How the Hungarian Civil Liberties Union turned a six-year thicket of data-protection cases into a paradigm shift for press freedom
To understand how Europe’s flagship data protection law has been turned into an instrument of press suppression in Hungary, Beatrix Vissy, a lawyer with the Hungarian Civil Liberties Union (HCLU) gives us a metaphor. “For journalists reporting on matters of public interest should be as natural as gravity,” says Vissy. “Yet in this legal environment, they have had to constantly ask themselves whether reporting is even possible. For them, it could feel as if they had suddenly found themselves in outer space, without the forces that usually guide normal life.”
That, in essence, is the world Hungarian investigative journalists have been operating in since the General Data Protection Regulation (GDPR) came into force in 2018. For close to six years, lawyers at the Hungarian Civil Liberties Union have been arguing, in administrative proceedings and courtrooms, that the rules designed to protect citizens from corporate and state data abuse were never meant to silence the press. Vissy and her colleague Léna Perczel are two of the lawyers who have worked on these cases.
After years of litigation — including more than thirty proceedings brought by a single family, a personal lawsuit against HCLU itself, and a pending application before the European Court of Human Rights — the organisation is finally seeing the ice break, with a landmark judgment against the misuse of the GDPR and a newly elected government vowing to change the press freedom landscape.
A Constitutional Inversion: How Hungary’s Data Protection Rules Were Weaponised Against Journalists
To grasp what changed in 2018, it helps to know what came before. After Hungary’s democratic transition in 1989, the Constitutional Court built one of the strongest data protection regimes in Europe, shaped, as Vissy notes, by the country’s experience with authoritarian surveillance. But the same court was equally clear about the other side of the equation.
Speech contributing to public debate deserved especially robust protection, and personal information relevant to that debate could only be withheld in exceptional circumstances. Crucially, the burden was on those seeking to restrict publication, not on the press to justify it.
“Since the GDPR came into force, however, this logic has been turned on its head,” Vissy says. “Hungarian journalists have been expected to justify the legitimate interest of publishing personal data, even when it relates to matters of public interest. They must also inform data subjects in advance, in a proactive and individualized manner, about the processing of their personal data — a requirement that may lead investigative journalism to a dead end.”
The GDPR itself, Perczel points out, anticipates this tension. Article 85 obliges member states to reconcile the GDPR with freedom of expression, including processing for journalistic purposes. Most, she notes, have done so. Hungary has not. The result was a regulatory vacuum that Hungary’s Data Protection Authority (DPA) and courts filled with their own interpretations — almost all of which, in the beginning, were firmly weighted against the press.
“The problem is not the GDPR itself,” Vissy says, “but the lack of clear journalistic exemptions and how this void has shaped the DPA’s and courts’ practice with adverse consequences for journalistic work.”
The Forbes Case: The Energy Drink Billionaires Who Filed 30 Proceedings Against a Magazine
The void was exploited in 2020, when the Barabás family, owners of the HELL energy drink empire, brought complaints against Forbes Hungary, the Hungarian edition of the magazine, after it included them on its annual list of Hungary’s wealthiest people (Forbes’ billionaire list). The figures Forbes had used were compiled from publicly available company data and reports. The family pursued the matter through both a civil suit, which produced an early preliminary injunction, and a complaint to the Data Protection Authority. The DPA’s response would set the tone for everything that followed.
The decision, Perczel says, “completely disregarded the role of the press in a democratic society and obliged Forbes to comply with all GDPR requirements without exception — just as it would a high-tech company or financial institution processing personal data for commercial purposes.” The Authority refused to accept the magazine’s general online privacy policy as adequate notice and fined Forbes around 4,625,920 HUF (approx. £11,279) for the failure to notify the Barabás family individually, in advance, and proactively that their data would be processed.
For HCLU, the decision was symptomatic of a deeper problem. The DPA had ignored the GDPR’s own preamble, which expressly respects freedom of expression. It had refused to apply Article 14(5)(b), which permits exceptions where compliance would impose an unnecessary burden on the publisher. And it had refused even to consider whether the legal basis for processing might be public interest rather than the commercial “legitimate interest” of the publisher. That last point matters more than one might think. Perczel explains that the obligation to notify subjects in advance arises only under the legitimate-interest basis. Had public interest been accepted, the entire notification trap would have been redundant.
