Under Hungarian laws, the processing of employee personal data is subject to the special conditions and limitations of the Labour Code due to the likely subordinated position of employees within the context of employment. According to the case law of the Data Protection Commissioner, data quality requirements of the Data Protection Act must be interpreted in the light of the provisions of the Labour Code having cumulative effect with respect to the protection provided for workers under general data protection laws harmonised by the European Data Protection Directive. According to the prevailing opinion, the provisions of the Hungarian Labour Code are specific in relation to the general rules of the Data Protection Act. However, it causes several ambiguities in practice that the Hungarian Labour Code does not have any provisions specifically dealing with data protection issues within the context of employment.

For instance, the Labour Code generally provides that employers shall not violate the personal rights of employees, further the employer may only disclose facts and data relating to its data employee to third persons as specified by law or with the employee’s consent. Information and data pertaining to employees may be used for statistical purposes and may be disclosed for statistical use in such a manner which precludes identification of the individual employees. The Labour Code protects employees’ personal rights in the course of the establishment of employment as it provides that an employee may only be requested to make a statement, fill out a data sheet, or take an aptitude test which does not violate his personal rights and which essentially provides substantive information for the aspects of the establishment of an employment relationship. Further, the Labour Code generally states that the employee cannot waive its privacy rights in advance and the parties to the employment contract cannot agree to prejudice such rights to the detriment of the employee. It follows that the employer must preserve the privacy rights of its employees and data processing must not be excessive in relation to the purpose of the data collection. However, the Labour Code does not regulate any other data protection aspects in detail (with the exception of criminal employee data); therefore it secures only the minimum protection to worker’s privacy.

The employer is generally considered to be authorised to process the personal data of employees if such data processing is necessary for the performance of the employment contract, furthermore this may include the control of the employees’ working performance under the provisions of the Labour Code. In exercising its controlling right, it must conform to the requirement of bona fide conduct and cooperation duty under the Labour Code as well as to the general provisions of the Civil Code. The general rules of the Labour Code provide that rights and duties prescribed in the Labour Code shall be exercised and fulfilled in accordance with their intended purpose that may not injure the rightful interests of others, harass them or suppress their opinion.

The Labour Code, the local implementing legislation of the European Workers’ Information and Consultation Directive provides that the employer shall consult with the Works Council before implementing proposals for any actions affecting large group of employees, and/or plans for internal regulations affecting the employees’ substantive interests. Accordingly, consultation with Works Council on policies covering data protection issues or the personal data record system of the employer is always a must. If the employer does not consult or does not comply with the deadlines of consultation, the implementation of such internal policies/ measures might be challenged by the Works Council before court and the Council may assert that such policies are null and void. Consultation with trade unions is not mandatory, however, the collective agreement (if any) might provide for such rights of the trade union.