Part I — Situation overview

On Tuesday, 27 October 2026, several strands of accountability reached the stage of coercive measures at the same time. According to a statement by the Budapest-Capital Regional Court, the investigating judge of the Buda Central District Court issued a European and an international arrest warrant against Ádám Matolcsy and György Stofa in the case concerning the foundation assets of the Magyar Nemzeti Bank (MNB, the central bank). According to Portfolio, the judge approved the motion of the Central Chief Prosecutor’s Investigation Office. According to the court, the two suspects are not staying at their registered address and are presumably outside Europe. On the same day the Criminal Directorate-General of the National Tax and Customs Administration (NAV) carried out a coordinated operation in Hungary and, on the basis of mutual legal assistance, in Austria in the case of the Covid-era ventilator procurements. The NAV is investigating on suspicion of budget fraud and money laundering, has seized assets worth HUF 1.5 billion, and a man was arrested in Austria on the basis of a European arrest warrant. Because of the overpricing and usability of the machines purchased, the National Bureau of Investigation (NNI, the police body handling major criminal cases) is investigating on suspicion of breach of trust in separate proceedings. In the evening Portfolio reported that the Ministry of Science and Technology had filed a criminal complaint over Gondosóra. According to the ministry, the Government Service Centre (KSZK), which operates the programme, and Fidesz concluded a data processing agreement, so the personal data of users and their relatives may have reached the party. The documents were received by the National Authority for Data Protection and Freedom of Information (NAIH), which has opened proceedings.

The precise separation of roles is not a formality here. The investigation is conducted by the investigating authority, and in the MNB case by the investigating prosecution service. The prosecution service decides on bringing charges; the court decides on the arrest warrant, on pre-trial detention and ultimately on guilt. The suspects are entitled to the presumption of innocence, and Fidesz has stated that the Gondosóra cooperation was lawful and documented. MIAK wrote about the custody stage of the MNB case and the end-of-mandate transactions on 22 October (György Matolcsy in custody), and about the arrest-warrant powers of the asset recovery office on 21 October (Arrest warrants and DNA samples at the NVVH). MIAK published a proposal on a protocol for future emergency procurements on 25 September (Emergencies need rules too), and on the procurement model of Gondosóra on 18 July (Gondosóra and KRÉTA). This analysis does not revisit these.

What is new is the data protection dimension of the Gondosóra case and the afterlife of the ventilators. A state service used mostly by elderly people for emergency calls became, according to the ministry, the data processing partner of a party. And according to HVG, a significant part of the machines bought in 2020 are still in storage. In MIAK’s reading, the same thing is missing in both cases: there is no rule that excludes in advance the possibility that a state resource, whether data or money, serves the purposes of a narrow circle. Therefore, alongside the criminal proceedings, two other, non-criminal questions must also be answered: what happens to the data of the people affected, and what the state actually bought.

Part II — Grounding in the literature

Four sources provide the interpretive framework. In Controlling Corruption, Robert Klitgaard (American economist, author of the classic handbook of anti-corruption policy) describes how the Hong Kong anti-corruption agency first concentrated on investigation and high-profile cases, and only afterwards on prevention. Its tool for this was the vulnerability assessment of organisations, which looks for where operations are risky, not for who made mistakes in the past. In Corruption and Government, Susan Rose-Ackerman (professor of law and political science at Yale University) warns that where politics mobilises state resources to win over voters, governance turns into a web of mutual favours. According to another of her theses, a corrupt system not only buys badly, but often also buys the wrong thing. The European Union’s General Data Protection Regulation (GDPR) treats data revealing political opinions as a special category and makes purpose limitation a principle. The Fundamental Law of Hungary states that parties may not exercise public power directly. The detailed discussion of the literature — author by author, with quotations — can be found in section 6.4 Literature in detail.

