The Wayback Machine - https://web.archive.org/web/20110120075253/http://www.privacyinternational.org:80/article.shtml?cmd%5B347%5D=x-347-64762
Privacy International

Privacy International

Hungarian Constitutional Court Decides on Identity Numbers

TITLE: HUNGARIAN CONSTITUTIONAL COURT'S DECISION ON PRIVACY RIGHTS (4/13/91)

KEYWORDS: HUNGARY; CONSTITUTIONAL COURT DECISION ON PRIVACY RIGHTS

BODY:

Constitutional Court Decision on Privacy Rights

91CH0650A Budapest MAGYAR KOZLONY in Hungarian No 30, 13 Apr 91 pp 805-814

[Constitutional Court Decision No. 15-AB of 13 April]

[Text]

FOR THE HUNGARIAN REPUBLIC!

Based on a petition seeking judicial review of the constitutionality of
certain legal provisions, the Constitutional Court announced the following:

DECISION

The Constitutional Court finds that the collection and processing of personal
data without a specific purpose for arbitrary future use is unconstitutional.


The Constitutional Court finds that a general and uniform personal
identification mark (personal number) for unrestricted use is unconstitutional.

The Constitutional Court finds that Decree with the Force of Law No. 10 of
1986 concerning the state census, and Council of Ministers decrees Nos. 25-MT of
8 July 1986 and 102-MT of 3 July 1990 implementing the above Decree with the
Force of Law are unconstitutional and therefore declares the Decree with the
Force of Law and the implementing decrees null and void.

The invalidated provisions shall lose force on 31 December 1991, except for
the following, which shall lose force on the day this Decision is published in
MAGYAR KOZLONY:

In the Decree with the Force of Law the second sentence of Paragraph 4; the
second and third partial sentences of Paragraph 6 Section (2); Paragraph 6
Section (3); the second sentence of Paragraph 7 Section (1); the expressions
"unless otherwise provided by law, or just interest" and "or with his statement"
in Paragraph 7 Section (2); Paragraph 7 Section (4); and the words "in the
Decree with the Force of Law or in the Council of Ministers decree" in Paragraph
10 Section (3).

Accordingly, between the date on which this Decision is published and 31
December 1991, Paragraph 4, Paragraph 6 Section (2), Paragraph 7 Sections (1)
and (2), and Paragraph 10 Section (3) shall remain in effect with the
following texts:

"Paragraph 4 State census records shall contain the citizens' personal
numbers, their basic data suitable for personal identification and their
addresses."

"Paragraph 6 Section (2). Computerized records which also contain personal
numbers and personal identification data shall be utilized as identifying data."

"Paragraph 7 Section (1). The state census shall provide data to private
person and, for the performance of their functions, to organizations."

"Paragraph 7 Section (2). A private person may request the provision of data
or the preparation of a document based on state census data concerning another
person if the private person seeking such information has a right to do so. The
applicant shall provide documentary evidence of such right."

"Paragraph 10 Section (3). Data pertaining to the person of a citizen or to
his family or other circumstances shall be publicized only with the concurrence
of the affected citizen, or in cases provided for by law."

The Constitutional Court orders the publication of this Decision in MAGYAR
KOZLONY.

ARGUMENT

I.

Petitioner challenged in their entirety the Decree with the Force of Law No.
10 of 1986 (hereinafter: TVR) and the two implementing Decrees Nos. 25-MT of 8
July 1986 and 102-MT of 3 July 1990 on grounds that these were repugnant to the
constitutional right to the protection of personal data (Paragraph 59 of the
Constitution). Petitioner asked that the three laws be declared null and void.

Petitioner argued that the TVR has failed to satisfy the requirement
established in both the Constitution and in Law No. 11 of 1987 concerning
legislation (hereinafter: Legislative Law) according to which fundamental rights
must be governed by legislative enactments, and that therefore the TVR as a
whole was unconstitutional. Petitioner also claimed that the TVR mandated the
release of data by delegating to the Council of Ministers authority to determine
the type of data to be provided; this authorization failed to specify the
subject and framework of the authority granted. Thus the Council of Ministers
was, in fact, regulating fundamental rights and duties, a matter it cannot be
authorized to do. The petitioner also claimed that the fact that a Council of
Ministers Decree determined the recipients to whom data if to be provided on a
mandatory basis was unconstitutional. These recipients determine people's
rights and duties based on the use of such data, at the same time, however, the
protection of personal data cannot be guaranteed in the hands of the recipients.

II.

Paragraph 59 Section (1) of the Constitution provides that every person in
the Hungarian Republic shall be entitled to a good reputation, to the
inviolability of the private residence and to the protection of private secrets
and personal data.

Based on the precedent established in Decision No. 20-AB of 1990, the
Constitutional Court does not regard the right to the protection of personal
data as a traditional right to protection, but in due regard to the active
aspects of this matter, as a person's right to make autonomous decisions
concerning the release and conveyance of his own personal data.

Accordingly, the substance of the right to protect personal data as provided
for in Paragraph 59 of the Constitution is individual dispositional authority
over the revelation and use of one's own personal data. In general, personal
data may be recorded and used only with the consent of the affected person; the
entire path of data processing must be made understandable and controllable by
everyone, i.e., everyone has the right to know who uses his personal data at
what time and for what purpose. On an exceptional basis a legislative enactment
may mandate the release of personal data, and a legislative enactment may also
prescribe the method in which such data shall be used. Such law would restrict
the fundamental right to make an independent decision, and would be
constitutional if it complied with the requirements established in Paragraph 8
of the Constitution.

