers were recorded together with the barcodes. For a second step, the Government had planned to create a database of their politically active supporters, (Case number: ABI-1642-4/2011/H) http://​abi.​atlatszo.​hu/​index.​php?​menu=​aktualis/​allasfoglalasok/​2011&​dok=​ABI-1642-4_​2011_​H.
 
13
First, the data controller decides according to its points of view, whether obtaining consent requires a disproportionate effort or not. If a data controller chose the legitimate interest as the reason for the personal data processing, then it should give a preliminary explanation to the data subjects, and they may object to the processing of their data. Ultimately, data subjects may turn to the competent national court. This should not be a kind of obligatory processing of personal data.
 
14
The Data Protection Commissioner of Hungary declared, first on 31st May 2011 (case no: ABI-2136-3/2010/K), that there is no legal possibility to record “street views,” by GSV, see http://​abi.​atlatszo.​hu/​index.​php?​menu=​aktualis/​allasfoglalasok/​2011&​dok=​ABI-2136-3_​2010_​K). After the Hungarian Parliament passed the amendment, the newly appointed commissioner issued another statement in which he acknowledged that GSV could begin to operate (case no: NAIH-5711-16/2012/B), http://​naih.​hu/​files/​Adatvedelem-NAIH-5711-162012B-Google-SV.​pdf.
 
16
Sections 52–54 of the Act II of 1972 on Healthcare required written consent in the case of living donor transplantation, from the donor and the recipient, and in the case of a cadaver transplantation from the recipient. Section 47 requested written consent before medical operations.
 
17
In Hungarian it is called TAJ (Társadalombiztosítási Azonosító Jel). It is a nine-digit number in which the last digit is a check digit. See Act XX of 1996 on the Identification Methods Replacing the Universal Personal Identification Number, and the Use of Identification Codes.
 
20
Such as the National Cancer Registry, the Hungarian Congenital Abnormality Registry, the National Tauffer Registry of Live Births, and the Itemized Medical Database of Subsidized Care Events.
 
21
The National Health Insurance Fund collects data about patients treated by novel and innovative methods (there are about twenty of them) in order to monitor the effectiveness and success rate of the procedure.
 
22
The Heart Infarct Registry, the National Registry of Implants and Prostheses, and the Stroke Register (planned).
 
23
For example, Hungarian Civil Liberties Union, http://​www.​tasz.​hu, the Ombudsman of Hungary (cases: 1/2011, 17/2014), and the Data Protection Commissioner (36/2007).
 
24
The CODICES is a database on the Constitutional Case Law of the Venice Commission at the Council of Europe. It collects English and French translations of constitutions and Constitutional Court decisions from many countries, http://​www.​codices.​coe.​int
 
25
The Supreme Court (Case no: 2029/2009.) decided that the parents who have hindered vaccination of their child are not guilty of the crime of endangering minors. The Chief Prosecutor proposed to sentence them for up to five-year imprisonment based on the Act IV of 1976 on the Penal Code, Section 195. According to the court’s decision, parents only committed an administrative offence and could therefore be fined. The public health authority denounced these parents to the prosecutors’ office. See http://​www.​lb.​hu/​hu/​elvhat/​20292009-szamu-bunteto-elvi-hatarozat
 
26
Paediatric Clinic Number 1 at the Semmelweis Medical University of Budapest and the Paediatric Clinic at the University of Szeged
 
27
The Act C of 2012 on the Hungarian Penal Code, Section 213 says that unauthorized changing of family status of a child is a qualified crime and carries up to a five-year prison sentence when it is committed by a healthcare professional.
 
28
Decree 33 of 1998 (24th June) originally issued by the Minister of Social Welfare.
 
29
The decision of the Constitutional Court No. 3201/2013 is on the homepage of the Court: http://​public.​mkab.​hu/​dev/​dontesek.​nsf/​0/​01BF09BD60225F1B​C1257ADA00524D92​?​OpenDocument
 
30
People who don’t go for medical screening will pay more (János Lázár, Minister of the Cabinet, 17th June 2016.), http://​aktiv.​origo.​hu/​gazdasag/​20160617-tobb-tb-t-fizethet-aki-nem-jar-szuresre.​html
National Medical Screening Programme: We must visit doctors regularly (28th May, 2013), http://​www.​vg.​hu/​vallalatok/​egeszsegugy/​nemzeti-szuroprogram-rendszeresen-orvoshoz-kell-majd-jarni-404479
 
31
It was later revealed that the entity that compromised the information of patients might have been the newly founded Fejér County Office of the Government, Public Health Body.
 