Part III — MIAK’s concrete proposal

MIAK proposes three measurable steps. None of them affects the ongoing criminal proceedings: in those, the investigating authority, the prosecution service and the courts decide. The proposals aim to ensure that the people affected know what happened, and that such a situation cannot arise in the future.

3.1 A statutory ban: data of users of state services may not go to parties (bill to be submitted by 31 December 2026)

The Government should submit a bill to the National Assembly. It should state that a state body, a state company or a provider performing a state task may not hand over the personal data of the service’s users and their relatives to a political party, a party-affiliated foundation or a candidate, and may not make such data accessible to them. A party or a party’s agent may not be involved in providing the service (installation, set-up, customer contact). The ban may not depend on the consent of the person concerned, because an elderly user who receives the emergency-call watch set up by a party activist is not in a genuine position of choice. The rule should apply equally to every party, including whichever parties are in government. The defence that the agreement was also open to other parties shows precisely the essence of the problem: state data assets cannot be the object of competition between parties. The second element is a mandatory access log (audit log): in every state system that processes personal data, it must be recorded who accessed which data and when, and the log must be retained for at least five years. The third is the sanction: breaching the ban entails a data protection fine and the employment liability of the responsible manager, while criminal liability is for the courts to decide. The GDPR leaves the detailed rules of data processing based on a public task to national law, so the tightening is consistent with EU law (see 6.4.3). Its constitutional basis is the prohibition on parties exercising public power (see 6.4.4). The proposal extends programme point D18 on data governance to party neutrality.

3.2 Notification of the people affected by Gondosóra, a log freeze before the handover and publication of the NAIH decision (log freeze and data inventory by 30 November 2026, individual notification by 31 January 2027)

According to HVG, the operation of Gondosóra will pass to the ministry’s companies from 1 January: the hardware will be handled by National Infocommunications Service Company Ltd. (NISZ) and the software by IdomSoft, as the current contract expires on 31 December. The handover is the riskiest moment, because during a system change the access logs that show who the data reached can be lost. MIAK therefore proposes that the data controller, the KSZK, freeze the entire log set by 30 November and preserve it as evidence, sharing it with the NAIH and the investigating authority. By the same deadline a data inventory should be prepared: the data of how many users and relatives, in what scope of data and for what period, may have reached the party. After this, the KSZK should notify everyone affected individually by 31 January 2027. By letter and through the dispatcher service as well, it must be set out in plain language what happened, what rights the person concerned has, and how they can request that the party delete their data with verification. Under the GDPR, in the case of a high risk the data subjects must be informed directly (see 6.4.3). Whether an infringement took place is for the NAIH, an independent authority, to decide. MIAK asks the NAIH to publish its decision naming the data controller, which the Hungarian data protection act makes possible. According to Rose-Ackerman’s thesis (see 6.4.2), the party-political mobilisation of a state service destroys trust, so the notification is also a condition for the future of the service. The proposal builds on the data security principle of programme point E2.

3.3 An itemised, public ventilator inventory and asset recovery balance sheet (inventory by 31 March 2027, updated every six months thereafter)

The Government should commission the Government Control Office (KEHI) to prepare an itemised inventory of every contract of the 2020 ventilator and protective equipment procurements. For each contract, the following must be recorded: the ordering body, the supplier and the intermediaries, the quantity ordered and actually received, the unit price, the market reference price, the acceptance rating, and where the equipment is today. The latter may be hospital use, storage, a donation abroad or disposal. The prices paid in the same period by the National Healthcare Service Centre (ÁEEK) provide a natural basis for comparison. The inventory should also include the storage and maintenance costs to date and per year, as well as a proposal for using the functioning machines. The second part of the inventory is the asset recovery balance sheet. It should include the seized assets, the civil-law claims submitted by the injured state bodies, among them the legal successor of the Ministry of Foreign Affairs and Trade, and the amount actually recovered. Publication should only cover data that does not jeopardise the investigation. The timing must be agreed with the investigating authority, and guilt is for the courts to decide. The independence of the State Audit Office (ÁSZ) is not affected: it decides itself whether to include the topic in its audit plan. The proposal is a retroactive application of programme points A2 on procurement transparency and A1 on the public-money dashboard. According to Klitgaard’s vulnerability criteria (see 6.4.1), a large-budget programme launched under time pressure is inherently among the riskiest.