Irrespective of the process to be applied, any law which pertains to the
recording, collection, storing, arrangement, conveyance, publicizing or changing
of personal data, or which impedes the further use of data or the generation of
new information from data (hereinafter: personal data processing or: data
processing) will comply with the requirements established in Paragraph 59 of the
Constitution only if it contains guarantees that the affected person will be
able to follow the path of processing and that he will be able to enforce his
rights. Accordingly, legal institutions which serve this purpose must secure
the affected person's consent to the processing of data, and must contain
precise guarantees with respect to exceptional cases in which personal data
processing may be pursued without the consent (perhaps without the knowledge) of
the affected person. These legal guarantees must, among other matters, confine
the flow of data within objective limits in order to be able to control such
flow.

An established purpose is the condition for, and at the same time the most
important guarantee of exercising the right to make an independent decision.
This means that personal data may be processed only for an established and
legitimate purpose. Every phase of personal data processing must comply with
its stated, and from the standpoint of the public, credible purpose. The
purpose of the processing of personal data must be stated to the affected person
in terms which enable that person to judge the manner in which the processing of
his personal data affects his rights, and so that the affected person is able
make a reasoned decision concerning the release of his data; and further, in a
manner that the affected person may enforce his rights in the event that his
personal data is used for a purpose different than what has been stated. For
the same reason affected persons must be notified if the purpose of processing
personal data changes. Processing personal data for a new purpose without the
consent of the affected person may be consistent with law only if a legislative
enactment expressly grants permission with respect to specific data and to a
specific data processor. It then follows from the "established purpose" concept
that the collection and storage of data without an established purpose, "for
storage purposes," or for undefined future use is unconstitutional.

The other fundamental guarantee is the limitation of the conveyance of data
and of the publicizing of data.

In its narrower sense, data conveyance means the provision of access to data
for a certain third person by the personal data processor. Publicizing personal
data means that any third person may familiarize himself with the data. Persons
commissioned by the personal data processor to perform the strictly construed
physical or computer functions of personal data processing on behalf of the
personal data processor, usually as part of a profession or in a businesslike
manner, must not be regarded as "personal data processors," and the access to
data granted to such persons must not be regarded as "conveyance of data." The
responsibilities of such commissioned persons must be regulated separately,
leaving untouched the full responsibility of the data processor for the data he
himself processed, or had processed by someone else.

Access to personal data may be granted to third persons in addition to the
affected person and to the original data processor, and to thus interconnect
data processing systems, only if all the conditions permitting the conveyance of
data prevail with respect to each and every piece of information. Accordingly,
this also means that the recipient of the conveyed data (the person requesting
the data) must either be authorized by law to process the conveyed data, or must
have the consent of the affected person. The requirement to have an established
purpose, and further, the conditions for changing a purpose and for conveying
data as described above also establish barriers to data conveyance among or
within individual state administrative organs.

III.

The TVR subject to challenge is unconstitutional because it fails to satisfy
the fundamental requirement of specifying an established purpose. Thus, in
particular, the TVR:

-- Fails to define the purpose of data processing.

-- Fails to accurately define the type of pertinent data in this context.

-- Enables the use of other unspecified records in addition to the services
provided by the census.

-- Fails to adequately secure the rights of affected persons. In particular,
the TVR does not contain adequate guarantees to protect the affected person with
respect to conditions governing the conveyance of data.

1. The definition provided in the TVR concerning the purpose of processing
personal data and the kind of data involved is unconstitutional.

According to TVR Paragraph 1 Section (2), the function of the state census
bureau is the collection and continuous recording of data required for a uniform
basic personal record, and the supplying of data. According to TVR Paragraph 4,
the record contains "basic personal identification and residential address
data." (Thereafter, the TVR delegates the definition of such data to the Council
of Ministers.) But TVR Paragraph 3 also mandates the supply of educational and
professional qualifications data. These are the visible traces in the TVR of a
concept for the establishment of an integrated personal data bank incorporating
the broadest possible scope of data concerning citizens. Based on this concept,
the subject of data would range from health characteristics through property
records all the way to office affairs. This is why it was necessary to mandate
the use of personal numbers in census records and in addition, in the
framework of state administrative and adjudicative proceedings (Paragraph 6
Section (2)). This concept was part of the developmental ideas of the state
census bureau even in the late 1980's. Plans for a similar integrated, central
state record had to be dropped in the middle 1960's in the United States due to
resistance manifested by society, and the same took place in France and in the
Federal Republic of Germany during the 1970's. Problems brought to the surface
by central data banks stimulated data protection legislation everywhere.

Data processing which lacks an established purpose, which cannot be
categorized in advance based on various use purposes for lack of a defined
purpose, which places any data at the disposal of users not defined in advance,
and which is pursued "for storage purposes" is unconstitutional in and of
itself. The lack of having an established purpose cannot be offset by providing
guaranteed conditions for the conveyance of data. This is because establishing
conditions for data conveyance and of having an established goal are not
alternative guarantees of the right to make an independent decision, but are
joint guarantees instead. The concept of having an established purpose must
prevail beginning at the point when data is recorded, until the data is deleted.
Accordingly, when it comes to a central integrated data bank which lacks a
specific purpose, the constitutional problem cannot be resolved by enforcing
only one of the constituent elements of the constitutional right to data
protection, the established purpose concept, and only with respect to those who
ask questions. This is so because a so-called legitimate data quality [as
published] must prevail in every phase of processing. It would not suffice if
only certain guarantees prevailed in individual phases of processing, and this
condition would not remedy the unconstitutionality that prevailed in other
phases of processing. For this reason, the provisions of Paragraph 5 Section
(2) of Decree No. 25-MT of 8 July 1986 are insufficient. These provisions state
that a person who requests and receives information contained in the census
records may utilize such information only for the purpose designated in his
request. This, otherwise self-evident duty of the requester, does not remedy
the lack of the apprehensible purpose for maintaining population records, nor
does it cure the shortcoming that also flows from this lack: the lack of
continuity of purpose in the data conveyance phase and the lack of legitimacy
for changing the purpose.

