The Hungarian government’s misuse of personal data during the 2022 national elections campaign undermined privacy and further tilted an already uneven playing field in favor of the ruling party, Fidesz, Human Rights Watch said in a report released today.
The 85-page report, “Trapped in a Web: The Exploitation of Personal Data in Hungary’s 2022 Elections,” examines data-driven campaigning in Hungary’s April 3, 2022 elections, which resulted in a fourth consecutive term for Fidesz and Prime Minister Viktor Orbán. Human Rights Watch found that the government repurposed data it collected from people applying for services to spread Fidesz’s campaign messages. The blurred lines between government and ruling party resources, including data, and the capture of key institutions by the government led to selective enforcement of laws that further benefited Fidesz.
“Using people’s personal data collected so they could access public services to bombard them with political campaign messages is a betrayal of trust and an abuse of power,” said Deborah Brown, senior technology researcher at Human Rights Watch. “The Hungarian government should stop exploiting personal data for political campaigns and guarantee a level playing field for elections.”
Human Rights Watch interviewed experts on privacy and data protection, election integrity, and political campaigns; representatives of political parties; companies involved in data-driven campaigning; and people whose data was misused by political campaigns. Human Rights Watch also undertook technical analysis of political party and campaign websites to understand how they handled users’ data.
Human Rights Watch found that the government repurposed data it had collected from people who signed up for the Covid-19 vaccine, applied for tax benefits, or registered for mandatory membership in a professional association to spread Fidesz’s campaign messages. For example, people who submitted their personal data to a government-run website to register for the Covid-19 vaccine received political messages intended to influence the elections in support of the ruling party.
The 2022 elections took place after 12 successive years of Orbán governments, which have undermined the independence of the judiciary, dominated public institutions, controlled the media landscape, criminalized activities by civil society organizations, and demonized vulnerable groups and minorities.
Hungary has a responsibility under regional and international law to protect privacy and to guarantee the right to participate in democratic elections. An even political playing field is a necessary condition for the right to participate in democratic elections, as outlined in regional and international standards.
Several people interviewed said they did not believe they were consenting to receive other government communications when they registered on the vaccine website, and were angered by the use of the registration data for political and electoral campaigning. They said they felt the government had taken advantage of them at a particularly vulnerable time during the pandemic.
A 36-year-old woman from the Budapest metropolitan area said that in the context of the fear and uncertainty caused by Covid-19, when she saw the question about further contact with the government, she had “this feeling that you cannot do otherwise, I have to be vaccinated.… This was not a free choice and that’s why I was so angry.”
Parties across the political spectrum in Hungary, as in other countries, have invested in data-driven campaigning, including building detailed voter databases, running online petitions and consultations to collect data, purchasing online political ads, deploying chatbots on social media, and conducting direct outreach to voters and supporters through robocalls, bulk SMS messaging, and emails. Such tactics have significant implications for human rights, including the right to privacy.
Human Rights Watch found that the opposition parties’ processing of personal data lacked transparency and risked undermining privacy but, unlike with the ruling party, found no evidence that their handling of data created unfairness in the election process.
People interviewed reported receiving unsolicited phone calls and text messages and being bombarded by political ads on social media from a wide range of political parties. Human Rights Watch detected that some of the data collected about visitors to the major party-affiliated websites were shared, through the use of third-party trackers, with known advertising technology companies like Facebook and Google. This practice suggests a culture of disregard for people’s privacy.
Hungary should rectify shortcomings concerning the use of people’s data for political campaigns in laws, policies, and practices, Human Rights Watch said. Specifically, it should ensure that legal and institutional frameworks unambiguously prohibit the misuse of administrative resources, including personal data collected from citizens. State institutions such as the judiciary, election administration bodies, and the data protection authority should be genuinely independent, impartial, and insulated from abuse by the ruling party.
At time of publication, government officials had not responded to Human Rights Watch’s November 14 letter asking for comment on the report’s main findings.
Political parties in Hungary should be more transparent about how they collect and process voters’ data, and demonstrate that they are taking their responsibility to respect people’s privacy seriously.
Facebook and other platforms provided a degree of transparency into campaign spending by offering limited insight into spending on political ads with their ad libraries. However, the opacity of certain ad targeting and delivery techniques provided by Facebook, which Hungarian political parties used, risks targeting people directly or indirectly based on their political opinions, further violating their right to privacy and undermining the democratic process.
Both the European Data Protection Supervisor and the European Data Protection Board have highlighted the risk of using personal data beyond their initial purpose, including to unduly influence people when it comes to political discourse and democratic electoral processes.
Social media platforms have a responsibility to respect human rights. They should provide meaningful transparency so that people can sufficiently understand the ad targeting and delivery techniques used, both in ad libraries and in real time. They should also ensure that ad targeting and delivery are not, directly or indirectly, based on observed or inferred special categories of data, including political opinions.
The European Union should urgently assess whether the exploitation of personal data collected by the Hungarian government for political campaigning is consistent with EU laws, specifically the EU General Data Protection Regulation, Human Rights Watch said. The European Commission should bring infringement proceedings against the National Authority for Data Protection and Freedom of Information for failing to meet the qualifications of an independent supervisory authority.
“In Hungary and elsewhere, electoral campaigns today rely heavily on data, often collected in non-transparent ways,” Brown said. “Governments, privacy and election experts, the tech industry and others should ensure that data-driven campaigning does not undermine people’s privacy or their right to participate in a democratic election.”