The three proposals are linked by one principle: the state’s data and money belong to the citizens, and the public should be informed about them routinely, not as a result of criminal complaints. According to Klitgaard’s Hong Kong example, high-profile investigations only leave a lasting result if they are followed by the institutional work of prevention. The current arrest warrants are the first stage; the party-neutrality rule and the itemised inventory are the second.

Part IV — Expected impacts and risks

Dimension Expected impact Risk
Society The trust of elderly users can be rebuilt if they learn what happened to their data The notification may cause alarm, and many may give up a useful service
Public administration Uniform logging in state systems, prohibited data transfers known in advance Introducing logging in legacy systems is costly and slow
Economy The ventilator inventory reveals overpayment, and machines in storage can be put to use Preparing the inventory takes up capacity, and recovery may take years
Politics and law The party-neutrality rule applies equally to every party, so competition becomes more predictable If the rule only hits the party that went into opposition, it looks like political revenge
Criminal proceedings The log freeze preserves the evidence Premature publication could jeopardise the investigation

The most important trade-off is the relationship between the interests of publicity and of the investigation. The data of the ventilator contracts are data of public interest, but certain details of the investigation are not. Therefore proposal 3.3 requires the disclosure of contractual data, not of evidence, and calls for coordination with the investigating authority. The other risk is the method of notification. Most Gondosóra users are elderly, so telephone assistance is needed alongside the letter, and it must be made clear that the service is not being discontinued. According to HVG, around 200,000 devices were never even switched on by their users. The notification is therefore also a good opportunity for those who do not want the service to return the device. The third risk is political framing. Magyar Nemzet pointed out that the investigating authorities must work independently of the political leadership. According to MIAK, members of the government should refrain from characterising ongoing cases, because this also protects the credibility of the proceedings.

Part V — Measurability and summary

5.1 What is worth tracking? (proposed KPIs)

MIAK proposes tracking the following performance indicators (KPIs, Key Performance Indicators):

  • Party-neutrality act: submission of the bill by 31 December 2026; the proposed target is that by the end of 2027 an access log should operate in 100% of central state systems processing personal data.
  • Notification rate: what percentage of affected Gondosóra users and relatives received individual notification by 31 January 2027; the proposed target is 100%, with verification that deletion requests have been fulfilled.
  • Publication of the NAIH decision: publication of the regulatory decision naming the data controller, within 30 days of the decision being made.
  • Coverage of the ventilator inventory: for what percentage of the 2020 contracts itemised data appears by 31 March 2027 (proposed target 100%), as well as the ratio of the amount recovered to the seized assets and to the established damage, published every six months.

5.2 Summary

MIAK’s key message: the arrest warrants and the raids are part of the criminal proceedings, and responsibility is for the courts to decide. MIAK asks the government and the National Assembly to launch the act prohibiting data transfers to parties this year. The data controller of Gondosóra should freeze the logs before the year-end handover and notify the people affected. And an itemised, public inventory of the ventilators should be prepared. The foundational values concerned are transparency and accountability. Transparency, because the 750,000 users still do not know what happened to their data, and because six years on there is still no complete public picture of the ventilators. Accountability, because without a prohibiting rule and a log there is nothing to measure responsibility against. Accountability is credible if the parties governing today are held to the same standard as their predecessors.

