The Hungarian DPA (NAIH) published two decisions (NAIH/2020/1154 and NAIH/2020/838) in connection with the list of the 50 wealthiest Hungarians and the list of the biggest family-owned businesses published by Forbes Hungary. The amounts of the fines were EUR 5,780 (HUF 2,000,000) and EUR 7,225 (HUF 2,500,000) respectively.

The data used for the publication had been collected from public sources, including the company register. Although the (estimated) value of the company in which the Applicants (data subjects) have an interest is not part of the company register but the publications do not present the personal assets of the Applicants, but the value of the business and the amount of wealth collected as a result of the business activity are estimated, the conclusions were drawn from publicly available company data and information, company reports and the company’s own communications. For the estimation, the Magazine collected the data from public sources, then evaluated it according to a specific methodology and provided it as an opinion.

The decision of the Authority contains important aspects regarding the collision of the right to data protection and the freedom of expression and information. 

1. Some of the key points in the decisions in connection with the legal basis of the data processing are as follows:

• “It should also be taken into account that Forbes is a press product containing articles and compilations written in the field of economics, therefore the Authority considers that the publication of the information available in registers, which are accessible to the public and the data and information contained in the companies' own public announcements and reports in various compilations does not infringe the principle of purpose limitation.” (Decision no. 2020/1154, p. 34)
• “It should also be emphasized that the estimation of the assets resulting from an economic activity or the value of a company determined by a specific estimation method clearly falls within the scope of freedom of expression. For the estimation, the Magazine collected data from various public sources and then evaluated the data based on a specific methodology.” (Decision no. 2020/1154, p. 34)
• “The processing of (personal) data from publicly available databases, companies' own communications and reports, as well as the evaluation of the collected data according to a specific methodology and the valuation, even of newly generated data, are related to the journalistic activity of the Magazine. The fact that the disclosure of this information may (also) be for profit-making purposes does not preclude it from being considered as a journalistic activity.” (Decision no. 2020/1154, p. 37)
• “[…] according to the Authority's opinion, there are no indications that the compilation of wealthiest lists is a "watchdog" type of activity and that such activity is linked to a specific public debate. These lists are published regularly (annually) and do not relate to specific events, but to who and to what extent they have become rich in a given period, regardless of the source of the wealth, as the lists are compiled on the basis of a specific methodology and not on the basis of the facts regarding who and which enterprise received state aid, so the compilations also include persons and enterprises that did not receive state aid. While economic journalism may indeed have a “mission”, but a “wealthiest list” as a product is not primarily and directly related to public debate, but satisfies a “gossip hunger” as it is not a matter of direct fact-finding, investigative journalism (that characterizes the “watchdog” type journalism), but that the Magazine estimates the value of the enterprises and, in the case of persons, the amount of assets that can be derived from the activities of the enterprise on the basis of publicly available information, and then ranks the companies and persons on the basis of the estimated value or assets.” (Decision no. 2020/1154, p. 38)
• “The reference to economic journalism as an activity of public interest cannot be accepted as a legal basis for data processing […]. This is because the legal basis under Article 6 (1) (e) of the General Data Protection Regulation may relate to a data processing activity related to a public task classified as such by law. Although economic journalism is an activity in the public interest, it is not a public task […], just as a journalist cannot be considered a person performing a public task. […]”  (Decision no. 2020/1154, pp. 38-39)
• “The General Data Protection Regulation itself does not classify journalistic activity as a legal basis under Article 6 (1) (e). This is also supported by the fact that Article 17 (3) (b) follows exactly the terms used in Article 6 (1) (e) […]. However, the possibility of ignoring the obligation to the erasure of data relating to the freedom of expression is not covered by this point but by Article 17 (3) (a).” (Decision no. 2020/1154, p. 39)
• “[…] "rich lists" and, in general, all data processing related to business journalism, which is not based on consent, may be based on the legitimate interest under Article 6 (1) (f) of the General Data Protection Regulation.” (Decision no. 2020/1154, p. 39)
• “In this balancing test, the data controller must consider, inter alia, whether a public actor is concerned (if so, this strengthens the data controller's interest in data processing) and whether the journalistic activity in question is of an investigative nature (this again also strengthens the data processing interest) or it is only to satisfy a “hunger for gossips” (in which case the interest in the protection of personal data is stronger). The balancing test is also successful if the article in question is about public subsidies or otherwise contains data that is public due to public interest (eg company data).” (Decision no. 2020/1154, p. 39)
• “In the opinion of the Authority, the legitimate interest indicated by the Magazine is also acceptable […], however, the Magazine infringed Article 6 (1) (f) of the General Data Protection Regulation and the principle of accountability under Article 5 (2) since it did not properly carried out the balancing test and it failed to inform the Applicants in advance about its own interests and the legitimate interests of the public, as well as the results of the comparison with the interests of the Applicants.” (Decision no. 2020/1154, p. 40)

