Czech Republic
Other chapters
Foreword and issue-by-issue comparison
Czech Republic
Get your copy
Request a hard copy of the GDPR Guide to National Implementation »
In this chapter:
Q1/ Applicable legislation
(a) Have the requirements of the GDPR been addressed by introducing a new law, or by updating existing legislation?
New legislation has been passed.
———
(b) Relevant legislation includes:
- Act on processing of personal data (the “Data Protection Act”)
- Date in force: 24 April 2019
-
Link: In Czech: see here
- Act amending certain legislations due to the adoption of the act on processing of personal data (the “Amending Act”)
- Date in force: 24 April 2019
-
Link: In Czech: see here
———
(c) What is the status of national pre-GDPR data protection law?
The relevant pre-GDPR legislation has been repealed in full. In addition, multiple existing laws (including the Civil Procedure Code and Criminal Procedure Code) have been amended through the Amending Act.
Q2/ Personal data of deceased persons
Does national law make specific rules regarding the processing of personal data of deceased persons?
There are no specific rules governing this issue. However, should the existing pre-GDPR guidance from the DPA remain in place, the following rules would apply:
- following the data subject’s death, the applicability of legal provisions in which the data subject acts as a participant in private law relationships expires (this includes provisions on the rights of the data subject, and the controller’s responsibilities with regard to the data subject, such as consent to the processing of personal data, consent to the processing of sensitive personal data, the controller’s obligation to inform, the protection of rights of the data subject and the remedy of non-material damage); and
- the legal provisions in which the data subject does not act as a participant in private law relationships remain applicable (this primarily covers obligations vested in the controller, such as purpose limitation, accuracy, storage limitation and data minimisation).
Q3/ Legal bases for processing
(a) Does national law make specific rules regarding the processing of personal data in compliance with a legal obligation?
Provided that the processing is carried out for the purpose of a “protected interest”, controllers and processors are exempt from the obligation to carry out a compatibility assessment regarding the purposes of processing.
A “protected interest” includes the following:
- interests of defence or security of the Czech Republic;
- public order and internal security, prevention, identification and detection of crime, prosecution of crime, enforcement of sentences and protective measures, procurement of security of the Czech Republic or procurement of public order and internal security, including the search for persons and items;
- other important objectives in the public interest, including in particular currency, monetary, budgetary, tax and financial markets, public health and social security matters;
- protection of the independence of courts and judges;
- prevention, detection or prosecution of violation of rules of ethics in regulated professions;
- supervisory, control or regulatory functions associated with the exercise of public power in the above cases;
- protection of personal rights and freedoms; or
- enforcement of private law claims.
The above list corresponds to the grounds for restrictions of the scope of the obligations and rights provided for in Art. 23 GDPR with slight variations resulting from the terminology used in the Data Protection Act.
Further, a controller or the processor processing personal data in compliance with a legal obligation must inform data subjects that it is processing their personal data in compliance with a legal obligation. This information may be made accessible remotely to data subjects.
Controllers or processors processing personal data in compliance with a legal obligation are exempt from the obligation to carry out Impact Assessments.
———
(b) Does national law make specific rules regarding the processing of personal data for the performance of tasks carried out in the public interest?
The following rules govern the processing of personal data for the performance of tasks carried out in the public interest:
- there is an exemption from the obligation to carry out a compatibility assessment of purposes when pursuing a “protected interest” (as defined in Q3(a) above); and
- controllers established by law and are performing statutory tasks in the public interest (in addition to public authorities) must appoint a DPO.
———
(c) Does national law make specific rules regarding the processing of personal data in the exercise of official authority vested in the controller?
The following rules apply:
- there is an exemption from the obligation to ensure that personal data are being processed for purposes that are “compatible” with the purposes for which the data were originally collected, if the new purpose is a “protected interest” (as defined in Q3(a) above); and
- controllers established by law and performing statutory tasks in the public interest (in addition to public authorities) must appoint a DPO.
———
(d) Does national law contain criteria in addition to those listed in the GDPR, to determine whether processing for a new purpose is compatible with the purpose for which the personal data were initially collected?
