The Hungarian Government – in the name of Prime Minister Viktor Orbán – has launched a public opinion survey in May 2011 under the name “Social Consultation 2011” which case recently gained major attention in the Hungarian media and same exposed the Data Protection Commissioner to heavy political attacks on the part of the Government parties.
The opinion survey had the official goal to consult the public in connection with the adoption of the new Hungarian Basic Law on issues relating to education, labour, pensions and social benefits. However, opposition parties claimed that the whole correspondence-campaign had the sole goal to use it for political PR of the government party FIDESZ as the questionnaire of the opinion survey consisted of “highly tendentious” and “leading questions”. The Government (through the central office of public administration and electronic public services) has sent 8 million (!) direct mails to Hungarian citizens and at the end of the opinion poll more than 1 million questionnaires have been returned to the office. Respondents were called upon to provide their e-mail address if they wished to participate in further consultations in electronic form. At the bottom of the second page of the letter – in much smaller typeface – the questionnaire also contained the following consent form to be signed by respondents of the consultation:
“ By my signature – pursuant to Section 3 of the Act Nr LXIII of 1992 on the Protection of Personal Data and Data of Public Interest – I hereby grant my consent for the administrative organ designated by the Government to process my name, address and other data indicated on the questionnaire to evaluate the results of the social consultation and to establish further direct contact with me until I do withdraw such consent in writing.”
Relating to the Social Consultation campaign several complaints have been submitted to the Office of the Data Protection Commissioner claiming that
– the questionnaire indicated that name and address of the addressee;
– the questions likely revealed political opinions that is sensitive data;
– each questionnaire contained two bar codes with unidentified purpose, further
– several complainants had the fear that not only the data of respondents, but also the data of people having not responded to the questionnaire would be recorded by the Government.
When the central office of public administration and electronic public services submitted the data processing relating to the opinion poll for DPA registration, the Commissioner launched an investigation. As a first step, the Commissioner released on 7 June 2011 a prior opinion establishing that data processing in connection with the Social Consultation does not comply with the Data Protection Act and the data gathered through the public opinion poll should be deleted. Since the office did not comply with the prior opinion, the Commissioner launched an administrative procedure and finally on 16 August 2011 released an order to cease and desist from illegal data processing.
The decision of the Commissioner established that the public opinion poll conducted by the Government did not observe the provisions of the Act on the Use of Name and Address Information Serving the Purposes of Research and Direct Marketing, which lays down the guarantees of public opinion surveys, including the requirement for the detachment of the name and the address of the respondent, the separate storage of such information and mandatory anonymization of data.
Further, the Commissioner considered that the consent form indicated on the questionnaire was invalid as it did not comply with the requirements of an informed voluntary consent under the Data Protection Act. Accordingly, the Commissioner established that the consent was neither freely given nor specific. The Commissioner held that the conditions of data processing relating to the Social Consultation were not available to the public and the notice to data subjects was generally missing, which did not conform to the Data Protection Act. Accordingly, the questionnaire applied during the social consultation did not contain any clarification whether it was voluntary or compulsory to supply the data, therefore certain respondents were likely in the belief that providing a response was mandatory. Further, the questionnaire did not provide unambiguous and detailed information on all the facts relating to the processing of data, in particular on the purposes and legal basis of the data processing, on the person authorised to carry out data processing, the duration of data retention, on who is authorised to have access to the data as well as on the rights and remedies of data subjects in connection with data processing. Pursuant to the Commissioner’s evaluation, the missing of any of the aforementioned information causes the consent to be invalid that makes the subject data processing illegitimate. The Commissioner also referred to the recently adopted opinion of the Article 29 Working Party on the definition of consent which also corroborates his standpoint.
The decision of the Commissioner also clearly maintains that the consent form should be visibly indicated on the document and the data protection notice (or its availability) should be also made available to data subjects conspicuously. The Commissioner concluded therefore that the provision of information on the bottom of the page (after the signature) did not conform to the fairness requirements of data processing.
What makes this case worthwhile is that
– this is the first time the Commissioner used its new powers introduced from 1 January 2011;
– the Commissioner has challenged a large scale data processing of the Government which concerned almost the entire Hungarian population;
– the Commissioner extensively relied on the opinion of the Data Protection Working Party;
– as regards that judicial review of the decision, it is likely that the representation of the Commissioner’s Office as a defendant shall be overtaken by the head of the new Hungarian Data Protection Agency that is nominated by the Prime Minister (in fact, whose data processing has been challenged), finally
– the Commissioner’s decision contains a particularly strict interpretation of the notice requirement relating to the processing of personal data.
The head of the central office of public administration and electronic public services indicated that they will challenge the decision of the Commissioner before court. We will report on any further follow-up in this case.
