“The impact of the corona virus pandemic brings unprecedented challenges for society both nationally and globally. Public authorities must make significant decisions that affect public health, civil liberties and people’s prosperity. The public’s right to access information about such decisions is vital.”^[1]

NAIH participated in the drafting of the above statement by the International Conference of Information Commissioners and it fully agrees with its findings, according to which openness, transparency and sharing information proactively are indispensable for people to understand the state’s decision-making processes. However, we must also bear in mind that public organisations must focus their resources on protecting public health during a pandemic.

In order to reduce the burden on disease control bodies, data requests could be completed in 45 days instead of 15 days^[2], but only if it was probable that performance within the ordinary due date would have jeopardised the discharge of the agency’s tasks related to the emergency situation. One disaster management directorate reported substantial additional tasks – naturally that was an acceptable reason. (NAIH/2020/4603)

NAIH received several complaints objecting to the fact that controllers referred to the 45-day period without any justification. The Authority underlined in every case that any deviation from the due date according to the Privacy Act must be justified individually. An acceptable reason was if during the emergency municipal decision-making had to be carried out with short due dates putting extra burden on the employees of the municipality and as most of them were working in home office mode only few employees had physical access to the documents. (NAIH/2020/4147)

A substantial part of the notifications and questions related to the pandemic were about the data concerning the disclosure of the fact of the infections and access to data on the geographical distribution of the infected persons. NAIH declared in every case that the health statistics of geographically based groups of certain sick persons qualify as public statistical data, whose accessibility may be restricted because of their role in decision-making only if their accessibility would jeopardise the effectiveness of the agency’s procedure. This should the decided by the controller, but its decision must be supported by detailed justification. Once the decision is made, the data request may be rejected, if the data would serve as the foundation of additional future decisions, or access to the data would have a negative impact on the lawful or smooth operation of the agency discharging public tasks. At the level of settlements, the number of infected people and the number of the deceased are statistical data that may be disclosed, provided the patients cannot be identified. Other processing without purpose or unlawful processing, such as posting a list of “infected” street names or indicating the exact place of an official quarantine by giving the street and house number on Facebook should be avoided as bad practice. (NAIH/2020/3506, NAIH/2020/2838, NAIH/2020/2904)

The municipal executive of Budapest 13th District applied to the Public Health Department of the 5th District Office of the Government Office of Budapest (hereinafter: Government Office) for the number of confirmed COVID-infected persons and the number of persons subject to an official quarantine in the 13th District in a daily breakdown. (According to the legal regulation, the 13th District belonged to the competence of the Public Health Department of the 5th District.^[3]) The Government Office rejected the data request with reference to the fact that Government Decree 41/2020. (III.11.) made it possible to transmit the requested data to the municipalities; with the end of the emergency, however, the legal basis of data transmission no longer existed.

The Government Office processes, inter alia, the onset and place of the infection, the place of nursing, the reported disease and its epidemiological description, the laboratory diagnosis and the qualification of the outcome with respect to COVIDinfected persons in the Epidemiological Subsystem of the National Specialised Information System (hereinafter: OSZIR) run by the National Public Health Centre.

According to Section 2.1 of the Amended procedures issued in relation to the new coronavirus identified in 2020 published by the National Public Health Centre (hereinafter: Procedures) the health care provider has to upload the data of the person suspected of being infected by COVID-19 or having positive laboratory results to the Communicable disease reporting subsystem of OSZIR within 24 hours. The public health staff of the district office creates a disease case from the Communicable disease reporting sheet received electronically within 24 hours and complete the individual data collection sheet with the available data. Section 2.2 of the Procedures contains the procedures to be followed to separate suspicious and confirmed cases. According to Section 2.2.(a) “Separation of a suspected patient at home having mild symptoms shall be done upon the instruction of the health care provider (primary care, outpatient care). In warranted cases, the authority may act through an order in the case of the positive result of a PCR laboratory test designed to detect SARS-CoV-2.”

