The National Data Protection and Freedom of Information Authority (hereinafter referred to as the Authority) has received numerous reports in which the complainants dispute the legality of the data processing of Mr. Előd Novák, Member of Parliament, in connection with the photo competition titled ” The Blessing of a Child ” announced on his public Facebook page on January 28, 2025.
According to the announcement, ” photos of pregnant women can be submitted to the photo competition (even from years ago), but other people can also be seen in them (mainly family members). A photo of a relative can also be submitted secretly ; in the event of an award, the jury will coordinate the appearance with the person concerned in advance.”
The Authority considers the purpose and message of the competition important, however, it has established that the photo competition in the form announced violates the provisions of the General Data Protection Regulation (GDPR) on several points. In its current form, it is not compatible with the principle of transparency, as data subjects do not receive adequate information about the data processing affecting them, and if the expectant mother or other family member cannot object to the data processing of the photo submitted for the competition, they do not even have the opportunity to object to the data processing. The Authority emphasizes that the intention of the applicant to participate cannot replace the consent of the data subject in the photo to the data processing affecting them, and the rights of the data subject are not overridden by the interests of the applicant submitting the photo or the representative announcing the competition during the data processing, and therefore the data processing does not have an appropriate legal basis.
In view of this , the Authority called on the data controller to immediately take measures to terminate the unlawful data processing in connection with the maternity beauty contest, to bring its data processing operations into line with the legal provisions, and to provide the Authority with proof of the measures taken within 3 days of receipt of the notice.
According to the GDPR, an image or audio recording – if the data subject can be identified – is considered personal data, and the creation, transmission and storage of such recordings constitute data processing. The Member of Parliament invites applicants to submit recordings of their family members or other persons secretly – which may also mean secretly making and submitting a recording, as well as secretly submitting an existing recording – both operations make the applicant a data controller under the General Data Protection Regulation, and it can no longer be considered private data processing on the part of the applicant. According to the consistent practice of the Constitutional Court, the use and transmission of secretly made recordings is considered an unlawful activity, and according to the Civil Code, submitting such recordings to the competition may also violate personal rights.
According to the GDPR, an essential condition for the lawfulness of data processing is that the data controller provides data subjects with comprehensive, plain-language information on data processing that covers all data processing purposes. There are only a very narrow range of exceptions to these requirements, which do not include photo contests.