amending act that should subsequently change a number of indirectly related statutes
(e.g. the Police Act, Code of Criminal Procedure, Code of Civil Procedure etc.)
However, both aforementioned acts, i.e. the ‘Personal Data Processing Act’ and the
‘Act Amending Certain Statutes with Regards to the Adoption of the Personal Data
Processing Act’ are at the time of editing of this text (Fall 2018) still pending at the
Czech Parliament.
Consequently, even after the GDPR came into force and the Directive the
No. 95/46/EC on the protection of individuals with regard to the processing of
personal data and on the free movement of such data, was repealed, there still applies
the old Czech Act No. 101/2000 Sb., on the Protection of Personal Data and on
Amendment to Some Acts that originally had implemented the Directive No. 95/46/
EC. This situation is quite unfortunate and leads to high uncertainty namely among
controllers and processors of personal data. It is highly questionable which parts of
the Act No. 101/2000 Sb. have been materially derogated by the GDPR and which
provisions still apply.
There has been so far established no case-law upon the GDPR. However, thanks
to the use of analogical fundamental principles and definitions related to protection
of personal data with previous legislation, it is possible to use existing case-law
namely of the Court of Justice of the European Union (CJEU) and the Czech
Supreme Administrative Law. The most relevant cases of the CJEU include:
– Case C-210/16, Unabhängiges Landeszentrum für Datenschutz SchleswigHolstein v. Wirtschaftsakademie Schleswig-Holstein GmbH.
– Case C-582/14, Patrick Breyer v. Germany.
– Case C-230/14, Weltimmo s. r. o. v Nemzeti Adatvédelmiés Információszabadság
Hatóság.
– Case C-362/14, Maximillian Schrems v Data Protection Commissioner.
– Case C-212/13, František Ryneš v Úřad pro ochranuo sobních údajů.
– Case C-131/12, Google Spain SL, Google Inc. v Agencia Española de Protección
de Datos (AEPD), Mario Costeja González.
– Joint cases C-293/12 and C-594/12, Digital Rights Ireland Ltd v Minister for
Communications et al.
– Case C-461/10, Bonnier Audio AB et al. v Perfect Communication Sweden AB.
– Case C-557/07, LSG-Gesellschaft zur Wahrnehmung von Leistungsschutzrechten
GmbH v Tele2 Telecommunication GmbH.
– Case C-275/06, Productores de Música de España (Promusicae) v Telefónica de
España SAU.
– Case C-101/01, Bodil Lindqvist.
Compared to other EU member-states, the Czech case-law is relatively scarce.
The most relevant cases are listed below:
– Supreme Administrative Court 9 Azs 49/2018—50.
– Supreme Administrative Court 3 As 3/2017—38.
– Supreme Administrative Court 3 As 118/2015—34.
– Supreme Administrative Court 1 As 113/2012—133.
116
R. Polčák et al.
(e.g. the Police Act, Code of Criminal Procedure, Code of Civil Procedure etc.)
However, both aforementioned acts, i.e. the ‘Personal Data Processing Act’ and the
‘Act Amending Certain Statutes with Regards to the Adoption of the Personal Data
Processing Act’ are at the time of editing of this text (Fall 2018) still pending at the
Czech Parliament.
Consequently, even after the GDPR came into force and the Directive the
No. 95/46/EC on the protection of individuals with regard to the processing of
personal data and on the free movement of such data, was repealed, there still applies
the old Czech Act No. 101/2000 Sb., on the Protection of Personal Data and on
Amendment to Some Acts that originally had implemented the Directive No. 95/46/
EC. This situation is quite unfortunate and leads to high uncertainty namely among
controllers and processors of personal data. It is highly questionable which parts of
the Act No. 101/2000 Sb. have been materially derogated by the GDPR and which
provisions still apply.
There has been so far established no case-law upon the GDPR. However, thanks
to the use of analogical fundamental principles and definitions related to protection
of personal data with previous legislation, it is possible to use existing case-law
namely of the Court of Justice of the European Union (CJEU) and the Czech
Supreme Administrative Law. The most relevant cases of the CJEU include:
– Case C-210/16, Unabhängiges Landeszentrum für Datenschutz SchleswigHolstein v. Wirtschaftsakademie Schleswig-Holstein GmbH.
– Case C-582/14, Patrick Breyer v. Germany.
– Case C-230/14, Weltimmo s. r. o. v Nemzeti Adatvédelmiés Információszabadság
Hatóság.
– Case C-362/14, Maximillian Schrems v Data Protection Commissioner.
– Case C-212/13, František Ryneš v Úřad pro ochranuo sobních údajů.
– Case C-131/12, Google Spain SL, Google Inc. v Agencia Española de Protección
de Datos (AEPD), Mario Costeja González.
– Joint cases C-293/12 and C-594/12, Digital Rights Ireland Ltd v Minister for
Communications et al.
– Case C-461/10, Bonnier Audio AB et al. v Perfect Communication Sweden AB.
– Case C-557/07, LSG-Gesellschaft zur Wahrnehmung von Leistungsschutzrechten
GmbH v Tele2 Telecommunication GmbH.
– Case C-275/06, Productores de Música de España (Promusicae) v Telefónica de
España SAU.
– Case C-101/01, Bodil Lindqvist.
Compared to other EU member-states, the Czech case-law is relatively scarce.
The most relevant cases are listed below:
– Supreme Administrative Court 9 Azs 49/2018—50.
– Supreme Administrative Court 3 As 3/2017—38.
– Supreme Administrative Court 3 As 118/2015—34.
– Supreme Administrative Court 1 As 113/2012—133.
116
R. Polčák et al.