Part VI — Justifications and further sources

6.1 Press framing by spectrum

Left-liberal band (Telex, 444.hu, HVG). On the MNB strand, 444.hu built on its own earlier revelations, among them its March article on the family’s moving of assets to Dubai. On Wednesday it presented the agreement by which the foundation asset manager and the private equity fund would have retroactively terminated the original contract five days after it was signed. HVG described the same document factually, and in a separate article presented the capital reduction of GTC Origine. In the ventilator case Telex followed developments in two articles: alongside the NAV statement it named the wanted chief executive, and recalled the chain of intermediaries in the 2020 foreign ministry procurements. HVG focused on the practical questions of the Gondosóra handover, cost reduction and the devices that were never switched on.

Mainstream band (24.hu, Index, ATV). 24.hu and Index reported the official statements in detail, without an evaluative frame. ATV put in its headline the Facebook post of a political analyst according to which the warrant is the most unpleasant scenario for the former governing party. The article, however, noted that this is a political assessment, and that the warrant in itself does not prove guilt.

Economic band (Portfolio). Portfolio explained the legal conditions of extradition, for example the principle of double criminality, and was the first to report on the Gondosóra data processing agreement. The article quoted a lawyer of TASZ (Hungarian Civil Liberties Union) and the press chief of Fidesz. According to the latter, the cooperation was lawful; no answer was given to the question of whether users had been informed.

Conservative band (Magyar Nemzet). Magyar Nemzet reported the fact of the warrant, and in the ventilator case, alongside the official data, it highlighted that the Prime Minister had again taken a public position on an ongoing criminal case. According to the paper, this raises questions regarding the independence of the investigating authorities. The conservative band did not raise the data protection strand of the Gondosóra case among its main topics that day. The day’s pieces by Mandiner and Népszava were not included in MIAK’s press monitoring.

6.2 Facts and data

Case Data Source
MNB case, arrest warrants 27 October 2026, investigating judge of the Buda Central District Court, on the motion of the Central Chief Prosecutor’s Investigation Office; European and international arrest warrants against two suspects Statement by the Budapest-Capital Regional Court, Portfolio, 444.hu
Retroactive contract termination the original contract was concluded on 28 February 2025, the termination agreement five days later, on 5 March 2025 444.hu, HVG
GTC Origine share capital reduced by HUF 23.8 billion; 2025 loss of HUF 19 billion HVG (based on the Company Gazette)
Ventilator case (NAV) 800 ventilators and 3 million masks from China; the state paid HUF 15.6 billion; more than HUF 3 billion in laundered profit; more than HUF 660 million in VAT damage NAV statement, 27 October 2026 (Telex, HVG, 24.hu, Index)
Coercive measures HUF 1.5 billion in seized assets; 1 arrest in Austria; 11 suspects, 2 of them in custody; an international arrest warrant against one organiser (presumably staying in Indonesia) NAV statement
2020 ventilator procurements in total around 19,000 machines, of which 16,000 through the Ministry of Foreign Affairs and Trade, for roughly HUF 300 billion; a significant part of the machines in storage HVG, 27 October 2026
The same in a different breakdown 6,000 machines through 10 Hungarian intermediaries for HUF 90 billion, a further 11,000 direct purchases Telex, 27 October 2026 (based on earlier press articles)
Unit prices foreign ministry contracts on average close to HUF 20 million, ÁEEK on average HUF 10.8 million per machine 24.hu, 25 September 2026 (based on the Ministry of Foreign Affairs’ internal investigation)
Gondosóra around 750,000 users; roughly 200,000 devices never switched on; 2026 budget close to HUF 27 billion, around HUF 13 billion for 2027 HVG, Portfolio
Gondosóra data processing KSZK–Fidesz data processing agreement, signed for the party by Gábor Kubatov; the ministry filed a criminal complaint, the NAIH opened proceedings Portfolio, 27 October 2026

The two breakdowns (16,000 and 17,000 machines procured by the foreign ministry, respectively) differ from each other. This also shows that six years on there is still no official, itemised data set on the procurements; this is precisely what proposal 3.3 would provide. The difference between unit prices does not in itself prove abuse, because the type, the delivery deadline and the market situation may also have differed.