There are no specific additional criteria governing this issue. As set out above, when pursuing a “protected interest”, controllers processing personal data in compliance with a legal obligation, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, are not obliged to carry out a compatibility assessment.
Q4/ Consent of children
At what age can a child give their consent to processing in relation to ISS?
15 years of age.
Q5/ Processing of sensitive personal data
(a) Are there any sensitive personal data which cannot be processed on the basis of a data subject’s consent?
All sensitive personal data can be processed if the data subject’s valid consent has been obtained.
———
b) Does national law contain any specific requirements regarding the processing of sensitive personal data in respect of the following:
(i) Employment, social security and/or social protection law
Where it is necessary to comply with the law, authorities responsible for social security may process personal data without consent, even after the data subject has objected to the processing or disputed the accuracy of the data. Further, these authorities may exercise their competence on the basis of automated processing of personal data. These rules apply to personal data in general, including sensitive personal data.
(ii) Substantial public interest
There are no specific rules on processing this category of data.
(iii) Preventative or occupational medicine; employee working capacity, medical diagnosis, provision of health or social care, or management of health or social care systems or services
When establishing and managing patient records, health services providers must use a separate dossier containing basic medical records on the patient’s health status within the medical records in order to facilitate the provision of cross-border healthcare services. Data included in the patient summary may be transferred without consent through the National Contact Point for the purposes of provision of health care.
To comply with applicable law, health insurance authorities and health insurance companies may process personal data without consent, even after the data subject has objected to the processing or has denied the accuracy of the data. Further, these authorities may exercise their competence in a manner based solely on the automated processing of personal data.
(iv) Public interest in the area of public health
There are no specific rules on processing this category of data.
(v) Archiving purposes, scientific or historical research purposes or statistical purposes
The controller or the processor must take concrete measures to protect the data subject´s interests, taking into account the state of the art and the costs of implementation, the nature, scope, context and purposes of the processing and the risk to the rights and freedoms of natural persons, such as pseudonymisation, encryption or the appointment of a DPO. The controller or the processor can therefore process sensitive personal data for the purposes of scientific or historical research or statistical purposes in a form that does not permit the controller or the processor to identify a data subject but that still allows these purposes to be achieved (unless the legitimate interests of the data subject override this).
The right of access by the data subject to archives only extends to inspection of the archival records. Arts. 16 & 18-21 GDPR and, to the relevant extent, also Art. 5 GDPR do not apply to the processing of personal data for archiving purposes.
———
(c) Has national law introduced any further conditions and/ or limitations with regard to the processing of genetic data, biometric data, or health data?
Sensitive personal data, including genetic data, biometric data or health data, may be processed if it is necessary for the purpose of an investigation of a particular crime or an offence conducted by the police, the General Inspection of Security Forces, the Customs Administration or the Military Police Service.
Passenger Name Record data revealing sensitive personal data, including genetic data, biometric data or health data, may be processed only by the police for the purpose of assessing and creating points of reference for passengers under EU Directive 514/2017, criminal offences listed in Annex II of the Directive 2016/681 and handovers handled by the authorities in order to fulfil this task. Such data must be erased immediately upon receipt.
Personal data may be processed if it is appropriate for the purpose of academic, artistic or literary expression; however, account must be taken of whether processing involves sensitive personal data, including health data.
Q6/ Data relating to criminal offences or convictions
Under what conditions does national law permit the processing of personal data relating to criminal convictions?
Any personal data may be processed if it is appropriate for the purpose of academic, artistic or literary expression; however, account must be taken of whether processing involves sensitive personal data, including data relating to criminal convictions and offences.
Q7/ Exemptions
(a) Does national law specify exemptions to a data subject’s right to erasure?
The data subject´s right to erasure can be suspended where necessary and proportionate in order to protect a “protected interest” as defined in Q3(a) above (unless applicable law requires otherwise). The controller or the processor has to notify the DPA any such restriction to this right without undue delay, and must provide reasonably detailed information pursuant to Art. 23(2) GDPR. These requirements do not apply to courts acting in their judicial capacity.
