How to ban Pride using biometrics
On the banning of Pride in Hungary from a privacy professional's perspective
To show the direction the Hungarian government’s communication and legislation has been taking in the past 15 years, the slogan of the Ministry of Truth comes into mind from Orwell’s 1984:
“WAR IS PEACE
FREEDOM IS SLAVERY
IGNORANCE IS STRENGTH”
This article is about the recent decision of the Hungarian government to ban Pride, supported with facial recognition of potential protesters who are now outlawed. This article is not to justify nor to discredit Pride or LGBT rights, but rather to show where the limitation of fundamental rights - the right to assembly and the right to privacy - might lead in a broader context, and why is this wrong from a legal and ethical perspective.
How to ban Pride? A quick guide for authoritarians
This is not a political blog, but in this case it is important to show the context how this law was even passed.
Hungary's current regime is in place since 2010. While it was clear that LGBT rights were somewhat ridiculed by the conservative government, it was never its central topic in its political communication and definitely not in its laws. Things changed with a scandal in 2020, when it was revealed that the Hungarian ambassador in Peru had stored pedophile content on his computer. This led to severe criticism of the government positioning itself as one of the ultimate conservative parties in the EU.
The government's response was a counterattack: although first they condemned the incident, then they started peculiar communication on mixing the borders between gay people and convicted pedophiles. This led to the narrative that Hungarian children need special protection from gay people.
This is not a political satire: these communications were followed by a series of legislation related to the “protection of children” in Hungary, which led to for example the strange step of putting foils on books in stores that might contain scenes related to gender reassignment or homosexuality. As per the related law:
“It is prohibited to display in shop windows or publicly exhibit any product intended for children that has as a defining element the depiction or promotion of deviation from self-identity corresponding to birth sex, gender reassignment, homosexuality, or the direct, explicit, or gratuitous representation of sexuality.”
This legislation took a next step, and only in one day a proposal for an act passed with a 82% majority to ban Pride in Hungary. Participants may receive a fine of up to ~500 euros (530 USD).
The enforcement is further supported by the facial recognition of protesters - and here’s when privacy comes into the picture.
Severe privacy violations
To show the gravity of the most recent modification1, it impacts three laws:
The act on the right of assembly.
The act on misdemeanours (i.e. crimes with a lower degree of penalties).
The act on the facial image analysis register.
From a data protection point of view, the GDPR poses strict rules on using sensitive data - revealing sexual orientation and political opinions in this case - and on biometric identification, especially for law enforcement purposes. In fact, Article 9 GDPR prohibits the processing of sensitive data as a general rule, which is only permitted based on specific exceptions, such as explicit consent or a substantial public interest. While consent is clearly out of the picture here, one could question the underlying public interest: whether this is truly necessary in a democratic society, and whether this is proporionate to the aims pursued.
However, defining a public interest in this situation is more than cynical, and given that the law was passed rapidly in only 1 (one!) day without debate, it was hardly possible to draft a data protection impact assessment on this, yet alone to consult the Hungarian data protection authority. Another issue with the law is proportionality, as the new law does not bring changes in the context of Pride as such (which should be already disproportionate), but in the context of all misdemeanours. This includes even the pettiest crimes, such as throwing garbage in the street or crossing red lights.
This means that potentially anyone committing the slightest crime can be subject to biometric identification in Hungary.
The processing of biometric data - most likely combined with automated decision-making with a legal and in this case, incriminating effect - are both a strict “no” under the GDPR. Again, exceptions might apply, but the speed of adopting this law suggests that the GDPR and Hungarian data protection law were completely disregarded.
Without a detailed legal assessment, there are just a few GDPR principles this new provision infringes:
Lawfulness: it is questionable whether the substantial public interest stands with regard to indiscriminate recording and potential biometric identification of persons, with special regard to Pride participants or protesters of any kind.
Fairness: this is a processing of data that cannot be foreseen by the persons concerned, especially ones without legal knowledge in the field or foreign citizens.
Transparency: how is it even possible to make this sufficiently transparent on a social level?
Potential infringements of the AI Act
The European AI Act2 is often criticized as an overly bureacratic piece of law that hinders technology. My view is that the legislative intent of the AI Act was to prevent exactly these type of use cases of AI. As Article 1(1) of the AI Act starts right away:
“The purpose of this Regulation is to (…) promote the uptake of human-centric and trustworthy artificial intelligence (AI), while ensuring a high level of protection of (…) fundamental rights enshrined in the Charter, including democracy, the rule of law (...), against the harmful effects of AI systems in the Union and supporting innovation.”
However, experts started arguing that the AI Act might not be sufficiently well-written enough to prevent the use of such systems.3 In a nutshell, the AI Act has a list of prohibited AI systems that bans “evil” practices practices such as manipulating elderly people, children or other vulnerable persons with the use of AI, which list is already applicable since 2 February 2025 in the EU. Article 5(1)(h) of the AI Act seems to prohibit exactly the case at hand:
“the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement, unless and in so far as such use is strictly necessary for one of the following objectives”
However, the aspect of real-time identification does not apply in this case, as the identification is done after a potential crime was committed. The other concern is that this practice must be also linked to the prevention of serious crimes such as abduction, human trafficking, sexual exploitation or crimes punishable with at least 4 years of improsenment - none of them concerned by the Hungarian law which aims to address more “petty crimes” (like attending Pride). It means that if this provision is strictly interpreted, the prohibition is not applicable in this case.
One might argue what is the benefit of the AI Act, if it cannot even prevent such cases. In my view, there is hope regarding the stated purposes of the AI Act, and that banning Pride with the use of automated biometric identification (whether this is done before or after the event) is a clear violation of fundamental rights, i.e. the right to assembly and the right to personal data protection.
However, this will be subject to legal debates likely lasting for years, and by that time this will be an ongoing practice.
Ethical issues
Without taking more Orwellian examples, you don’t have to be a human rights specialist to see that maintaining a register of gay people or even supportes of them, and using the latest tech for this is not exactly ideal in a democratic society. If this can be done with the LGBT community, why wouldn't it be possible to extend this to persons with other political views? In fact, the new legal environment allows this for any kind of protests, as Pride or similar assemblies are not explicitly mentioned by the new law.
This is not only a thought experiment, another similar ban was foreseen for a pro-marijuana protest (again, I'm not going to agree or disagree with the purpose of the protest). Why not to extend this to the far-left or far-right? Or socialists, liberals and anyone deemed to be a threat to the nation's sovereignty?
Fundamental rights are not some abstract things out there written by scholars and lawyers in the shadow. These rights are very real and the lack of them feels like the lack of air. These rights include more existential ones like right to life, prohibition of torture, but also political ones like the freedom of expression, the freedom of assembly and the right to the protection of personal data as well. These right and freedoms are not "nice to have", but the preconditions for a society where one can live freely.
Those who cut these rights, cut these preconditions for a better society.
Official English transation available here: https://njt.hu/jogszabaly/en/2025-3-00-00
AI Act text: https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
More in-depth legal analysis available in Hungarian here: https://gdpr.blog.hu/2025/03/26/10_pontban_az_arcfelismero_rendszerek_alkalmazasa_kapcsan#more18822232