New Hungarian Laws Clarify, Strengthen Employers’ Rights to Monitor Employees

Hungary’s laws are undergoing significant revision by the Parliament. After adopting a new Constitution (the “Basic Law”) in April 2011, the Parliament began to adopt important new acts regulating the fundamental rights of Hungarian citizens. Some of these new acts are so-called “fundamental acts” which may not be changed without the approval of a two-thirds majority of the Parliament in the future.

One of these new acts is the new Act on Information Self-Determination and the Freedom of Information (the “Information Act”), ¹2011. Act CXII of 2011 on Informational Self-determination and Freedom of Information (Hung.), available at http://www.naih.hu/files/act_2011_cxii_in_eng_v2.pdf. adopted last summer, which significantly changed the Hungarian system of privacy and data protection and took effect Jan. 1 (11 PVLR 19, 1/2/12). Simultaneously, the Parliament approved a New Labour Code (the “New Labour Code”) to replace the existing Labour Code, slated to take effect July 1, 2012. The New Labour Code, by its purpose, will facilitate certain rights of employers, and “respects the economic and social interests of both employers and employees.” ²The International Labour Organization (ILO) has already expressed its concerns regarding whether the liberalization of the data protection rules in the Labour Code are in compliance with European Union requirements. Simultaneously, the Information Act is already subject to an infringement action by the European Commission (11 PVLR 162, 1/23/12).

The New Labour Code, together with the Information Act, expressly allows the monitoring of employees in Hungary, with certain conditions and restrictions.

Illegal Monitoring: The Past.

Under the previous legislation, the law was silent about monitoring, and different conclusions could be reached. Data protection commissioners issued several opinions regarding, inter alia, employers’ monitoring of employees’ use of the internet, e-mail, cellular phones or global positioning system (GPS) devices. The second data protection commissioner, Dr. Attila Péterfalvi (currently the president of the data protection office ³The curriculum vitae of Dr. Attila Péterfalvi is available at http://www.naih.hu/files/cv_peterfalvi_eng.pdf.), expressly took the position that monitoring is not allowed by law, and that even safety cameras may not record any data of employees. The third and last data protection commissioner, Dr. András Jóri, ⁴András Jóri, Data Protection Law—An Introduction (2007), available at http://www.dataprotection.eu/pmwiki/pmwiki.php?n=Main.Privacy. also addressed the issue of surveillance cameras in the workplace. He did not expressly deny the possibility of safety cameras in the workplace, but, in his view, it was important to regulate the extent to which and the conditions under which employers may use safety cameras, and information must be provided to employees.

While the data protection commissioners took the above stringent positions, the practice of labour tribunals was much more flexible, and some judgments reached the conclusion that monitoring must be limited to working hours or work-related activity.

In the future, employment tribunals will have to apply the New Labour Code, even if the subject of the case is the violation of data protection law or the unlawful monitoring of employees. This might result in a situation where the interpretation of monitoring and the protection of employees’ private lives, as stated by the data protection authority (i.e., the data protection commissioner), will possibly be overruled in the future, and thus the stringent approach of the data protection commissioners will no longer be applicable in Hungary.

Some recent judgments (relating to the previous legislation) already show the trend of a more flexible approach. In a very recent second instance decision [a final and binding decision in the Hungarian legal system], an employment tribunal took the position that the monitoring of an employee (even with a hidden camera) is lawful, provided that the employee was aware of the fact that the workplace is monitored by the employer for safety reasons. In its judgment, the court highlighted that it was not relevant whether the given employee saw the camera or not.

Possible Monitoring: The Future.

The New Labour Code contains express provisions regarding the monitoring of employees. Some experts come to the conclusion that the rules of the New Labour Code call for the application of the legal principle lex specialis derogat legi generali—under which a law that governs a specific subject matter overrides a law that governs general matters—and, therefore, the Information Act will not even be applicable in the context of employment law. However, no individual complaints will be subject to the procedure of the new data protection authority, and this fact might lead to the result that the only effective protection for individual complaints of employees will be provided by employment tribunals.

In this respect, it is important to note that the New Labour Code does not refer to the balance of interests clause introduced by the Information Act, but states that the fundamental rights of employees may be restricted by employers at anytime, provided that employers give prior notification of the restriction, including the expected duration of such restriction.

In Hungary, the right to private life is laid down in the Basic Law, and consequently this right may be restricted only by another right protected by the Basic Law. Therefore, the above-mentioned provisions of the New Labour Code may be examined by the Constitutional Court of Hungary. However, as long as the New Labour Code expressly allows this restriction, employers monitoring their employees will be on the safe side.

According to the New Labour Code, employers are expressly entitled to monitor their employees, provided that they notify employees properly and the monitoring “solely relates to the nature of the employment relationship.” Therefore, monitoring is not limited in time, but it must relate to the employment relationship. For example, the monitoring of an employee’s movements by a GPS system or by cellular information is not per se unlawful since the entry into force of the new legislation (although it was previously prohibited by the data protection commissioners).

Another important provision of the New Labour Code makes clear that an employer may apply sanctions for employee conduct performed “before or after his/her working hours.” These two provisions implicitly allow the monitoring of employees beyond working hours, or by the measures of social media or other communication systems. As a guarantee, the New Labour Code states that “the private life of the employee may not be monitored by the employer.” However, in the absence of relevant case law, it is unclear which types of data will qualify as “relating to the employment relationship” and which are protected by the principle of mandatory respect for the privacy of the employee by the employer.

How to Make It Legal?

Although it is clear from the new legislation that employee monitoring is allowed in the workplace, and also that employers may enter into the private lives of their employees, and may even restrict their fundamental rights, there are still some conditions.

Proper information must be provided to employees, it must contain the time of monitoring and it must be consented to by the employees. As overly broad consent is expressly prohibited, the monitoring policy must be carefully worded.

It is also recommended that the consent of employees be included in their employment contracts, and that these be signed by employees either at the time of entry into the employment relationship or at the time of the commencement of the surveillance. This conclusion is also supported by the provisions of the Information Act, according to which any consent relating to the performance of a contract must be included in the contract itself.

It is also clear from a recently published communication of the data protection authority that any monitoring system shall be registered in the National Data Protection Registry. However, the processing of employee data is exempted from this registration requirement. Therefore, it will be left to employers to decide whether they shall register their monitoring systems or not.

It is very likely that the data protection authority will come to the conclusion that if the monitoring system is directly operated by the employer, the monitoring is still covered by the exemption, but that if it is done by a security service provider, then such monitoring shall also be registered at the authority.

This conclusion is confirmed by the interpretative provisions of the Information Act, according to which the “calling down” of any data qualifies as a separate data processing activity. This conclusion would put an end to an evergreen dispute involving the data protection commissioners. The focus of this dispute was whether monitoring by cameras without recording qualifies as a data controlling activity or is merely a technical part of the data processing. Under the new legislation, the monitoring clearly qualifies as a sui generis data controlling activity.

The registration of the monitoring activity shall be made on the form provided by the data protection authority and is subject to legal fees. However, the fees have not yet been published, and, therefore, according to the official statement of the authority, fees do not have to be paid until the office publishes its fee schedule.