Hungary: Employee Monitoring From The Perspective Of Hungarian Data Protection Laws

While employers oftentimes wish to monitor the behavior of their employees, which generally is a rightful intention, it is also the employees' rightful expectation for the employer to respect their privacy and personal data. In this article, we provide a brief overview of the most important rules employers must observe when monitoring their employees.

Under the Hungarian Labour Code, an employer may inspect the work of its employees. However, there are certain mandatory rules employers must comply with when actually monitoring employee's behaviour.

The data commissioner has issued several opinions (aka information sheets) on the employer's control of the employee's use of Internet, email and cellular phone. They also addressed the issue of surveillance cameras at the workplace and to what extent and under what conditions employers may use them.

Under the Hungarian Data Protection Act, personal data may only be managed with consent from the person concerned. Personal data means any information relating to an identified or identifiable natural person and any reference drawn, whether directly or indirectly, from such information. In the course of data management, such information shall be treated as personal data as long as the data subject remains identifiable through it. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his/her physical, physiological, mental, economic, cultural or social identity.

For the purposes of the Data Protection Act, data management means any operation or set of operations that is performed upon data, whether or not by automatic means, such as collection, recording, arrangement, storage, adaptation or alteration, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, deletion or destruction, and blocking them from further use. Photographing, sound and video recording, and the recording of physical attributes for identification purposes (such as fingerprints and palm prints, DNA samples and retinal images) also qualifies as data management.

It is worth noting that concerned person's consent means any freely given specific and informed indication of his / her wishes by which the person concerned signifies his / her agreement to his / her personal data being processed without limitation or with regard to specific operations. This means that for the purposes of the Data Protection Act, only consent that has been granted based on proper, complete and prior information given by the employer may be regarded as consent.

We now briefly address the various means through which employee behavior may be lawfully monitored.

1 Internet Use

The employer may monitor the use of Internet by the employees if

(i) the employer has previously informed the employees that Internet is provided specifically for work-related purposes and of the prohibition to use the Internet for private purpose and also of the employees' rights concerning data management and

(ii) the employees have given their written consent regarding monitoring as indicated under clause (i) above.

The monitoring must be proportionate with the aims wished to be achieved by the employer and must be justified by a lawful aim of the employer. Personal data can only be managed for specified and explicit purposes, where it is necessary for carrying out certain rights or obligations. This purpose must subsist in all stages of operations of data management. The personal data managed must be essential for the purpose for which they were collected, they must be suitable for achieving that purpose, and they may be managed to the extent and the duration necessary for achieving that lawful purpose.

If the employer has not prohibited or restricted the use of Internet for private purpose or has explicitly allowed private use, the employer may not lawfully monitor employees' Internet use.

It is worth noting that if the employer may monitor the use of Internet, it does not mean that the employer has the right to review all data collected through monitoring. The employer may only list the data downloaded and the sites visited; it may not review such data and sites.

Of course, the employer may restrict the employees' use of Internet in a way that certain sites cannot be opened. In addition, the employer may also easily list the sites opened and files downloaded.

2 Email Use

If the employer wishes to monitor email correspondence, the employer must properly and completely inform the employees of the monitoring of email use in advance. The information must cover the following:

(i) purpose and duration of monitoring;

(ii) entity carrying out data management and

(iii) rights of the data subjects.

The employer must obtain prior written consent to such monitoring from the employees. Again, as indicated above, personal data may be managed only for specified and explicit purposes, where it is necessary for carrying out certain rights or obligations. This purpose must subsist in all stages of operations of data management. The personal data managed must be essential for the purpose for which they were collected, they must be suitable for achieving that purpose, and they may be managed to the extent and the duration necessary for achieving that purpose.

It is worth noting that any email sent to or received from a third party may not be reviewed. This is because the third party has not given his / her consent to such review / data management.

If the employer has provided an email account to the employees for work purposes, the employer may review the subject of the email, the name of sender and recipient, date and size of email. Following such review, the employer may require the employee to hand over to him a specific email. The employee may refuse to hand over an email only by way of reference to a third party's interest.

Instead of a total prohibition from using the work-related email account for private purposes, it is also possible to restrict the use of email, e.g. in a way that emails above a certain size may not be sent from the specific email account or no email may be sent to a specific addressee.

It is worth noting that IT hosts may review email correspondence if such review is necessary for protecting the employer's IT system from viruses. However, it is essential that the information collected by the IT host through the review may not be handed over to third parties, including the employer.

3 Cellular Information

If the employer wishes to know where certain employees are during working hours, the employer must properly and completely inform the employees in advance of such monitoring during working hours. The information must cover the following:

(i) purpose and duration of monitoring;

(ii) entity carrying out data management;

(iii) rights of the data subjects.

The employer must obtain prior written consent to such monitoring from the employees. Personal data may be managed only for specified and explicit purposes, where it is necessary for carrying out certain rights or obligations. This purpose must subsist in all stages of operations of data management. The personal data managed must be essential for the purpose for which they were collected, they must be suitable for achieving that purpose, and they may be managed to the extent and the duration necessary for achieving that purpose.

The employer may under no circumstance monitor the location of its employees out of working hours.

It is worth noting that the employer may not monitor any private calls from office cellular phones nor may it list the calls placed by the employee. This is because the third party (the calling party or the person called) has not given his / her consent to such monitoring.

A practical proposal, as suggested by the data commissioner, is as follows: The employer sets a threshold (budget) for the employees up to which threshold the employer pays the cellular phone bill. This threshold may be determined in a way that it also covers the costs of some estimated private calls by the employees. The relevant employee then pays the amount exceeding the monthly threshold.

4 Use of Surveillance Cameras

If an employer wishes to install surveillance cameras at the workplace, it must properly and completely inform all employees of the surveillance in advance. The information must cover the following:

(i) purpose and duration of surveillance;

(ii) entity carrying out data management;

(iii) rights of the data subjects and

(iv) whether the surveillance cameras record or simply show real time events without recording anything.

Personal data may be managed only for specified and explicit purposes, where it is necessary for carrying out certain rights or obligations. This purpose must subsist in all stages of operations of data management. The personal data managed must be essential for the purpose for which they were collected, they must be suitable for achieving that purpose, and they may be managed to the extent and the duration necessary for achieving that purpose.

An employer must obtain prior written consent from the employees if surveillance cameras are used to check the performance and/or presence of employees. No consent is needed if surveillance cameras are used to detect theft (e.g. if the cameras are installed in a warehouse). In this case, prior information is sufficient.

The use of surveillance cameras may not be secret. In addition, no surveillance cameras may be used in changing rooms, restrooms, toilets or kitchens. The surveillance cameras must be installed in such a way that they are clearly visible to those entering the relevant room and a sign must be posted at the entry of the rooms equipped with such cameras.

In addition to the above, the employer must ensure that the footage is deleted as and when necessary under the law.

Although employees can request that the employer delete relevant footage relating to them, the employer may refuse this request if it turns out that the employee requesting deletion committed a theft which can be proven by the relevant footage.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Authors
 
Some comments from our readers…
“The articles are extremely timely and highly applicable”
“I often find critical information not available elsewhere”
“As in-house counsel, Mondaq’s service is of great value”

Related Topics
 
Related Articles
 
Up-coming Events Search
Tools
Print
Font Size:
Translation
Channels
Mondaq on Twitter
 
Mondaq Free Registration
Gain access to Mondaq global archive of over 375,000 articles covering 200 countries with a personalised News Alert and automatic login on this device.
Mondaq News Alert (some suggested topics and region)
Select Topics
Registration (please scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.

Disclaimer

The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.

General

Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions