Peter Magyar’s Data Scandal Could Constitute a Criminal Offense

A political party may have committed a criminal offense by failing to properly protect personal data stored electronically — according to a statement from the National Authority for Data Protection and Freedom of Information (NAIH). The authority emphasized that even media reports and opinion pieces about the case must comply with general data protection rules, balancing press freedom with the right to privacy.

The Tisza Vilag app (Photo: Krisztian Mate)

The NAIH warned that it could be unlawful — and even criminal — if a political party fails to implement adequate data security measures to safeguard the personal information it stores electronically, and unauthorized individuals gain access to or obtain that data. The authority confirmed that it has received multiple complaints regarding the use of leaked data from the Tisza Vilag [Tisza World] app and its volunteer database by various media outlets. While the issue may be of public interest, the NAIH stressed there is no legal basis for anyone exploiting a security flaw to store or publish personal information from such databases. Furthermore, if a media outlet reports on the data leak and uses information illegally released to the public in its coverage, it must still comply with the General Data Protection Regulation (GDPR) and respect the balance between freedom of the press and data privacy, the agency stated.

Tisza Party chief Peter Magyar (Photo: Gabor Markovics/Mediaworks)

Handle the Data Leaked through Tisza with Caution

The authority underlined that when personal data is stored or used in media content, the media provider bears full responsibility for the handling of the data. This responsibility remains in place even if the political party failed to ensure proper security measures or if the personal data had previously been leaked. The NAIH said media outlets must apply the principle of proportionality when deciding how and for what purpose they use personal data.

For example, if a journalist uses contact information solely to verify facts or to reach out to individuals for comment, such use may comply with GDPR requirements,

the statement reads.

However, the NAIH warned that it may violate data protection rules if a publication makes personal data available — even indirectly — that was obtained through unlawful means. Doing so only amplifies the breach and further harms the individuals’ privacy. The authority also noted that those affected by the breach are vulnerable, since they did not choose to make their data public; it was exposed by an individual who exploited a data security flaw. Before publishing any personal details, media outlets must assess whether the individual had previously expressed political opinions publicly, and if so, in what form and context — particularly regarding their public role or profession, the agency added.

Privacy Must Be Respected

The NAIH stressed that while individuals may have disclosed some personal data themselves — such as political opinions — other details, including home addresses or phone numbers, remain illegal for media outlets to distribute.

Data handlers must exercise extreme caution and respect individuals’ right to private and family life, avoiding any harassing or intrusive use of personal data. 

Media organizations may store personal data related to a breach only temporarily and only if they can prove that such processing complies with GDPR. The NAIH made clear that these standards also apply to public figures who use leaked information in the course of expressing their opinions.

Cover photo: The Tisza Vilag app (Photo: Krisztian Mate)