Independent from the per se constitutionality of conveying data, it comes as
natural for a data processor who deals with data of an undefined scope to
familiarize himself with the totality of, and the relationships between data
pertaining to individual persons. This fact renders the persons whose data is
on file entirely dependent, it permits insight into their private lives, and
results in an unequal communication situation in which the affected person is
unaware of what the data processor knows about him. So-called "personal
profiles" composed of data which is necessarily taken out of its original
context, and which in particular violates personal rights, and which constitutes
a fundamental consideration in judging the legality of individual data
processing endeavors, are necessary companions of data processing of an
undefined scope. For all these reasons, this kind of data processing offends
human dignity.

The Constitutional Court has not found a single constitutional right or
interest that would render unavoidable the restriction necessarily imposed by
data processing without an established purpose on the right to make an
independent decision guaranteed by Paragraph 59. of the Constitution. Nor did
it find any supportive argument of this restriction which is proportionate to
the injury caused. In particular, the efficacy of state administration does not
constitute such an interest, because one cannot prove that the data processing
method which constitutes a grave affront to the right to make an independent
decision is the sole available path for the state administration to function
effectively and efficiently. Accordingly, the Constitutional Court holds that
data processing systems which operate without an established purpose, for
storage purposes are unconstitutional.

2. The most important legal provisions concerning the census are also
unconstitutional if taken individually.

2.1 As defined in the TVR, the established purpose is fully inadequate in the
context of a data processing system which affects the entire population of the
country and which fundamentally determines the fate of personal data and the
rights related to such personal data (see: personal number). (Paragraph 1
Section (1) of the TVR reads as follows: "To help citizens enforce their rights
and perform their duties, and to assist the workings of social organizations,
associations, and associations of private persons (hereinafter jointly:
organizations).") This meaningless text is unsuitable for establishing a
direction for, or limits to data processing, i.e. it is not suited to permit any
discussion at all about conditioning data processing by having an established
purpose. The wording of Paragraph 1 Section (2) according to which "the
function of state census record keeping is to gather data needed for a uniform
basic personal record system" confirms the intent of establishing a data
processing endeavor without an established purpose, for storage purposes, for
the future satisfaction of "case related data needs," along with the regular
provision of data to state organs, the scope of which is not defined in the TVR.
(See TVR Paragraph 7 Section (3).)

2.2 The scope of data contained in the record is defined in TVR Paragraph 4.
as follows: "State census records contain the citizen's personal number,
fundamental identification data and his residential address. The scope of data
to be recorded shall be determined by the Council of Ministers."

This authorization is unconstitutional. According to Paragraph 8 Section (1)
of the Constitution legislative enactments must establish rules relative to
basic rights and duties. The regulation of the processing of personal data has
an obvious bearing on a fundamental right, the right to protect personal data as
specified in Paragraph 59 of the Constitution; but even Paragraph 5 Section (1)
of the Legislative Law included "personal registration" among matters subject to
legislation. The legislation "pertaining" to the processing of personal data
must enable everyone to determine without doubt which of the data pertaining to
a person are covered by the legislation. Neither the purpose of state census
record keeping, nor its function (Paragraph 1), nor the definition of the scope
of data by law (Paragraph 4) in the framework of the challenged TVR is suitable
for unequivocally limiting the scope of data to be recorded.

Considering the significance of census records, the data to be contained in
those records should have been enumerated in full detail in the TVR's framework.
Instead of doing so, however, the TVR delegated the definition of the data to be
included in the record to the Council of Ministers, without even defining the
scope of the authorization. This is so because the term "fundamental
identification data" is not sufficiently accurate from the standpoint of
providing a guarantee. In doing so, the TVR granted to the Council of Ministers
freedom to act on the one hand, while on the other it failed to provide
pecific information to the persons affected. Incidentally, the TVR itself
renders its own definition as impossible to interpret, when in Paragraph 3 it
also requires the provision of data concerning educational background and
professional qualifications. The implementing decree specifies that these types
of data must be included in census records, even though the authorization
granted in TVR Paragraph 4 cannot be interpreted to include such data in the
census records. On the other hand, Decree No. 25-MT of 8 July 1986 exceeded
even the broadest possible interpretation of TVR Paragraphs 3 and 4 when it
required the recording of the personal numbers of fathers, mothers, children and
spouses (Paragraph 1 Section (1) Subsection (O)). This is so because such data
must not be included among the fundamental personal identification data of the
affected persons. The succession of personal numbers will show even the most
distant family relationships. Use of such data may constitute particularly
severe violations of privacy rights, because it could yield and render usable
correlations entirely independent from whether the affected person cultivates a
given family relationship or if he knows about such relationship at all.
Accordingly, the family tree program conceals similar dangers as the already
mentioned personality profile.