Vissy describes how the DPA treated the GDPR as a kind of clean break that wiped out the constitutional balance built up since 1989, as though privacy in the journalistic context were being defined for the first time. That framing is what HCLU has been fighting to dismantle through individual cases.
Notification trap: The GDPR Loophole That Kills Investigations Before They Begin
The notification obligation mentioned before is, in HCLU’s view, the single most corrosive demand the DPA has placed on journalism.
Perczel sketches it out. A journalist begins quietly investigating a businessman with close ties to a politician. The moment they start gathering information, the DPA’s reading requires them to tell that businessman personally. And because the GDPR defines personal data so broadly, almost any fact tied to the subject already counts as data that must be disclosed.
“At this point, the investigation is essentially over before it begins, giving the subject the opportunity to hide evidence, silence sources, request a preliminary injunction, or simply tip off others involved.”
“Not to mention,” Vissy adds, “that this takes up a lot of energy from the journalist.”
The chilling effect has rippled through Hungarian newsrooms. Other outlets absorbed the lesson and held stories back rather than face the cost of civil and administrative parallel proceedings. “Self-censorship, in that sense, became a kind of protective shield,” Perczel says.
SLAPPs: How Data Protection Became a New Avenue
The HELL owners did not stop at one proceeding against Forbes. They pursued the magazine through every available level of administrative and civil review, often simultaneously.
Hungarian law, unlike many European systems, does not preclude parallel actions before the Data Protection Authority and the civil courts, and the Barabás family took full advantage. Then came what Perczel calls “nitpicking proceedings”: fresh claims targeting Forbes’s reporting on the very litigation it was already entangled in, including a press rectification case based on the magazine’s statement that the lawsuits were aimed at silencing the press rather than protecting privacy.
Vissy tells us that the numbers speak for themselves, “since 2019, Forbes has had to face more than 30 proceedings across 10 separate cases against the HELL-owners”.
This, HCLU argues, is the textbook profile of a Strategic Lawsuit Against Public Participation, with one important twist. The vehicle is not defamation but data protection.
“A tried and tested strategy would be filing a defamation lawsuit,” Vissy explains. “However, in the GDPR’s framework, an allegedly false statement can also be framed as a data protection issue on the grounds that the published personal data is inaccurate. Therefore, it has become relatively easy to bring a data protection case instead of or even in addition to a defamation lawsuit.”
The consequence, Perczel says, is that even articles produced according to the highest professional standards, “after dozens of background conversations, fieldwork, trawling through public records and databases, mapping the connections between uncovered facts, and all the other steps that form the backbone of investigative journalism,” and containing no false statements, can still be blocked at the moment of publication.
Preliminary injunctions: The Court Orders That Buried Stories for Five Years
Preliminary injunctions, the courts’ power to halt publication before a case is decided, compound the difficulties. In 2020, Forbes was ordered to withdraw already-distributed magazines from newsstands. The weekly Magyar Narancs was prohibited from publishing its article on the HELL owners in its entirety. In some HCLU cases, articles have been blocked for more than five years while litigation crawls forward.
“We all know that news is a perishable commodity,” Vissy says. “If a preliminary injunction lasts for years, while the courts deliver their final judgment, the story may simply lose its public relevance.”
“Imagine an investigative article on a sensitive corruption case being blocked shortly before an election. By the time the courts finally decide the case, the election may already be over.”
The Forbes injunction is now itself the subject of a case before the European Court of Human Rights, brought with HCLU’s assistance. In February 2026, the court communicated the application to the Hungarian government, signalling that it will be examined on the merits. “It would be particularly interesting if the Court said something about the DPA’s approach specifically,” Perczel says.
Magyar Narancs Breakthrough: The Landmark Ruling That Put Press Freedom Back Into Hungarian Data Law
Six years of incremental argument has now produced a decision HCLU describes as the most significant they have won in this context. The case, again involving the Barabás family, this time concerned Magyar Narancs and its investigation into how the HELL owners had become one of the country’s most influential business families in just over a decade, including the role of state financial support in that rise.
The Budapest Court of Appeal’s second-instance ruling did something earlier courts had stopped short of doing. It rejected the ‘clean break’ rationale outright.