The right to erasure may also be limited where controllers process personal data in compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in them. For example, AML legislation provides that the official authority (in this case, the Financial Analytical Office) must refuse a request to erase personal data if doing so could hinder the performance of its AML duties or the protection of classified information.
The exercise of a data subject´s right to erasure with regard to the processing of personal data for the purpose of academic, artistic or literary expression is governed by special legislation. In this respect, constitutional legislation takes precedence over the provisions of the Data Protection Act. Accordingly, freedom of expression and the right to information must be weighed against the interests of the data subject, especially in more complex cases. Norms with constitutional power, as national law, are applicable to other conflicts between standards governing the protection of personal data, and rights and protected interests governed by constitutional norms (freedom of expression, freedom of the press, freedom of scientific research and artistic expression, the right to acquire and disseminate information), using the principles of proportionality.
With regard to the processing of personal data carried out for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, the right to erasure may be limited where complying with such a request could hinder the performance of a task in this field, the course of proceedings, the protection of classified information or the legitimate interests of a third person.
There are no exemptions to a data subject´s right to erasure linked to scientific or historical research purposes and statistical purposes or archiving purposes.
———
(b) Does national law specify exemptions to a data subject’s right to be provided information under Art. 14 GDPR where the personal data has not been obtained from the data subject?
Exemptions to the right to be provided information are provided for in certain specific laws. For example, national banking legislation provides that Art. 14 GDPR does not apply to personal data processed by the relevant public authority (in this case the Czech National Bank) in respect of economic measures taken during crisis situations.
———
(c) Does national law specify exemptions to a data subject’s right to not be subject to a decision based solely on automated processing, including profiling?
With regard to the processing of personal data carried out for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, the relevant public authority may process personal data by automated means (provided it keeps records of any processing) and can limit any rights of the data subject. The relevant public authority must, however, take measures to ensure the necessary level of protection and recoverability of the data, the ability to identify and verify persons with access to the data, the security and reliability of the information system containing such data, and the prevention of unauthorised access to the data.
With regard to the processing of personal data carried out for the purpose of ensuring the defence and national security interests of the Czech Republic, the controller or the processor is further obliged to ensure that the automated processing is used to make decisions only by an authorised natural person, to ensure that such authorised natural person has access only to personal data corresponding to his or her authorisation, and to keep electronic records.
Q8/ Restrictions on data subjects’ rights
Aside from the exemptions noted in Q7, does national law contain any other restrictions on the rights of data subjects under Chapter III GDPR?
Arts. 12-22 GDPR and, to the relevant extent, Art. 5 GDPR may be limited where necessary and, to a proportionate extent, in order to protect a “protected interest” as defined in Q3(a) above. The controller or the processor must notify the DPA of any such restrictions without undue delay, and must provide reasonably detailed information pursuant to Art. 23(2) GDPR. These requirements do not apply to courts acting in their judicial capacity.
Arts. 15-16, 18 & 21 and, to the relevant extent, also Art. 5 GDPR may be limited where necessary and with regard to the scope appropriate for scientific or historical research purposes and statistical purposes. Art. 15 GDPR does not apply to processing necessary for scientific purposes if the provision of information requires disproportionate efforts.
The right of access to personal data stored in archives must be carried out only by inspection of the archival records. Arts. 16 & 18-21 and, to the relevant extent, also Art. 5 GDPR do not apply to the processing of personal data for archiving purposes.
Q9/ Joint controllership
Does national law provide rules or guidance on the apportionment of responsibility between joint controllers?
There are no additional rules on apportionment of liability between joint controllers.
Q10/ Processor
In addition to the contract between controller and processor, are there any pieces of legislation which govern processing by a processor?
The Data Protection Act provides additional rules for the processor in respect of processing carried out for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties as well as processing of personal data carried out for the purpose of ensuring the defence and security interests of the Czech Republic.
Q11/ Impact Assessments
Are there any circumstances in which national law requires an Impact Assessment to be carried out, where the GDPR would not otherwise require such an assessment?
