On May 4, 2020, the Hungarian Government issued a Decree that suspends, during the COVID-19 created state of emergency, the one-month deadline that controllers have under the GDPR to reply to data subject rights requests. The Decree also allows public entities to refuse or suspend freedom of information (“FOIA”) requests in certain situations. The Decree has been heavily criticized by civil society groups and prompted the scrutiny by the European Data Protection Board (“EDPB”).

According to the Decree, the normal one-month deadline to reply to data subject rights requests will start running once the state of emergency ends, for which there is no fixed date yet. This means that during the state of emergency, controllers are able to rely on this Decree to refuse to answer requests relating to access, correction and erasure of data, as well as requests objecting to the processing of personal data. The Decree also provides that, during the state of emergency, the right of information under Articles 13 and 14 GDPR can be satisfied through electronic means. This suggests that controllers can meet their transparency obligations by publishing on a website a privacy notice, even where they collect data offline.

The Decree also gives Hungarian public authorities the ability to extend from 45 days to 90 days the period to respond to a FOIA request or to reject FOIA requests where there is a risk that the request could jeopardize the public authorities’ tasks related to the COVID-19 situation. The public authorities must inform the requestor within 15 days of receipt of the FOIA request about the extension or rejection of the request.

On May 8, 2020, the EDPB announced that it had contacted the Hungarian Supervisory Authority about the above-mentioned Decree, but that it required further information to form a view. This was one of the topics discussed by the EDPB at their plenary session of May 14, 2020, and there are likely to be further developments related to this story.