Further, TVR Paragraph 5 Section (2) authorizes the minister of the interior
to issue orders for the maintenance of separate records of persons who stay in
certain locations specified in legal provisions. The goal, and the total
failure to define the scope of persons covered by this provision also renders
the content of this authorization unconstitutional.

Paragraph 7 Section (1) renders the seeming restrictions on the scope of data
enumerated in the TVR ultimately senseless when it authorizes the census bureau
"to utilize in the course of providing its services data obtained from other
records -- with the concurrence of the affected organizations." This provision
is unconstitutional from the standpoints of both the scope of data and the
linkage to an established purpose. This provision renders the state census data
processing effort unlimited and at the same time uncontrollable for several
reasons. First, at this place the TVR conditions the processing of data not by
the consent of the affected persons, but by the agreement of the other data
processor; second: it provides no rules regarding the requirement to delete the
foreign data after it was used, nor does it say that such supplements must be
recorded alongside the data of the affected person; third: state census data
combined with other data may provide qualitatively new information about the
person who does not become aware of the fact that data has been provided. Data
contained in another record could be acquired and conveyed further in a
constitutional manner only if this use of the data remained within the scope of
the purpose of the original record, and would not become accessible to a
constituency broader than what the original record keeping endeavor envisioned.
Data that does not fit within the scope of state census activities must be
deleted after conveyance, and the request for data and the fact of conveyance
must be documented.

2.3 All effective provisions concerning data conveyance are unconstitutional.

The TVR establishes different conditions for providing data to "private
persons" on the one hand, and to "organizations" on the other.

According to Paragraph 7 Section (2) a private person may request information
about another person if he has a right to, or a legitimate interest to do so.
The requester must verify such right or interest with a document or by his own
statement. The state census bureau provides data to organizations "for the
performance of their functions." (Paragraph 7 Section (1)) (Paragraph 1 defines
"organizations" as state organs, business and social organizations,
associations, as well as associations of private persons.)

These conditions for the supply of data do not adequately consider the
affected person's right to the protection of personal data, instead they favor
the person who requests the data and the organs of the census bureau. These
provisions are unsuitable to serve even as a starting point for the fulfillment
of the census bureau's obligation to protect a person's privacy (Paragraph 8).

According to TVR Paragraph 8 the release of data must be denied if doing so
may violate a person's rights. This obligation should obviously be applied
after the fulfillment of the objective criteria described in Paragraph 7, and
was meant to serve as a subjective filter. But if the objective conditions -- a
"just interest" described verbally, and the "performance of the functions" of
any kind of organization -- do not satisfy the requirement of protecting a
person's privacy rights, how could they serve as a starting point for the
census bureau to evaluate whether the release or utilization of certain data
violated the affected person's right to privacy? The terms "function" and
"just interest" are equally incomprehensible, and there is no difference between
the two. For example: the function of an enterprise is, (and the just interest
of an enterprise is) to operate in a profitable manner. Could the state census
bureau freely decide whether the release (in reality: the sale, because TVR
Paragraph 9 mentions e.g. for advertising purposes) of the names and addresses
of 10,000 persons of the same gender, who live in a given type of community and
have a given level of education violated the privacy rights of these persons?

It should be obvious that consistent with the principle of protecting
privacy rights, personal data should be released only for the performance of a
"function" which is accurately defined, and whose performance warrants in a
constructive manner that the risk related to the release of personal data be
taken. In the judgment of the Constitutional Court the only organs which have
functions like this are the state administrative organs and the judiciary.
Accordingly, if the requester organ verified that it needed the data for the
lawful performance of a function within its authority and jurisdiction, that
verification also established a limit with respect to the kind of data it could
request. If that organ also described the circumstances which guaranteed
adherence to the established purpose and the security of data, and further, if
the request for data was documented by the state census (also to the affected
person), the data conveyance would have satisfied the objective conditions for
protecting personal data. Thereafter it should still be examined whether the
release of data should be denied on grounds of TVR Paragraph 8 In providing the
above example the Constitutional Court wishes to convey the sense of the level
of guarantees demanded by the right to make an independent decision, and to
demonstrate its position according to which, short of such guarantees, TVR
Paragraph 7 is unconstitutional.

It follows from the above that identical restrictive conditions must also be
applied to the release of data to private persons and to "organizations" other
than state administrative organs and the judiciary. In such instances the need
to enforce the right to make an independent decision may be satisfied by
permitting in general the state census bureau to release a home address based on
a right (perhaps just interest) evidenced in writing. Let the private person
obtain additional data from the affected person; if a right indeed exists he
may do so even by way of court action. At the same time, the duty to examine
requests for data, as established in Paragraph 8, also applies to this case: The
state census bureau may refuse to release a residential address as a matter of
protecting the affected person's rights.

The Constitutional Court intends to secure the constitutionally mandated
protection of this right as long as the TVR is in force. In the present case
the Court was able to do so by declaring null and void certain parts of the TVR
to the effect that it discontinued the opportunity to release data to
organizations not entitled to regularly receive data, while it tied the release
of data to private persons to written verification of the related right. In
principle, the Constitutional Court regards the release of a name and address as
constitutional even if a just interest exists. But since invalidating legal
provisions is the only means available to the Constitutional Court, it is unable
to distinguish between various users and various methods of use relative to the
data stored by the state census bureau. After invalidating the legal provisions
specified in this Decision, a private person may seek the release of all
presently stored information -- i.e. not only a name and address -- provided
that he proves his right to do so in writing, beyond the release of such
information the census bureau's evaluation based on Paragraph 8 is the only
means by which the release of data can be restricted. It appeared as too risky
for the Constitutional Court to rely on this uncertain defense relative to
requests for data based on "just interest" and on the organizations'
"functions."