Impact Assessments are only required in accordance with the provisions of the GDPR. However, controllers are exempt from the obligation to carry out an Impact Assessment provided that the controller is obliged to carry out the processing of personal data by applicable law.
Q12/ Prior authorisation and public interest
Are there any circumstances in which national law requires controllers to consult with, or obtain prior authorisation from, the DPA in relation to processing for the performance of a task carried out by the controller in the public interest (including processing in relation to social protection and public health)?
Prior authorisation from the DPA is only required in accordance with the provisions of the GDPR.
Q13/ DPOs
(a) Does national law require controllers to appoint a DPO in circumstances other than those in Art. 37(1) GDPR?
The obligation to appoint a DPO also applies to entities established by law and performing statutory tasks in the public interest (in addition to public authorities).
———
(b) Does national law impose secrecy and confidentiality obligations on DPOs and if so, in what circumstances do they apply?
DPOs are not subject to secrecy obligations under national law.
Q14/ International data transfers
(a) Does national law make specific rules about transfers of personal data from public registers?
Data transfers from public registers are not subject to specific rules.
———
(b) Does national law restrict the transfer of specific categories of personal data to third countries?
Data transfers are not subject to restrictions beyond those set out in the GDPR.
Q15/ DPAs
(a) Details of the DPA(s).
- Name of DPA: The Office for Personal Data Protection (Czech: “Úřad pro ochranu osobních údajů”)
- Address: Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
- Website: uoou.cz
———
(b) If more than one national DPA has been established, what is the rationale behind multiple DPAs?
Not applicable as there is only one DPA.
———
(c) How does national law ensure consistent application of the GDPR by the various DPAs in accordance with Art. 63 GDPR?
Not applicable.
———
(d) Does national law grant the relevant DPA additional powers beyond those set out in Art. 58 GDPR?
The scope of the competence of the DPA includes the protection of the right to information. The DPA can carry out a review of the decision of the management board of the relevant entity with regard to a request for information, and can take measures against inaction if redress cannot be obtained from the management board.
Further, the DPA also deals with unsolicited commercial communications.
———
(e) What national appeals process exists to enable parties to challenge the decisions of the DPA?
An administrative appeal may be brought against decisions issued by the DPA.
———
(f) Have specific national rules been adopted regarding the DPA’s power to obtain information from controllers or processors that are subject to obligations of professional secrecy (or equivalent)?
The DPA is entitled to access all the information necessary for the performance of a particular task. This also applies to information protected by confidentiality rules, unless applicable law requires otherwise.
With regard to personal data protected by legal privilege, the DPA may only consult the relevant personal data with the consent of, and in the presence of, a representative of the Czech Bar Association appointed by the President of the Association. If no consent is granted, there is an additional procedure that can be used to obtain authorisation from a court.
Q16/ Claims by not-for-profit bodies
Does national law specify any not-for-profit bodies that are entitled to bring claims on behalf of individuals without the specific mandate of those individuals?
Data subjects may be represented by a not-for-profit legal entity whose activities include the protection of the rights of the data subjects.
Q17/ Administrative fines, penalties and sanctions
(a) Does national law lay down rules on whether and to what extent administrative fines may be imposed on public authorities for breaches of the GDPR?
The law in the Czech Republic sets the maximum amount of the fine for controllers and processors indicated in Art. 83(7) GDPR at CZK 10 million (approx. €390,000), and entirely cancels fines for municipalities that do not exercise delegated powers, voluntary unions of such municipalities, subsidy organisations established by such municipalities and legal persons carrying out activities on behalf of schools or school facilities established by municipalities or by voluntary unions of municipalities.
———
(b) Does national law impose penalties/sanctions in addition to those set out in the GDPR, for breaches of the GDPR not subject to administrative fines (e.g., criminal penalties)?
There are no additional penalties/sanctions.
Q18/ Freedom of expression and information
(a) What (if anything) does national law do to balance the provisions of the GDPR against the right to freedom of expression and information?
There are no specific provisions governing this issue.
———
(b) What derogations have been introduced by national law concerning the processing of personal data for the purpose of academic, artistic or literary expression?