6.3 Policy dimensions

  • Transparency and anti-corruption policy (programme points) — itemised retrospective review of the Covid-era procurements, retroactive extension of the public-money dashboard, asset recovery balance sheet;
  • Digitalisation and AI regulation (programme points) — party neutrality of state data assets, mandatory access log, data governance;
  • Healthcare (programme points) — the state and use of the ventilator stock, data security of health-related services;
  • Justice (background material) — publicity of decisions on coercive measures, separation of the roles of the investigating authority, the prosecution service and the courts;
  • Territorial inequality and rural policy (programme points) — the data needs of the new parliamentary committee of inquiry, initiated by the Tisza parliamentary group, to examine the use of catching-up funds; the setting up of the committee is decided by the National Assembly.

6.4 Literature in detail

6.4.1 Robert Klitgaard: Controlling Corruption

Analysing the first years of Hong Kong’s Independent Commission Against Corruption (ICAC), Klitgaard describes how the agency first concentrated on its investigation department. Initially it had to establish its credibility through a politically demanding effort to secure the extradition of a high-ranking police officer who had fled abroad. The department responsible for prevention and community relations only gained a larger role later. The latter, cooperating with government departments more as an adviser than as an investigator, assessed where their operations were vulnerable. In a separate box the book describes this vulnerability assessment. The assessment does not look for evidence of past abuse, but for the points where a monopoly position and discretion meet difficulty of control. Among the factors increasing the risk are a programme being new, operating under time pressure, having a large budget and being in contact with many outside beneficiaries. The Covid-era procurement and Gondosóra meet every one of these criteria. In the Hungarian situation, the current arrest warrants correspond to Klitgaard’s first stage. A lasting result requires the second stage: the institutional closing of the vulnerable points.

📖 Source: Robert Klitgaard: Controlling Corruption

6.4.2 Susan Rose-Ackerman: Corruption and Government

In the chapter on electoral corruption, Rose-Ackerman uses Italian, Spanish and East Asian examples to show how political actors mobilise state resources, jobs and benefits to win over voters. In her view this creates a web of obligations. To the objection that there is no harm if the benefit ultimately reaches the voters, she replies that such a system is no longer based on democratic principles but on an exchange of favours among those with the most resources and power. Personalised benefits also make it harder for a credible opposition alternative to emerge. In the chapter on procurement she formulates another thesis: the decision on what the state buys is as important as how it buys. Corrupt systems often procure the wrong thing, so where fair competition cannot be ensured, procurement should be steered towards products that have a market reference price. Applied to the Hungarian case: the party-political embedding of Gondosóra as a state service carries exactly the risk of the mobilisation pattern she describes. And the ventilators standing in storage raise the question of whether the number and type of machines matched real need at all.

📖 Source: Susan Rose-Ackerman: Corruption and Government

6.4.3 European Union: General Data Protection Regulation (GDPR)

Article 9(1) of the GDPR reads: “Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership […] shall be prohibited.” Among the exceptions is that an organisation with a political aim may process the data of its own members and of persons in regular contact with it, but may not disclose these to outsiders without the consent of the data subjects. According to recital (56), parties may compile data on people’s political opinions in the course of electoral activities if appropriate safeguards are established. Article 5 makes purpose limitation a principle: data may only be collected for specified, explicit and legitimate purposes and may not be further processed in a manner incompatible with those purposes. The same article also obliges the controller to be able to demonstrate compliance. Under Article 34, if a personal data breach is likely to result in a high risk, the controller communicates it to the data subject without undue delay. In the case of Gondosóra this means two things. Data collected for the purpose of an emergency-call service ending up with a party is hard to reconcile with purpose limitation. And if the party links the list of the service’s users with its own records, this can generate special-category data revealing political opinions. Whether this happened is being investigated by the NAIH; proposals 3.1 and 3.2 aim at preventing the risk and informing the people affected.