32
The Public Health Body has not been authorised (i.e. obliged) to transfer screening data to GPs, and patients apparently did not give their consent to the data transfer.
 
33
The practice was first mentioned in the Report on the Financial and Subsidisation System of Medicines and Consumption by the State Audit Office, October 2004, page 70, https://​asz.​hu/​storage/​files/​files/​%C3%96sszes%20​jelent%C3%A9s/​2004/​0448j000.​pdf?​ctid=​758. The complaint was mentioned in the Annual report of the Hungarian Data Protection Commissioner 2004, page 66, case number 267/A/2004, http://​naih.​hu/​files/​Adatvedelmi-biztos-beszamoloja-2004.​PDF
 
34
The decision number is 29/2009. (20th March).
 
35
Decree 53 of 2007 (7th December) on Accreditation Rules for Medical Prescribing Software
 
38
Unfortunately, Act XLVII of 1997 has no English translation. The up-to-date Hungarian text in force can be retrieved from the National Legal Repository: http://​www.​njt.​hu
 
39
In 2009, two companies approached the Clinical Centre at the University of Szeged and offered money for the pseudonymised prescription data. The author as a member of the Research Ethics Committee recommended not selling data and sent in a complaint to the Data Protection Authority, but it failed to act against the companies. The requested ‘pseudonymous’ data contained the prescription numbers and demographic data (date of birth, ZIP code of the resident address and gender).
 
40
The prescription number is an 18-digit number, the first two digits are 21, then comes the last two digits of the year of printing (2015 is coded as 15), a reserved digit (zero), a 5-digit licence number of the prescriber, 6-digit serial number, one-digit prescription type (1 - normal, 2 - pro familia, 3 - ophthalmologist, etc.) and a checking code. Licence numbers are public data, hence available to everyone.
 
41
The English translation of the law can be found on the homepage of the Constitutional Court: http://​hunconcourt.​hu/​rules/​act-on-the-cc
 
43
The official translation of the Act CLI of 2011 on the Constitutional Court can be found on the homepage of the Court: http://​hunconcourt.​hu/​rules/​act-on-the-cc
 
44
See Article 99, Paragraph 1: This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
 
45
The institution of a living will exists in Hungary. Nevertheless, the formal criteria of a living will make it difficult to apply. Patients ought to express their will – before a notary public in advance, and they should hand it over when being hospitalized. If patients are unable to present their living will to the doctor in the hospital, then their only hope is that they have given a copy of the living will to the family doctor previously, and the family doctor will notify the hospital. A living will can be elaborated only after the lethal prognosis is communicated, but the patient still has the capacity to understand the consequences of his/her decision. A committee of three physicians (the treating physician, an independent specialist, and a psychiatrist) should approve the living will. See Act CLIV of 1997 on Healthcare, Section 20.
 