According to TVR Paragraph 7 Section (3) decrees may prescribe the mandatory,
regular release of data to certain organizations to enable these to perform
their basic functions. These organizations were defined in the two implementing
decrees. It should be obvious that from the standpoint of a constitutionally
sound data conveyance method to organizations designated in the decrees -- e.g.
councils and ministries -- the "basic function" criterion alone is insufficient.
For this reason, and because the personal records maintained by autonomous local
governmental bodies or ministries do not constitute a unit, and since the need
to link the release of data to an established purpose also restricts exchange of
information between various data processing endeavors within a single
institution, legislation must specify the kind of data to be conveyed on a
regular basis, and the record keeping systems which must receive the specified
data on a regular basis.

In addition to the substantive unconstitutional aspects related to the
conveyance of data, a procedural unconstitutionality with respect to related
authorizations exists also in this instance: The Council of Ministers, and to an
even lesser extent a "decree" must not define regular, mandated recipients of
data, and the scope of data to be provided.

2.4 The above described regulatory shortcomings gravely endanger the rights
of the affected persons. Similarly, the guarantees expressly intended to
protect privacy rights are insufficient to satisfy the standards of
constitutionality.

The duty to protect privacy rights, as that has been assigned to the census
bureau in TVR Paragraph 8, cannot be performed because the conditions for the
conveyance of data prescribed in the TVR themselves violate privacy rights.

Further, the fact that Paragraph 10 Section (2) grants to the affected person
a right to make corrections only is insufficient. Since it is the essence of
the right to make an independent decision that the affected person has a right
to know and to follow the ways and circumstances in which his personal data is
used, the preliminary conditions for exercising this right must be established
first. This means that the census bureau must be mandated to document each
individual request for personal data it received, i.e. to whom, at what time and
for what purpose such data has been released. The recorded use of records
received from other sources (Paragraph 7 Section (1)) is also part of this
matter. Documentation is also necessary because in case a correction takes
place, such correction must be entered in all records which used the incorrect
information. The rights of the affected person must be extended to include the
opportunity to delete information from the records, in addition to correcting
the information. For example, an affected person should be able to demand the
deletion of information borrowed by the census bureau from some other record, if
it failed to do so. All this necessitates of course that the affected person's
right to review his personal record (Paragraph 10 Section (1)) be extended to
include a review of the documentation, so that access to the documentation may
not be denied on the basis of Paragraph 83 Section (2) of the Civil Code of
Laws. This provision provides potential grounds for denying access to such
documentation on grounds that such access would violate "state or public
security interests."

According to the TVR, personal data may be publicized only in cases defined
by legislative enactments and in Council of Ministers decrees (Paragraph 10
Section (3)). In the above context the general authorization granted to the
Council of Ministers is also unconstitutional. The Constitutional Court notes
that the state census bureau would have satisfied its obligation to protect
privacy rights from the outset, had it conveyed or publicized personal data
only if the function designated as the reason for requesting data could not be
performed with the help of data which excluded the possibility of identifying
individuals (anonymous data). Anonymous data can be of great help to autonomous
local governments and to business organizations without endangering privacy
rights whenever data concerning groups of people is sought for planning,
statistical or business purposes.

Since the right to make an independent decision may be restricted in a
constitutional manner only when such restriction is unavoidable, the protection
of privacy rights satisfies the Constitution only if the affected person is
able to prohibit the release of his data by the state census bureau. Instances
which present "unavoidable situations" and justified exceptions from under the
rule may be defined in the framework of legislation.

3. A general, uniform personal identification code which may be used without
restriction (i.e. a personal number) distributed to every citizen and to every
resident of the country based on an identical principle is unconstitutional.

TVR Paragraph 6 Section (2) states that "Personal numbers must be used as
correlating data in computerized records which also contain personal data, such
numbers must be entered into official documents and records, and further, must
be used in the course of state administrative and judicial proceedings."

Based on a narrow interpretation of this Section personal numbers must be
treated as correlating data in the census bureau computers and must be entered
into state census documents and records. Under a broad interpretation,
however, the use of personal numbers may apply to all kinds of official
documents and records, and an even broader interpretation of Paragraph 6 would
permit the use of personal numbers in all kinds of computerized records. These
provisions exceed the scope of census operations anyway. Accordingly, the TVR
provisions related to personal numbers may be misunderstood; as demonstrated in
practice, the provisions were not suitable to unequivocally define the mandatory
application of personal numbers.

But the possibility of misunderstanding is a mere consequence of the
shortcoming which is far more significant from the standpoint of constitutional
law: Paragraph 6 does not contain any restriction or condition whatsoever with
respect to the use of personal numbers.

3.1 The personal number provided for in the TVR is a so-called universal,
multipurpose identifier, which in principle may be used in any and all records.
In contemplative discussions not closely tied to the TVR, but which were
included as part of the arguments supportive of this Decision, the
Constitutional Court used the term "personal number" with the above meaning.
(The other kind of personal number is tied to the purpose of a given data
processing system, and may be used as an identifier only within such a system,
e.g. pension number, account numbers. These limited use personal numbers raise
in part different problems relative to privacy rights. The actual legal
problem implicit in the relationship between the two types of personal numbers
is that the legislature could prevent the general use of personal numbers even
if it was tied to an established purpose.)