“The court directly challenged that approach by making it clear that the GDPR does not operate on a blank slate; rather it is embedded in a long-standing constitutional framework for the protection of press freedom,” Vissy says. “Drawing on this, the court held that interpretations of data subjects’ rights that are inconsistent with the democratic function of the press and disproportionately limit the public’s right to be informed cannot be accepted.”
Perczel describes the ruling as a reframing of the very silence Hungarian regulators had used to justify their strict approach. “The DPA and the courts had long argued that the legislator’s silence on reconciling the GDPR with press freedom meant no reconciliation was needed, so the GDPR applied in full. The Court of Appeal turned this on its head: that silence reflected confidence in the existing balance, not indifference to it.”
What is genuinely new, Perczel says, is that earlier decisions had recognised the importance of press freedom case by case without explicitly exempting journalists from incompatible GDPR obligations. The Court of Appeal closed that gap. “Compared to where we started, the decision materially improves journalists’ ability to report without prior notification obligations that would expose sources or derail investigations.”
There are early signs that the DPA itself is shifting. A recent DPA decision relating to the 2024 Forbes billionaire list shows “significant improvement in how it approaches journalistic data processing,” Vissy tells us. “Constitutional aspects of press freedom that were previously absent from the DPA’s legal reasoning appear to be emerging.” It is, she says, evidence that the courts have begun to nudge the Authority off its path.
“This is the best court decision we’ve had throughout six years of litigation,” Perczel says. “If this interpretation is followed by other courts and takes hold, it could meaningfully reduce the GDPR-based obstacles imposed on the press.”
Journalists would have far stronger leverage to argue that GDPR compliance imposes a disproportionate burden on their work, and the legal uncertainty that fuels self-censorship would finally start to lift.
HCLU sued: When the Lawyers Became the Defendants
The progress has not come without personal cost to HCLU itself. The Barabás brothers sued the organisation directly in civil court, alleging that its public description of their “stacking and nitpicking tactics” as a SLAPP had portrayed them in a negative light.
The brothers sought 10 million Hungarian forints (approx. £24,000) in non-pecuniary damages, an amount that, Vissy says, “if awarded, would have represented a significant blow to a non-profit operating in Hungary’s civic space.”
HCLU won the case on all forums, with the courts finding all the claims against them to be unfounded.
Six Years of Chipping Away: The Ice Is Finally Breaking
What does six years of this work feel like from inside an organisation that has at points found itself simultaneously representing journalists, defending itself against a civil suit, and taking a case to Strasbourg?
“It was clear from the beginning that our task was very ambitious,” Perczel says. “It used up a lot of our team’s resources and energy, with the final goal often feeling out of reach. Litigation can feel like an eternity: years of waiting for decisions. We also felt quite isolated, as the Hungarian case was unique, with no precedents to draw on.”
Vissy adds that “over the past decade and a half, the space for meaningful dialogue between the government and civil society has largely disappeared. Organisations like ours — much like the independent outlets we represent — have been treated not as partners in public debate but as hostile actors.”
Thankfully, that fraught relationship is shifting. The election victory in April 2026 of Péter Magyar’s new government, and its promise to dismantle the state-controlled media apparatus built by the previous government and replace it with new press legislation, looks set to open much needed space for the civil liberties work HCLU has long been fighting to do.
The lesson, Perczel says, is unambiguous. “It shows that no effort is in vain. No matter how small, every step counts. We’ve been chipping away at the DPA’s and courts’ rigid interpretation step by step, and we have come far.”
Vissy returns to metaphor for her final answer. “Looking at the sheer number of proceedings, it may seem as though, after six years, we finally got lucky. And it is certainly possible to frame it that way — it did take a strong case and a thoughtful, forward-looking judge. I would rather say that it was not a matter of luck, but of persistence. Defending fundamental rights is very often about breaking the ice: at first, you see almost nothing, then only small cracks, but over time, those cracks can lead to a larger break.”
For Hungarian journalists and civil society, those cracks are finally showing.
In the cases discussed in the interview, HCLU’s clients were represented by attorneys Tivadar Hüttl, Noémi Fanni Molnár, and Márk Pető.
HCLU is a funded partner of Media Defence. Learn more about our Funded Partner Programme here.