The following derogations apply concerning the processing of personal data for the purpose of academic, artistic or literary expression:
- derogation from the right of access;
- derogation from the rights to rectification, erasure and restriction of processing; and
- derogation from the right to object.
Q19/ National identification numbers
Does national law stipulate specific conditions for the processing of a national identification number, and if so, what are the conditions?
National identification numbers can only be processed in the following circumstances:
- where such personal data is processed by government ministries, other administrative authorities, bodies responsible for the performance of state administration, within the courts, or notaries;
- where applicable law provides for such processing; or
- with the consent of the relevant data subject.
Q20/ Processing in the context of employment
(a) For what purposes can employees’ personal data in the employment context be processed under national law?
There are no specific provisions governing the processing of employee data.
———
(b) Does national law provide safeguards for employees’ dignity, legitimate interests, and fundamental rights?
There are no specific safeguards of this nature.
Q21/ Other material derogations
Are there any other material derogations from, or additions to, the GDPR under national law?
There are no other material derogations.
Q22/ Current legal challenges
Are there any current legal challenges (e.g., court cases or regulatory appeals) regarding the validity or operation of the national GDPR implementation law (e.g., claims that the law incorrectly applies the GDPR; claims that the law is incompatible with constitutional principles; etc.)?
There are no current legal challenges ongoing.
Q23/ Enforcement
Has the local DPA issued any material fines or taken any material enforcement action to date for breaches of the GDPR?
A complaint was brought to the DPA by a non‑profit organisation representing data subjects in mid‑December 2018 concerning the processing of localisation data of users of an internet platform. In line with the rules set out in the GDPR for investigating cross-border cases and of the fact that the platform´s main establishment in the EU is in Ireland, the DPA referred the complaint to the Irish DPA.
Q24/ Regulatory Guidance
Has the DPA issued any significant guidance on the application of the GDPR or national implementation law?
The DPA has issued the following guidance on the application of the GDPR and/or GDPR implementation law:
- basic guidance on the GDPR (see here (in Czech));
- guidance on Codes of Conduct (see here uoou.cz/assets/File.ashx?id_org=200144&id_dokumenty=31514 (in Czech));
- guidance on data protection Impact Assessments (see here uoou.cz/assets/File.ashx?id_org=200144&id_dokumenty=33193(in Czech));
- template for record of processing activities for small businesses (see here (in Czech)); and
- overview of the GDPR (see here uoou.cz/assets/File.ashx?id_org=200144&id_dokumenty=32697 (in Czech)).
White & Case contributors
|
Ivo Janda |
|
Ivo Janda focuses on competition law, dispute resolution, insolvency law and public law (regulatory practice). Among other roles and duties, Ivo leads the Prague office’s competition law practice and is co-head of the dispute resolution practice group. Prior to joining White & Case in 2001, he worked for the International Law Department of the Ministry of Foreign Affairs of the Czech Republic, and was also posted to the UN in New York as a legal adviser to the Czech Government. Ivo advises clients across industry sectors on all aspects of Czech and EU privacy and data protection law, including general compliance issues but also casespecific and client-specific issues. |
|
|
Anna Stárková |
|
Anna Stárková joined the Prague office of White & Case during her studies in 2017 as a legal intern and after graduating from the Law Faculty of Charles University, became a member of the competition and regulatory team. Anna focuses primarily on legal advisory services in connection with IT, IP, data protection and cybersecurity. Her experience includes also advising clients on merger filings with the EU and national supervisory authorities, and proceedings before supervisory authorities. Before joining White & Case, Anna also worked as an intern at the Office of the Agent of the Czech Republic before the Court of Justice of the EU. |
|
Other chapters
- Foreword and issue-by-issue comparison
- Country-by-country guides:
———
See also:
Our Global Data, Privacy & Cybersecurity Practice »
GDPR Handbook: Unlocking the EU General Data Protection Regulation »
———
This publication is provided for your convenience and does not constitute legal advice. This publication is protected by copyright.
© 2019 White & Case LLP
