Over the past few years the Data Protection Office in the Czech Republic has dealt with the question of monitoring systems on many occasions. It has decided that the operation of monitoring systems constitutes “Personal Data Processing” as defined in Act No. 101/2000 Coll. (the “Data Protection Act”) and that operators must therefore comply with the Data Protection Act.
Since this decision, the Data Protection Office has ruled on various aspects of the operation of monitoring systems such as the necessity to obtain the data subjects’ consent to the data processing or the required retention period for data obtained. In these decisions the Office adopted a “common-sense approach” to the application of the Data Protection Act, approving the operation of monitoring systems where necessary to protect the rights and legitimate interests of the collector even without the data subjects’ consent. However, it held that the data subjects must be aware that they are being monitored. Data obtained from cameras may only be used for the determined purpose and stored only for the period of time necessary for the realisation of the purpose (e.g. pictures showing a person committing an offence may not be stored after the lapse of the statutory period for the prosecution of the offence).
At the end of 2008 the Office dealt with a case relating to a very specific use of the monitoring system data. The city of Chomutov (Northwest Bohemia) decided to use the data from the city’s monitoring system to prosecute prostitutes (the city of Chomutov issued a city order declaring prostitution an offence). The city would use a car registration number shown on the pictures from the system to identify the customer of a street prostitute. The customer would be then called as a witness in the proceedings against the prostitute.
The wave of opposition to this use of data prompted the Data Protection Office to examine the case. After negotiations with the city, the Data Protection Office held that the data use was necessary to protect the city’s interests, and that such proceedings were in accordance with the Data Protection Act. The Data Protection Office, however, refused to approve the publication of the registration numbers and pictures from the cameras on the city’s website. It held that this could only be done with the data subjects’ consent.