Hungary

Overview

EU Member State: Hungary is subject to the GDPR, the Law Enforcement Directive, and the ePrivacy Directive. For the EU framework, see the EU Framework page.

Change of government (2026): the April 12, 2026 election ended sixteen years of Fidesz rule. Péter Magyar’s Tisza party won 141 of 199 seats, a two-thirds constitutional majority, and Magyar was sworn in as prime minister on May 9. The surveillance architecture described below was built under the previous government and, apart from the Sovereignty Protection Office, remains on the statute book; see Recent Developments for what has changed.^[18]

Hungary deploys Pegasus spyware against investigative journalists (Direkt36), opposition politicians, lawyers, and the Bar Association president, with NAIH classifying its findings until December 31, 2050. Five security services operate under Act CXXV/1995, with TEK wielding surveillance powers so broad the ECHR found them “virtually unlimited” (Szabó and Vissy, 2016). The Sovereignty Protection Office (SPO), created by the Protection of National Sovereignty Act (2023), targets civil society and foreign-funded NGOs. NAIH independence has been questioned since a 2012 CJEU ruling that Hungary’s termination of the prior commissioner violated EU law. Article 7(1) TEU proceedings (triggered September 2018) remain ongoing. NSA CROSSHAIR partner.^[1][2]

Hungary’s outward data-sharing runs through its alliances and treaties, each detailed below. It is an NSA CROSSHAIR partner and a NATO member (since 1999), and its services take part in the Club de Berne intelligence forum, its Counter-Terrorism Group, and Visegrad Group (V4) cooperation; it is a party to the 1959 Council of Europe Mutual Assistance Convention and the Budapest Convention on Cybercrime, belongs to the Schengen and Prüm frameworks and to Europol and the European Investigation Order, and holds a bilateral mutual legal assistance treaty with the United States alongside an extensive inherited bilateral treaty network. These are the channels through which the domestic protections described below are, in practice, bypassed.^{[12][13][14][15][16]}

International Data Sharing Agreements

Mutual Legal Assistance

EU Member States (26 countries): Hungary cooperates with the other EU states through the EU Convention on Mutual Assistance in Criminal Matters (2000), the Schengen Convention, and the European Investigation Order, which enables binding cross-border evidence requests.

European Convention on Mutual Assistance in Criminal Matters (1959, ETS 30): This Council of Europe instrument and its Additional Protocols apply between Hungary and all other parties. As of July 2026 it has 51 parties: all 46 Council of Europe member states (Albania, Andorra, Armenia, Austria, Azerbaijan, Belgium, Bosnia and Herzegovina, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Georgia, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Moldova, Monaco, Montenegro, the Netherlands, North Macedonia, Norway, Poland, Portugal, Romania, San Marino, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye, Ukraine, and the United Kingdom) plus five non-members (Chile, Israel, Mongolia, the Republic of Korea, and the Russian Federation).^[12]

Convention on Cybercrime (the Budapest Convention, 2001, ETS 185): Hungary is a party to the Council of Europe’s cybercrime convention (opened for signature in Budapest), which governs the expedited preservation and cross-border disclosure of stored computer and subscriber data. As of July 2026 it has 82 parties: 45 Council of Europe member states (every one of the 46 except Ireland, which has signed but not ratified), namely Albania, Andorra, Armenia, Austria, Azerbaijan, Belgium, Bosnia and Herzegovina, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Georgia, Germany, Greece, Hungary, Iceland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Moldova, Monaco, Montenegro, the Netherlands, North Macedonia, Norway, Poland, Portugal, Romania, San Marino, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye, Ukraine, and the United Kingdom; together with 37 non-member states: Argentina, Australia, Benin, Brazil, Cabo Verde, Cameroon, Canada, Chile, Colombia, Costa Rica, Côte d’Ivoire, the Dominican Republic, Ecuador, Fiji, Ghana, Grenada, Israel, Japan, Kiribati, Mauritius, Morocco, New Zealand, Nigeria, Panama, Papua New Guinea, Paraguay, Peru, the Philippines, Rwanda, São Tomé and Príncipe, Senegal, Sierra Leone, Sri Lanka, Tonga, Tunisia, the United States, and Vanuatu.^[13]

EU e-Evidence Regulation (2023/1543) and Directive (2023/1544): since August 18, 2026 a judicial authority in any other participating EU member state can serve a European Production Order or European Preservation Order directly on a service provider established or represented in Hungary, and Hungary’s own prosecutors and courts can do the same to providers elsewhere in the Union, for subscriber, IP-identification, traffic and content data, with a ten-day deadline (eight hours in an emergency) and no mutual-assistance request in between. Hungary is notified of traffic- and content-data orders served on its providers and may stop execution only on the Regulation’s listed grounds. Any provider offering services in the EU, wherever it is headquartered, must designate an addressee in the Union to receive orders, and an unjustified refusal can draw a penalty of up to 2% of worldwide annual turnover. For provider-held data this instrument now sits ahead of the Budapest Convention and the 1959 Convention among EU states; Denmark alone is outside it, and Switzerland adopted a transitional permit scheme in October 2026 so that its providers can comply (see the European Union and Switzerland pages).^[22]

