creation is solely a matter of initiative or controllers, processors or various professional associations or guilds.
2 Personal Data Processed by Electronic Means
The Czech law does not contain a specific legislative act covering the protection of
personal data in the context of services provided at a distance, by electronic means,
at the individual request of a recipient of services. These forms of personal data
processing were until recently governed by the general statutory rules of the Act.
No. 101/2000 Sb. on the Protection of Personal Data and on Amendment to Some
Acts. The current general framework is provided by the GDPR. It shall further be
supplemented by upcoming new Czech national personal data protection framework
consisting of the ‘Personal Data Processing Act’ and the ‘Act Amending Certain
Statutes with Regards to the Adoption of the Personal Data Processing Act’. These
legislative drafts reflect the coming into force of the GDPR and provide for transposition of the provisions contained in Directive (EU) 2016/680 on the protection of
natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of
criminal offences or the execution of criminal penalties (Police Directive 2016/680)
and Directive (EU) 2016/681 on the use of passenger name record data for the
prevention, detection, investigation and prosecution of terrorist offences and serious
crime. However, as of now, there are no indications, that even this new legislation
should contain specific legislative provisions on the protection of personal data in the
context of services provided at a distance, by electronic means, at the individual
request of a recipient of services.
Aside from directly applicable general provisions of the GDPR, the Czech law
currently does not provide for specific additional protection of data subjects in this
context. The data controller is not required to have a consent for the electronic
processing under circumstances divergent from the requirements set under the
GDPR. There are no additional limitations of processing for specific purposes or
for specific types of data or other particular requirements for the electronic
processing of personal data. The increased protection of minors pursuant to the
GDPR should be applicable to age threshold of 15 years of age, as implies from the
proposal of the ‘Personal Data Processing Act’. This provision is, however, subject
to extensive political debate and it is currently unclear, if the threshold will not be
moved further towards the minimal threshold of 13 years of age set by the GDPR.
Rules for the rectification and erasure of personal data were already previously
found in the Act. No. 101/2000 Sb. as a transposition of the Directive No. 95/46/EC
on the protection of individuals with regard to the processing of personal data and on
the free movement of such data. These were replaced by more extensive and detailed
provisions in Articles 16 and 17 of the GDPR as well as parallel provision of Article
16 in the Police Directive 2016/680, which are to be transposed to Czech law by the
National Report: Czech Republic
119
2 Personal Data Processed by Electronic Means
The Czech law does not contain a specific legislative act covering the protection of
personal data in the context of services provided at a distance, by electronic means,
at the individual request of a recipient of services. These forms of personal data
processing were until recently governed by the general statutory rules of the Act.
No. 101/2000 Sb. on the Protection of Personal Data and on Amendment to Some
Acts. The current general framework is provided by the GDPR. It shall further be
supplemented by upcoming new Czech national personal data protection framework
consisting of the ‘Personal Data Processing Act’ and the ‘Act Amending Certain
Statutes with Regards to the Adoption of the Personal Data Processing Act’. These
legislative drafts reflect the coming into force of the GDPR and provide for transposition of the provisions contained in Directive (EU) 2016/680 on the protection of
natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of
criminal offences or the execution of criminal penalties (Police Directive 2016/680)
and Directive (EU) 2016/681 on the use of passenger name record data for the
prevention, detection, investigation and prosecution of terrorist offences and serious
crime. However, as of now, there are no indications, that even this new legislation
should contain specific legislative provisions on the protection of personal data in the
context of services provided at a distance, by electronic means, at the individual
request of a recipient of services.
Aside from directly applicable general provisions of the GDPR, the Czech law
currently does not provide for specific additional protection of data subjects in this
context. The data controller is not required to have a consent for the electronic
processing under circumstances divergent from the requirements set under the
GDPR. There are no additional limitations of processing for specific purposes or
for specific types of data or other particular requirements for the electronic
processing of personal data. The increased protection of minors pursuant to the
GDPR should be applicable to age threshold of 15 years of age, as implies from the
proposal of the ‘Personal Data Processing Act’. This provision is, however, subject
to extensive political debate and it is currently unclear, if the threshold will not be
moved further towards the minimal threshold of 13 years of age set by the GDPR.
Rules for the rectification and erasure of personal data were already previously
found in the Act. No. 101/2000 Sb. as a transposition of the Directive No. 95/46/EC
on the protection of individuals with regard to the processing of personal data and on
the free movement of such data. These were replaced by more extensive and detailed
provisions in Articles 16 and 17 of the GDPR as well as parallel provision of Article
16 in the Police Directive 2016/680, which are to be transposed to Czech law by the
National Report: Czech Republic
119