The sense in having a uniform personal identification code is that it enables
an easy and secure comparison and gathering of data pertaining to one and the
same person with the help of a brief, from a technical standpoint easily
manageable code which cannot be changed and cannot be confused with another
code. Thus a personal number is the natural companion of all integrated record
keeping systems; the idea of introducing such code emerged both in Hungary and
abroad as part of plans to have large central data banks which store
information. Further, a uniform personal code is eminently suited for the
linking of personal data contained in various records to specific cases. Data
becomes easily accessible, and may be mutually verified with the help of such
codes. These technical advantages increase the efficiency of data processing
based on personal numbers, and the related administration and service
provisions. Similarly, personal numbers save time and money for the persons
whose data is stored, because they render the repeated submission of data
avoidable.

These advantages present grave risks from the standpoint of privacy rights,
and in particular from the standpoint of the right to make an independent
decision. Personal numbers present a particular threat to privacy rights. If
data is acquired by "sparing" the affected person from having to deal with
various data bases, the affected person will be excluded from the flow of data,
and will be restricted in, or deprived of the possibility to control the path
and use of his own personal data. This method conflicts with the fundamental
principle of data protection which holds that data must be acquired from the
affected person, with the knowledge of the affected person. The private sphere
ceases to exist under the pervasive use of personal numbers, becasue a so-called
personal profile may be produced from the most distant records generated for a
variety of purposes. The personal profile is an artificial image which covers
any part of the affected person's scope of activities, and which also
penetrates into the intimate life of the affected person. At the same time,
however, such personal profiles are very likely to be distorted because the data
used has been taken out of context. And yet, data processors make decisions on
the basis of such information, and produce and convey new information concerning
persons. The large volume of connected data of which the affected person is
unaware in most instances, creates an unequal situation insofar as
communications are concerned. Any situation is humiliating in which one side is
unable to learn about the kind of information his partner has. This renders
free decision impossible. The power of a state administration which uses
personal numbers increases immeasurably. If the use of personal numbers is also
permitted outside of the state sphere, this fact not only grants more power over
the affected person to the data processor outside the state sphere, but also
leads to a further increase in state power: it extends even further the
opportunity to exercise control on the basis of data.

All this gravely endangers the freedom to make independent decisions and
constitutes a threat to human dignity. Personal numbers whose use is
unrestricted may become the means for total control.

Accordingly, the logic of personal numbers is contrary to the constituent
elements of data protection: to the principle of having separate information
systems tied to established goals, and to the main rule which holds that data
must be obtained from the affected person with the knowledge and consent of the
affected person. If followed consistently, the principles of data protection
eliminate the sense of personal numbers because the "advantages" provided by
such numbers cannot be taken advantage of.

Considering the methods by which data is processed today, the personal number
is the technically most advantageous means for linking personal data in a
reliable manner. Quite naturally, personal data may also be linked on the basis
of names, and other identifiers that become necessary, such as the mother's
maiden name or a person's address. Considering the capacity of present day
computers, the extent of such identifiers would not create any particular
problem. But "natural" data is subject to change (e.g. names change as a result
of marriage or by changing names), and situations may occur in which further
data becomes necessary; and further, in case of changing data (such as the
residential address) it becomes necessary to follow and to maintain and data.
The related difficulties and expenses present themselves as significant items in
data processors' cost versus profit analyses, and these costs discourage
unwarranted data collection prompted by having personal numbers on hand. The
barriers flowing from the right to make an independent decision apply to all
data collection and processing efforts. But the personal number demands special
safeguards commensurate with the increased risks, precisely because of the
technical perfection implicit in personal numbers. If personal data accessible
through personal numbers is maintained by a central record keeping organization,
the data processor -- e.g. the census bureau -- finds itself in a key position.
For this reason the data processor must be subject to particularly specific
rules which provide guarantees.

3.2 Accordingly, by virtue of its nature, the personal number presents a
particular threat to privacy rights. It follows from the state's first class
duty to protect fundamental rights (Constitution, Paragraph 8) that this risk
must be reduced to a minimum: it must tie the use of personal numbers to rules
which provide guarantees. This can be accomplished in two ways: the state could
either restrict the use of personal numbers to specific data processing
endeavors, or it could tie the permissibility to release information covered by
personal numbers, and the linking of records which contain such information to
strict restraining conditions and controls. At the same time we must recognize
that as a result of restricting the uniform and general code in any manner, we
also lose the essential purpose of such code. A limited use personal number is
no longer a personal number in the sense that this concept is used in the TVR.

3.3 The use of personal numbers varies greatly in different countries. A
number of countries have de facto universal personal numbers. These resulted
from identification codes originally used for specific purposes which then
proliferated and enjoyed unimpeded application. These numbers were originally
introduced to serve census or social security purposes. Belgium, Denmark,
Iceland, Holland and Norway exemplify the first case, while Finland and
Switzerland the latter case. The Swedish personal number is regarded as the
text book example for universal personal numbers. Its original purpose was to
assign numbers to birth records.