Bilateral MLAT with the United States: Signed December 1, 1994, in force March 18, 1997. Hungary also maintains bilateral MLA agreements inherited from the pre-1989 treaty network with countries including Mongolia, Bulgaria, China, Cuba, Russia, Romania, Poland, and Turkey, supplemented by newer agreements with Australia and Canada. The full set of Hungary’s bilateral treaties is searchable in the National Legislation Database (Nemzeti Jogszabálytár) at net.jogtar.hu.^[9]

Intelligence Cooperation

NSA CROSSHAIR partner. NATO member since 1999. Hungary’s services participate in the Club de Berne and its Counter-Terrorism Group (CTG); the Club de Berne keeps no public roster, but it is reported to comprise the intelligence services of the 27 EU member states (Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden) together with Norway and Switzerland, with the United Kingdom also reported as a member; the CTG comprises the same services plus the United Kingdom.^[17] Visegrad Group (V4) intelligence cooperation with Poland, Czechia, and Slovakia. During its 2024 EU Council Presidency, Hungary blocked Chat Control mandatory scanning proposals.^[10]

EU and Multilateral Frameworks

SIS II: Real-time query and alert sharing across the Schengen Area (29 states: Austria, Belgium, Bulgaria, Croatia, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and Switzerland).^[14] Prüm: Automated DNA, fingerprint, and vehicle-registration exchange; the framework binds 31 states (all 27 EU members plus the non-EU Schengen associates Iceland, Liechtenstein, Norway, and Switzerland); Prüm II (2024) adds facial images and police records.^[15] EU-US Umbrella Agreement, SWIFT/TFTP, PNR. Interpol I-24/7. Egmont Group.

Europol

As an EU member state, Hungary is one of the 27 EU members that constitute Europol, the EU Agency for Law Enforcement Cooperation (Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden). Europol also holds operational agreements permitting personal-data exchange with 17 non-EU states (Albania, Australia, Bosnia and Herzegovina, Canada, Colombia, Georgia, Iceland, Liechtenstein, Moldova, Monaco, Montenegro, North Macedonia, Norway, Serbia, Switzerland, Ukraine, and the United States) and cooperates with US law enforcement including the FBI, so Hungarian person data flowing through Europol is reachable onward.^[16]

The Privacy Backdoor Effect

Despite formal GDPR compliance, systemic alternative access exists:

• Pegasus: Government-deployed spyware against journalists and opposition, findings classified until 2050
• TEK: “Virtually unlimited” surveillance with ministerial authorisation, ECHR violation unremedied
• Sovereignty Protection Office: Investigates foreign-funded civil society outside GDPR oversight
• NSA CROSSHAIR: Bilateral SIGINT partnership
• EU Framework: Hungarian data in SIS II, Prüm, EIO accessible to 27 EU states
• MLAT/CoE Conventions: the US, the 51 parties to the 1959 Convention and the 82 parties to the Budapest Convention can request data through MLA channels
• EU e-Evidence: prosecutors and courts in the 25 other participating member states can serve production orders directly on providers here, ten days or eight hours, no MLA request (since August 18, 2026)
• Article 7: Ongoing proceedings confirm systemic rule-of-law concerns affecting enforcement credibility

Surveillance and Intelligence

Five Security Services

AH (Alkotmányvédelmi Hivatal): Domestic counterintelligence. IH (Információs Hivatal): Foreign intelligence. KNBSZ (Katonai Nemzetbiztonsági Szolgálat): Military intelligence/counterintelligence. NBSZ (Nemzetbiztonsági Szakszolgálat): Technical surveillance capabilities. TEK (Terrorelhárítási Központ): Counter-terrorism with surveillance powers the ECHR found “virtually unlimited” and subject to ministerial (not judicial) authorisation.^[5]

Pegasus Spyware (2021)

The Pegasus Project revealed Hungary purchased NSO Group’s Pegasus, deployed against investigative journalists at Direkt36, opposition politicians, lawyers, and the president of the Budapest Bar Association. The government admitted the purchase, claiming all use was lawful. NAIH classified its findings until 2050. Pegasus targets are now pursuing ECHR applications. The PEGA Committee mission to Budapest (February 2023) found systemic oversight failures.^[2][6]

