EDPB challenges Hungary’s GDPR suspension under Article 23

On May 4, the Hungarian government issued a decree suspending Articles 15 to 22 of the GDPR until the end of the country’s coronavirus pandemic state of emergency. Those articles cover right of access by the data subject, right to be forgotten, and right to restriction of processing among several other key pillars of the legislation.

Article 23 of the GDPR allows for member states to restrict the scope of the obligations and rights provided for under the aforementioned articles when the restriction is necessary and proportionate to safeguard national security, defense, or public security, among other matters. Though Hungary’s government has deemed the coronavirus such a threat, the EDPB feels otherwise.

“The mere existence of a pandemic or any other emergency situation alone is not a sufficient reason to provide for any kind of restriction on the rights of data subjects,” the agency said in a statement following Tuesday’s plenary session. “Rather, any restriction must clearly contribute to the safeguard of an important objective of general public interest of the EU or of a Member State.”

The statement follows a joint letter the EDPB received from the Civil Liberties Union for Europe, Access Now, and the Hungarian Civil Liberties Union regarding Hungary’s decree. “The decision by the Hungarian government to limit the application of data subjects’ rights is disproportionate, unjustified, and potentially harmful to the public’s response to fight the virus,” the letter reads.

As part of its response, the EDPB said it will issue guidelines on the implementation of Article 23 of the GDPR in the coming months. “Data subject rights are at the core of the fundamental right to data protection and Article 23 GDPR should be interpreted and read bearing in mind that their application should be the general rule. As restrictions are exceptions to the general rule, they should only be applied in limited circumstances,” it said.