In other countries the use of personal numbers is prohibited, moreover, it is
regarded as unconstitutional. A law enacted in Portugal in 1973 ordered the
introduction of universal personal numbers beginning in 1975. In contrast,
Paragraph 35 Section (2) of the 1976 Constitution promulgated after the collapse
of the Fascist regime prohibited the linkage of data bases containing personal
records, and Section (5) provided that "the assignment of a nationwide, uniform
personal number to citizens shall be prohibited." In France and in the Federal
Republic of Germany resistance against census records using personal numbers
lead to the promulgation of the 1978 data protection laws, and at the same time
to discontinuing integrated records and the personal number. The German Federal
Constitution declared in 1969 already that "the registration and cataloging of
the full personality of individual citizens" cannot be reconciled with the
fundamental right to human dignity, and the state has no authority to pursue
such endeavors even under the anonymous circumstances of statistical data
collection (BVerfGE 27.1.6); and the so-called census judgement which in 1983
defined the right to make an independent decision, regarded the personal number
as the "decisive step" by which personality profiles could be obtained, for the
avoidance of which one must accept even other methods of restricting the right
to make an independent decision (BVerfGE 65.1.27, 53, 57).

One finds other states whose practices fall between these two extremes. In
these countries personal numbers are used for purposes other than the
established purpose of these numbers, nevertheless these countries succeeded in
preventing these numbers from becoming universal codes. (Thus, for example, the
identification number assigned by the French National Economic Statistical and
Research Center to every person born in France did not become a general personal
number, and in a similar manner legal barriers were established in Canada with
respect to the use of social security numbers.)

During the 1970's the threats presented by electronic data processing to the
autonomy of the person became publicly known. From then on the personal number
became the symbol of total control over citizens, and was regarded as an outlook
which considered efficiency only, and which treated the person as an object.
Even though the personal number is only a means and can be evaluated only in the
total context of regulating data processing, its introduction and use enables it
to play the role of clashing the two value judgments: technical feasibility on
the one hand, and the primacy of the right to privacy on the other. These
debates resulted in the establishment of a general requirement for the
specific regulation and limitation by law of the use of personal numbers, and
this process has also begun in countries which introduced personal numbers
before awareness of the need to protect data evolved. (See: Report of Council
of Europe, Expert Committee on the Protection of Data: "The Introduction and Use
of Personal Identification Numbers: Issues Pertaining to the Protection of Data.
Strasbourg, 15 December 1989.) Use of personal numbers would already be
restricted by applying the general principles of data protection, as that is
done with respect to any other personal data. According to this principle, a
person must be legally authorized before he demands the release of a personal
number; no one must suffer disadvantage for not having a personal number or for
refusing to release his personal number. Personal numbers must not contain
sensitive personal data (e.g. nationality, religion) -- but a requirement that
the personal number not become a "tell tale" number is gaining ground, i.e. that
the personal number not include information such as date or place of birth.
Laws must accurately circumscribe the use of personal numbers, and an
independent commissioner charged with the protection of data must verify
compliance with the law. In addition to establishing these general
requirements, however, risks inherent in personal numbers must also be offset by
applying separate safeguards. In Norway, for example, the establishment of
records based on personal numbers is subject to a separate permit, and in regard
to certain records Norway prohibits the use of personal numbers. Interface
between records based on personal numbers must be subject to particularly strict
conditions and controls, and such activities must be rendered transparent to the
affected persons. These safeguards have been instituted for example by the
Swedish office for data protection.

Safeguards related to personal numbers must also prevail in regard to other
similar identifiers (e.g. personal identification documents, passports and
authorization numbers), and with logical changes, in personal codes used in
certain specialized fields (pension, social security numbers).

3.4 The present rules governing personal numbers are unconstitutional because
TVR Paragraph 6 mandated, and elswhere enabled the unlimited use of personal
numbers by state organs without providing adequate safeguards against dangers
inherent in the use of personal numbers.

Hungarian law enabled the rise of all threats implicit in the nature of
personal numbers, when it failed to provide for any constraint regarding the use
of personal numbers, and when it introduced personal numbers in a legal milieu
in which the fundamental guarantees of the right to protect data were unknown.
(Only one partial issue was recognized from among these safeguards: the affected
person's right to review his own personal data. This safeguard was taken out of
its own context and therefore never prevailed.) The possibility of restricting
the flow of data within the state administration was not even mentioned in
official circles, at the same time, however, release of the personal number was
established as a condition outside the state sphere for receiving services.
Under such circumstances a multitude of records based on personal numbers was
generated, often without the knowledge of the affected person. Interface
between these records was unobstructed; no one knows by now who can have access
to his personal data, and if so, where and when such access is possible.

Provisions related to privacy and the safeguarding of secrets, as those
contained in the Civil Code of Laws and elsewhere, are insufficient with respect
to the threats created in this manner. This is so, even though the 1977
amendments to the Civil Code of Laws included a general clause according to
which computerized data processing must not violate privacy rights. These
amendments also introduced the right of affected persons to make corrections,
and prohibited the release of information to unauthorized persons (Civil Code of
Laws Paragraph 83). But to this date no legal provision or court decision has
provided a substantive meaning to the above mentioned general clause, or at the
minimum, has specified the constituent elements of the right to make an
independent decision or of the right to the protection of data. Thus the data
processors are not constrained by the requirement of having to have an
established purpose, nor are they restricted by the rules of entering or
conveying data, and the affected persons are unable to learn of their rights.
(Still today, the affected persons have no legally established opportunity to
find out in what records they are included, and thus the exercise of the right
to review is illusory.) Independent control over data processing has been
missing altogether. Only the TVR contained more detailed rules for the flow and
protection of personal data. These provisions, however, were inadequate from
the standpoint of constitutional standards, as was shown in this Decision of the
Constitutional Court. The above mentioned, and even generally insufficient
safeguards are entirely unsuited to offset the peculiar risks inherent in the
character of personal numbers. Neither the TVR, nor any other Hungarian law
contains provisions intended to protect against the special dangers that
attended the personal number, by either establishing conditions or controls for
the use of such numbers or by enabling the control of such use.