Hungary’s commercial surveillance toolkit extends beyond Pegasus. A VSquare and Citizen Lab investigation documented the Orbán government’s use of Cobwebs Technologies’ web-intelligence tool “Webloc” (an Israeli-origin platform combined with Hungarian-developed technology), with a fresh round of license renewals completed in March 2026, weeks before the April 12, 2026 parliamentary elections. The disclosure deepened concern that surveillance capacity is being expanded in an electoral context while NAIH continues to issue findings clearing the government’s spyware use.^[11]

Szabó and Vissy v. Hungary (ECHR, 2016)

The Court found TEK’s surveillance regime violated Article 8 ECHR: authorisation by the Justice Minister (not a judge) was insufficiently independent, and the virtually unlimited scope of secret intelligence gathering lacked adequate safeguards. Still not remedied as of early 2026.^[5]

Internet Infrastructure and Transit Exposure

BIX (Budapest Internet Exchange): Over 260 connected networks. As a landlocked country, all international traffic transits through Austria and Germany, both with intelligence infrastructure (HNA Königswarte; BND/DE-CIX cable interception). Hungarian traffic through DE-CIX Frankfurt is subject to BND bulk monitoring.^[7]

Recent Developments

New Government: Sovereignty Protection Office Abolished, Surveillance Laws Untouched (May–October 2026)

The Tisza government’s first surveillance-relevant act was to dismantle the Sovereignty Protection Office, which it had promised in its manifesto: parliament voted it out of existence by a large majority on June 30, 2026. Created in 2023 and upheld by the Constitutional Court in November 2024, the office had investigated foreign-funded media and NGOs outside any data-protection oversight; Transparency International’s case against it at the European Court of Human Rights remains pending. On June 24 the government also tabled a bill to open the communist-era secret-service archives, with an independent commission deciding what stays classified and stricter criteria for keeping files secret.^[19][20]

What has not changed matters as much. No reopening of the Pegasus investigation has been reported, the NAIH findings remain classified until 2050, TEK’s powers found “virtually unlimited” in Szabó and Vissy are unamended, and metadata access still runs on ministerial rather than judicial authorisation. The archive bill covers the communist period, not the Orbán-era services. Two weeks before the election, on March 26, 2026, Orbán’s chief of staff Gergely Gulyás announced an espionage complaint against investigative journalist Szabolcs Panyi, himself a 2021 Pegasus target, over his reporting on Russian influence; the National Bureau of Investigation opened a preliminary inquiry on April 1, and no outcome has been reported. A two-thirds majority gives the new government the votes to rewrite the surveillance statutes; it has not yet introduced a bill to do so.^[21][6]

EU Rule of Law Report 2025 (July 8): Documents ongoing judicial independence failures and systemic concerns.^[3]

European Parliament Rule-of-Law Alarm (November 2025): Deepened concerns over democratic backsliding and surveillance abuse.^[3]

Chat Control Blocked (2024): Hungary blocked mandatory scanning as Council president, contributing to failure to reach qualified majority.^[10]

Pegasus ECHR Applications: Targets now pursuing Strasbourg applications. PEGA Committee found Hungary failed to conduct adequate investigation.^[6]

Privacy Framework

The NAIH (led by President Attila Péterfalvi since 2012) enforces Act CXII of 2011 (Info Act, amended 2018 for GDPR). The EU Rule of Law Report 2025 (July 8) documents ongoing judicial independence failures. The Act on the Protection of National Sovereignty (2023) created the SPO with powers to investigate individuals and organisations receiving foreign funding; the Constitutional Court upheld it (November 2024), and the new parliament abolished the office on June 30, 2026.^[3][4]

Data Retention

1-year mandatory metadata retention under Act C of 2003 (Electronic Communications Act). Five security services can access metadata with ministerial (not judicial) authorisation. The ECHR Szabó ruling found this authorisation model insufficient, but reforms have not been enacted.^[8]

Pending Legislation

The legislative pipeline inherited by the Tisza government consists of enacted measures expanding state power (broad TEK surveillance authority, ministerial authorisation of metadata access) rather than reform bills; the Sovereignty Protection Office is the only one so far reversed. The notable pending items are:

• EU AI Act national implementation: Hungary must designate AI market-surveillance authorities and adopt implementing rules; legislation is pending.
• NIS2 implementation: national cybersecurity-supervision measures continue to be developed following transposition.
• Surveillance oversight reform: despite the ECHR Szabó and Vissy (2016) ruling that TEK’s “virtually unlimited” powers violate Article 8, no remedial legislation has been introduced, including by the new government with its two-thirds majority; reform remains a pending obligation rather than an active bill.^[6]
• Communist-era secret-service archives: government bill of June 24, 2026 to open the archives under an independent declassification commission.^[20]

Sources