2. Some of the key points in the decisions in connection with the data subjects’ rights are as follows:

• “Given that the Magazine did not collect the data used to compile the lists directly from the Applicants, but used the information contained in various public databases, reports and […] public communications, in connection with the Magazine's prior information obligation, Article 14 of the General Data Protection Regulation shall apply. Consequently, Article 13 of the General Data Protection Regulation, [...], is not relevant in the present case, so that the alleged breach cannot be established.” (Decision no. 2020/1154, p. 44)
• “However, it can be stated that before the publication of the lists, the Magazine (through its journalists) always contacted the Applicants and informed them that they are intended to be included in the list, as well as a short description of the methodology used and the Excel sheet containing the value and wealth estimation based on the methodology were provided to the Applicants and they had the opportunity to comment and clarify the data if necessary, the Magazine did not properly comply with the prior information obligation, as it did not provide information on the purpose and legal basis of the data processing, the legitimate interests pursued by the controller or by a third party and the outcome of the balancing test, the expected consequences of profiling, the rights of the Applicants as data subjects and the right of the Applicants to lodge a complaint.” (Decision no. 2020/1154, p. 45)
• “It can be stated that the Applicant's replies to the Applicants' requests for the exercise of the right of access do not fully comply with Article 15 (1) of the General Data Protection Regulation, since in its replies, the Magazine did not provide information on the expected consequences of profiling, the rights of the Applicants as data subjects and the right of the Applicants to lodge a complaint.” (Decision no. 2020/1154, p. 45)
• “Given that during the first contact […], the Magazine did not draw the Applicants’ attention to their right to object and did not present such information clearly and separately from all other information, the Magazine did not comply with the obligation under Article 21 (4) of the General Data Protection Regulation.” (Decision no. 2020/1154, p. 46)
• “In view of the above, the Authority finds that the Magazine did not commit an infringement by failing to carry out an individual balancing test following the Applicants' objection. […] However, in order for the Magazine to be able to properly perform the second, individual consideration of interests after the objection, it is expected and necessary that the Applicants explain in sufficient details for what reasons they object to the data processing. It should be emphasized that these data may only be processed and used for the purpose of examining the application for the exercise of the right of objection and carrying out an individual balancing test.” (Decision no. 2020/1154, pp. 46-47)
• “The processing (including disclosure) of data relating to the Applicants or the company in the Applicants' interest by the Magazine is one of the exceptions for which the right of erasure cannot be exercised (and a request for erasure of personal data can be legally refused) under the 17 (3) a) of the General Data Protection Regulation since the processing of such data is necessary to ensure the right to freedom of expression and information.” (Decision no. 2020/1154, p. 47)
• “In the present case, therefore, Article 17 (3) (a) of the General Data Protection Regulation provides the balance between the right of erasure and the exercise of the right to freedom of expression and information, thus ensuring, inter alia, freedom of the press and in case of online versions of lists, the freedom of the Internet." (Decision no. 2020/1134, p. 47)

3. The following conslusions may be drawn from the decision:

• Compilations prepared on the basis of a specific methodology, such lists of wealthiest people, may be deemed as opinion.
• Legitimate interest may be used as a proper legal basis for processing personal data in connection with business journalism. However, the balancing test shall be prepared prior to the data processing and must be documented in line with Art. 5 (2) of the GDPR.
• The data subjects shall also be informed in line with the GDPR. Such information obligation cannot be replaced by contacting the data subjects and providing the possibility to comment on the planned publication but information in line with Art. 14 (including information concerning the rights of data subjects) shall be provided.
• The cooperation of the data subjects is necessary for the second, individual balancing test that should be carried out after the data subject's objection to the data processing since without this, the data controller is not in the position to make the specific evaluation of the impacts of data processing on the given individual(s).
• A request for erasure of personal data can be legally refused in such cases since such data is necessary to ensure the right to freedom of expression and information.

Decision under no. NAIH/2020/838 imposing a fine of approx. EUR 7,225 (HUF 2,500,000) on the publisher of Forbes Hungary is based on similar factual circumstances and contains similar conclusions.

(For more information regarding GDPR fines imposed in Hungary in 2020, please see this blogpost.)