Czech Republic

The Data Protection Act ("DPA") has been published in the Collection of Laws on 24 April 2019, effective as of publication.

The former DPA No. 101/2000 Coll. was repealed by the new DPA. Multiple existing laws (e.g. Civil Procedure Code, Criminal Procedure Code) have been amended by an Amending Act. The new DPA has also transposed the Law Enforcement Directive.

The DPA is effective as of 24 April 2019.

Areas where Member States must have local laws:

Section 17 allows processing of personal data carried out by adequate means for journalistic purposes or for purposes of academic, artistic or literary expression. Sections 18 et seq. stipulate exceptions to information obligations (Section 18), protection of source and content of information (Section 19), exceptions to right to rectification, erasure and restriction of processing (Section 20), information about rectification, erasure and restriction of processing (Section 21), and limitation of the right to object (Section 22).

Section 61 stipulates fines for the administrative offence of unlawful publication of personal data where the prohibition of disclosure is stipulated by law (e.g. Criminal Procedure Code). Fines may amount to CZK 1 million. Maximum fines of CZK 5 million are stipulated if the administrative offence is carried out through print, film, radio, television, publicly accessible computer network or other similarly effective means.

Section 62 stipulates various administrative offences in relation to which no fines may be imposed on public authorities and bodies.

Section 63 stipulates various administrative offences in relation to data processing by public authorities and bodies. A fine up to CZK 10 million (i.e. lower than GDPR) may be imposed.

No new criminal penalties are introduced (unauthorised use of personal data is already recognised by the Criminal Code).

Areas where Member States may have local laws:

Section 58 stipulates that Data Protection Authority must exclude from inspection information that constitute trade secrets or bank secrets or any similar types of secrets, copyrighted works, and information protected by secrecy obligations under special laws, if the file is inspected by a person who did not provide such protected information. The Data Protection Authority is only authorised to get acquainted with information protected by professional secrecy of attorneys with consent and upon presence of a representative of the Czech Bar Association.

Section 16 stipulates measures that must be ensured when carrying out processing for purposes of scientific or historical research or for statistical purposes (e.g. maintenance of records of collection, insertion, alteration or erasure of personal data and of  appointment of a DPO). Special categories of data must be processed in a form that does not allow  identification of data subjects, unless this would make it impossible to achieve the relevance objectives, or processing  is prevented by legitimate interests of the data subjects.

n/a

n/a

 15 years.

Section 16(2) stipulates that special categories of data should be processed for purposes of scientific or historical research or for statistical purposes, in a form that does not allow for identification of data subjects, unless this would make it impossible to achieve the relevant objectives, or the processing  is prevented by legitimate interests of the data subjects.

Section 17(1) stipulates that personal data may also be processed if such processing reasonably serves journalistic purposes or purposes of academic, artistic or literary expression. The proportionality test should take into account whether such processing entails processing of special categories of data.

Section 14 stipulates that obligation to appoint a Data Protection Officer under Article 37(1)(a) GDPR also applies to bodies established by law that fulfil tasks imposed by law in public interest.

n/a

Other:

n/a