📖 Source: European Union: General Data Protection Regulation (GDPR, 2016/679)

6.4.4 National Assembly: Fundamental Law of Hungary

In its provision on parties, the Fundamental Law states that parties contribute to the formation and expression of the will of the people, but may not exercise public power directly. Access to the user database of a state service is not a classic exercise of public power, but it relates to data assets collected by the state for the performance of a public task. Therefore, in the spirit of the constitutional principle, an act must draw the line. According to the constitutional reasoning on the legal status of the prosecution service, the exercise of criminal-justice power is divided in the spirit of the separation of powers. The prosecution service is an independent constitutional institution not subordinate to any branch of power, and its task is the impartial enforcement of the state’s claim to punishment before the courts. From this follows the separation of roles in the Situation overview: the investigation is conducted by the investigating authority or the investigating prosecution service, the prosecution service decides on charges, and the court decides on coercive measures and on guilt.

📖 Source: National Assembly: Fundamental Law of Hungary

6.5 International comparison

United Kingdom — Covid procurement. In November 2020 the British National Audit Office reviewed government procurement during the pandemic in a separate investigation. It found that suppliers recommended through political connections were handled through a separate, expedited channel, and that the documentation of many contracts was incomplete. The health ministry later wrote down, in its annual report, impairments in the order of billions of pounds on unusable or surplus protective equipment. The lesson from the perspective of proposal 3.3 is that the inventory must show not only the procurement but also the afterlife of the equipment.

United Kingdom — parties and personal data. In 2018 the British data protection authority (ICO) issued a comprehensive report on the use of data in political campaigns, and initiated data protection audits of the parliamentary parties. The data processing of parties can therefore be examined by the data protection authority at system level too, not only following an individual complaint.

Hong Kong. According to Klitgaard’s account (see 6.4.1), after the high-profile cases the anti-corruption agency switched to vulnerability assessments of government departments. The independent investigation office of programme point A10 can follow this two-stage logic.

Transparency and anti-corruption policy

  • A1 — Public-money dashboard
  • A2 — Procurement transparency
  • A10 — Independent Anti-Corruption Investigation Office

Digitalisation and AI regulation

  • D18 — Data governance and open data intermediaries

Healthcare

  • E2 — Digital health system

Justice

  • I1 — Court transparency

Territorial inequality and rural policy

  • TE3 — Segregated-area map and catching-up programme

Proposed new programme point: Party neutrality of state data assets: a statutory ban on handing users’ data to parties, a mandatory access log in state systems — for the Digitalisation and AI regulation area.

6.7 List of sources

Press sources (MIAK press monitor, 28 October 2026 — topic 1):

Knowledge-base references (literature and legal sources):

  • 📖 Robert Klitgaard: Controlling Corruption
  • 📖 Susan Rose-Ackerman: Corruption and Government
  • 📖 European Union: General Data Protection Regulation (GDPR, 2016/679)
  • 📖 National Assembly: Fundamental Law of Hungary

MIAK internal materials:

  • MIAK policy area: Transparency and anti-corruption policy (programme points; programme point ID: A1, A2, A10)
  • MIAK policy area: Digitalisation and AI regulation (programme points; programme point ID: D18)
  • MIAK policy area: Healthcare (programme points; programme point ID: E2)
  • MIAK policy area: Justice (programme points; programme point ID: I1)
  • MIAK policy area: Territorial inequality and rural policy (programme points; programme point ID: TE3)
  • MIAK press monitor, 28 October 2026 — topic 1, score: 92/100

Supplementary public data sources:

  • Statement by the Budapest-Capital Regional Court, 27 October 2026
  • Statement by the National Tax and Customs Administration, 27 October 2026
  • 24.hu: unit-price data based on the Ministry of Foreign Affairs’ internal investigation, 25 September 2026 (processed in MIAK’s 25 September analysis)

Generation metadata