Literature
1.
Cartledge B. The will to survive, ISBN: 978–1849041126: Columbia University Press; 2011.
2.
3.
Kende T., Nagy B., Sonnevend P., and Valki L. (editors): Nemzetközi Jog (International Law), ISBN: 978–9632953823, Complex Kiadó, 2014.
4.
Gárdos-Orosz F.: The Hungarian Constitutional Court in Transition – from Actio Popularis to Constitutional Complaint, Acta Juridica Hungarica, Vol.: 53, No.: 4, pp. 302–315, Akadámiai Kiadó, 2012, DOI: 10.​1556/​AJur.​53.​2012.​4.​3.
5.
6.
7.
8.
Mayer-Schönberger V.: Generational Development of Data Protection in Europe, in Technology and Privacy: The New Landscape, (eds.) Agre, Phillip E. and Marc Rotenberg, pp. 219–242, ISBN: 978–0262511018, Cambridge, MA, MIT Press (1998).
9.
10.
11.
12.
13.
14.
Act II of 1972 on Healthcare, Tanácsok Közlönye (Municipality Gazette), No 20/1972, Library of the Hungarian Parliament, 357–373.
15.
Alexin, Z.: Az orvosi vények adatvédelmi problémái, (Data protection questions concerning medical prescriptions), Orvostovábbképző Szemle, Vol.: XIX. 6, 65–70 (2012).
16.
17.
Hanti, P.: Kommentár az egészségügyi és a hozzájuk kapcsolódó személyes adatok kezeléséről és védelméről szóló 1997. évi XLVII. törvényhez (Commentaries to the Act XLVII of 1997 on Health Data Processing and Protection), ISBN: 978–9632952703, Wolters Kluwer Ltd. (2013).
18.
Németh K. Fertőző betegség és emberi jogok (Transferable disease and human rights). Med & Jur. 2014;5(3):14–7.
19.
20.
21.
Alexin Z.: Protecting Privacy in Medical Research, in Lege Artis Medicinae, Vol. 16, No. 6., 594–597, ISSN: ISSN 0866–4811, in Hungarian (2006).
22.
23.
24.
25.
Rothstein, M. A.: Is Deidentification Sufficient to Protect Health Privacy in Research, The American Journal of Bioethics, Vol. 10, No. 9, pp. 3–11, Taylor & Francis Group (2010).
26.
Alexin, Z.: Az EESZT adatvédelmi problémái a jogi szabályozás tükrében, (Privacy questions concerning the Electronic Health Cooperation Service Space in the light of the legal regulation), in Hungarian, Interdiszciplináris Magyar Egészségügy, Vol. XV. No. 5, pp. 56–60, Larix Kiadó Kft. (2016).
27.
28.
29.
De Hert, P., Gutwirth, S.: Data Protection in Case Law of Strasbourg and Luxemburg: Constitutionalisation in Action, pp. 3–44, Reinventing Data Protection, ISBN: 978–1–4020-94972, Springer (2009).
30.
31.
Consolidated versions of the Treaty on European Union and the Treaty on the Functioning of the European Union - Protocols - Annexes - Declarations annexed to the Final Act of the Intergovernmental Conference which adopted the Treaty of Lisbon, signed on 13 December 2007 - Tables of equivalences Official Journal C 326, 26/10/2012 P. 0001–0390, http://​eur-lex.​europa.​eu/​legal-content/​EN/​TXT/​?​uri=​CELEX:​12012E/​TXT (retrieved 31st August 2016).
32.
33.
Regulation (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, Official Journal 4.5.2016 L 119/89, http://​eur-lex.​europa.​eu/​legal-content/​EN/​TXT/​?​uri=​CELEX%3A32016L0680 (retrieved 31st August 2016).
34.
Csáky-Szunyogh M, Vereczkey A, Gerencsér B, Czeizel AE. Maternal hypertension with nifedipine treatment associated with a higher risk for right-sided obstructive defects of the heart: a population-based case-control study. Heart Asia. 2014 Jan 23;6(1):3–7. doi:10.​1136/​heartasia-2013-010331.CrossRef
35.
Vermes G, László D, Mátrai Á, Czeizel AE, Ács N. Maternal factors in the origin of isolated anorectal malformations – a population-based case-control study. Journal of Maternal-Fetal & Neonatal Medicine. 2016;29(14):2316–21. doi:10.​3109/​14767058.​2015.​1085014.
36.
Metadata
Title
Hungary’s unorthodox approach to personal privacy
Author
Zoltán Alexin
Publication date
21-02-2017
Publisher
Springer Berlin Heidelberg
Published in
Health and Technology / Issue 4/2017
Print ISSN: 2190-7188
Electronic ISSN: 2190-7196
DOI
https://doi.org/10.1007/s12553-017-0181-7

Other articles of this Issue 4/2017

Health and Technology 4/2017 Go to the issue

Original Paper

Reflections upon periclitations in privacy: perspectives from Rwanda’s digital transformation

Editorial

An introduction to the contributors

Editorial

Privacy matters: updating human rights for the digital society

Original Paper

Oversight of EU medical data transfers – an administrative law perspective on cross-border biomedical research administration

Original Paper

Regulation of Big Data: Perspectives on strategy, policy, law and privacy

Original Paper

The end of privacy for the populace, the person of interest and the persecuted

Premium Partner

    Image Credits