Based on all of the above, laws now in force concerning the personal number
are repugnant to the Constitution: they are contrary to the right to protect
personal data (Constitution, Paragraph 59), and unnecessarily and
disproportionately limit the exercise of that right.

3.5 It is the duty of the legislature to create an act concerning the
protection of personal data and regarding accessibility to information of public
concern, and further, to express the basic principles included in that
legislative enactment in specific terms, in the framework of so-called
area-specific legislative enactments. These legislative enactments must be
consistent with Paragraphs 59 and 61 of the Constitution. It is the
legislature's responsibility to decide whether to reintroduce with restrictions
the personal number which in its present form is voided by the Constitutional
Court, and if so, to decide the constraints to be applied and the specialized
control mechanism to be developed. In the present case the Constitutional Court
declares that the personal number is unconstitutional because the TVR has failed
to include any limitation relative to the personal number. This, however, must
not mean that just any kind of restriction would suffice to render the
institution of personal numbers constitutional. For this reason the
Constitutional Court summarizes the above detailed opinion with respect to
limits within which a permanent personal identity code could be regarded as
constitutional.

The Constitutional Court determines that by virtue of its essence the
universal personal number is contrary to the right to make an independent
decision. For this reason, identifying numbers whose use is restricted to data
processing for a specific purpose may be reconciled with the Constitution. A
legislative enactment which introduces such a limited use "personal number" must
contain regulatory and control guarantees to prevent the use of such numbers in
other contexts. Neither the "state sphere," nor the state administration as a
whole may be regarded as a unit within which a uniform personal identification
code could be introduced or used.

4. The TVR and its implementing decrees create and maintain a situation
which constitutes a grave violation of the Constitution. Therefore their
immediate invalidation is warranted. At the same time, the Constitutional Court
recognizes the fact that a sudden change in the record keeping systems
established on the basis of these legal provisions, for the purpose of
permitting these systems to be used for personal identification in a manner
consistent with the Constitution, would temporarily render the functioning of
the state administration significantly more difficult. Further, the
Constitutional Court considered the fact that the reforming of these systems has
begun and that legislation providing for the protection of personal data will be
enacted within the foreseeable future. Accordingly, in order to facilitate the
transition to a constitutional personal record keeping system, the
Constitutional Court sustains until the end of this year certain provisions of
the TVR in force on the basis of which the state census bureau would be capable
to supply data that was absolutely necessary in order to provide legal
protection to citizens and from the standpoint of administrative functioning.
The continued supply of data to private persons is temporarily permitted,
provided that these private persons prove their related right in writing.
Similarly, data may be supplied to organs authorized by the Council of Ministers
decrees to regularly receive data. (See the related arguments in 2.3 above.) On
the other hand, the conveyance of data to private persons invoking only a just
interest, or to those not able to verify their right in writing, and further, to
all organizations except for the above exceptions, shall cease effective
immediately. In order to enable this function of a limited scope, and to
facilitate reorganization, the Decision left untouched the data gathering field
until the end of this year. The Decision discontinues with an immediate effect
only the opportunity to broaden this function based on decrees.

As a result of the grave unconstitutionality of the present use of personal
numbers, the Constitutional Court invalidates the provision which mandates the
use of personal numbers in official documents, records, administrative and
judicial proceedings, and which requires the entering of the personal number
into the personal identification booklet. Beginning on the date when this
Decision is published no one has the authority to demand from another person, or
to render the exercise of a right or the provision of a service contingent on
the disclosure of the personal number.

The Constitutional Court stipulates that the existing personal numbers will
not be deleted from state records until the new codes are introduced based on a
legislative enactment. The Constitutional Court nevertheless calls attention to
the fact that personal numbers of new persons must not be added to records, and
to the fact that interface between records with the use of personal numbers is
not included in the grace period in which the already existing personal numbers
-- to be used exclusively as internal references -- will not be deleted for the
time being. The threat implicit in this kind of limited use of the
unconstitutional personal number is offset by the fact that by virtue of its
character this use is condemned to extinction: the unity of systems will
necessarily disintegrate because new data tied to personal numbers will not be
incorporated, and because affected persons will not reveal their personal
numbers.

Discontinuing the unconstitutional condition is the duty of everyone who
recorded personal numbers, irrespective of whether these data processors acted
on behalf of the state. State data processors used the personal numbers at
their own risk, in theory depending on receiving the consent of the affected
persons.

The state census bureau is the sole organization authorized to issue new
personal numbers until 31 December 1991, and to use those only as internal
reference in conjunction with the existing personal numbers. This is necessary
in order to preserve the wholesomeness of the aggregate data until the
legislature renders a decision regarding the constitutional successor
organization to the census bureau.

5. Pursuant to Paragraph 41 of Law Number 32 of 1989 the Constitutional
Court publishes this Decision in MAGYAR KOZLONY.

[Signed] Dr. Laszlo Solyom, chairman of the Constitutional Court, the
Constitutional Court Justice presiding Constitutional Court justices: Dr. Antal
Adam, Dr. Geza Kilenyi, Dr. Peter Schmidt, Dr. Odon Tersztyanszky, Dr. Geza
Herczegh, Dr. Tamas Labady, Dr. Andras Szabo, Dr. Imre Voros, and Dr. Janos
Zlinszky



<< Back

Email us at privacyint@privacy.org.
Call on +44 (0)208.123.7933.
Privacy Policy - About PI - Support PI