On May 4, the Hungarian government suspended – for the duration of the COVID-19 state of emergency – the GDPR’s one-month deadline to reply to requests from data subjects, instead allowing them one month after the state of emergency is cancelled. The decree also allows public entities to refuse freedom of information requests or extend the response period from 45 days to 90 days in certain situations. The action has been heavily criticized by civil society groups and prompted scrutiny by the European Data Protection Board. The Hungarian parliament previously granted prime minster Viktor Orbán broad emergency powers until he declares the health crisis over.