This means that the Government Office does have the requested data and it is able to obtain aggregated statistical data from the data stored in OSZIR, which are public data pursuant to Section 4(8) of Act XI of 1991 on the Activities of the Health Authority and Administration (providing for public access to data on the epidemiological situation). (NAIH/2020/7731)

The question was raised in several cases whether the fact that an identifiable person is infected can be published. As health data constitute one of the special categories of personal data according to GDPR Article 9, as a main rule, their public access is prohibited, thus a municipality lawfully refused to issue, for instance, the name of an infected municipal representative. (NAIH/2020/2926, NAIH/2020/6568). At the same time, the information whether the government office granted a licence to a family doctor to start working after participating in a conference abroad is a personal data accessible on grounds of public interest. The reason is that there is a legal regulation^[4] that stipulates that health care workers in direct contact with patients, in addition to their professional qualification for the job, are considered fit to perform their duties if they do not suffer from a disabling infectious disease. The information whether a person discharging a public task meets the legal conditions of discharging that public task is public data accessible on grounds of public interest as other personal data related to the discharge of the public task. (NAIH/2020/2963)

Several submissions asked about the accessibility of data concerning the epidemiological control of residential social care institutions. Data in the public interest include, for instance, how many people were shown to have coronavirus infection in the institution, the number of available protective devices, whether there is a designated epidemiological officer and whether he or she held an infection control training, or whether patients were returned from the hospital without testing them for coronavirus. These data are processed by the institutions, they are part and parcel of their activities and related to their operation and do not qualify as personal data. Pursuant to Section 32 of the Privacy Act, an agency discharging public tasks has to facilitate and ensure the accurate and rapid provision of information to the public concerning the cases within its responsibilities (NAIH/2020/3752). The findings of the inspection report concerning the professional supervision carried out in residential social care institutions are also data in the public interest; by anonymising the personal data they can be published in internet websites. The finding of the report that the managers of the institutions severely jeopardised the health of the people they cared for during the period of the emergency and epidemiological alert is closely related to the performance of their public duties and the public has a substantial interest in accessing it, thus it qualifies as personal data accessible on grounds of public interest. (NAIH/2020/6631)

Data of financial management related to the epidemic show a varied picture: for instance, those requesting data wished to have access to the municipalities’ contracts related to the epidemic, the amounts spent on rapid tests, the quantities ordered, which are naturally data in the public interest. (NAIH/2020/6190, NAIH/2020/6299). A journalist asked for the contracts concerning the procurement of the ventilators from the Ministry of Foreign Affairs and Trade, but the Ministry did not send him the annexes containing the technical specifications. Once NAIH requested information concerning the restriction of access to the annexes, the Ministry made them available to the journalist, thus the public could be informed within a very short time. (NAIH/2020/7123)

Another journalist submitted a data request to the Hungarian National Blood Transfusion Service (hereinafter: OVSz). The subject matter of the data request was the contract on the sale of blood plasma and its amendment. The company with which OVSz concluded the contract regarded the entire contract as its trade secret, and because of this only the three data in the publication list of OVSz, the subject matter, value and period of the contract was to be issued. In the course of its investigation, NAIH underlined that in the event of a conflict between data in the public interest and trade secrets, access to the data in the public interest enjoy priority and Section 27(3) of the Privacy Act is to be interpreted strictly. The public had a substantial interest in the transparency of the management of the national blood supplies, particularly in the current epidemiological situation. NAIH requested the company to provide detailed justification for the classification of each point of the contract as trade secret and also to what extent access to the given point of the contract would cause disproportionate harm in business life. After this, the contracting company continued to state that 10 out of the 45 points of the contract were trade secrets. Of these, the Authority accepted the argumentation in the case of two points, so OVSz sent the rest to the journalist. Among other things, the Authority regarded access to the obligations undertaken by the parties in the contract as unconditionally justified because without knowledge of these, a well-founded societal debate on the appropriateness of the sales price could not evolve. When concluding a contract, whose subject matter was part of the national assets, the company had to expect that at least the main obligations would be accessible to the public. According to the Authority’s position, it should also be transparent what legal consequences are stipulated by the contract if the contracting party fails in its obligation to facilitate the supply of domestic blood plasma to patients. (NAIH/2020/1800)

[1] Statement of the International Conference of Information Commissioners (icic)  (14 April 2020) https://www.informationcommissioners.org/covid-19

[2] Section 2(3) of Government Decree 179/2020. (V. 4.) on deviation from certain data protection and data request provisions during the emergency. It has ceased to be in force since the day of the termination of the emergency, i.e. from 18 June 2020. Government Decree 521/2020. (XI. 25.) on deviation from certain data request provisions during the emergency will lose effect on 8 February 2021.

[3] Based on Section 3(1) and Section 5 of Government Decree 385/2016. (XII. 2.) on the discharge of the public health duties of the Budapest and county government offices and the district (Budapest district) offices and the designation of health care administrative agencies, the district office performs all the public health, authority, professional supervisory tasks of the public health administrative body in its field of competence, which are not referred to the competence of the national medical officer or the government office by legal regulation. Annex 2 to the Government Decree specifies the fields of competence of the district offices.

[4] Section 4 of Decree 40/2004. (IV. 26.) ESzCsM on the examination and certification of medical fitness to perform health care