‘Personal Data Processing Act’. Apart from these, there are no specific rules present
in the Czech law for the rectification and erasure of personal data. In particular, the
Czech law did not, as of now, pursue specific legal framework for personal data
processing on social networks. There are therefore so far no tailored provisions
regarding personal data protection in this context and the general data protection
framework as introduced above applies.
Despite there is no specific legislation regarding electronic processing of personal
data, it might be found relevant in this context that the Czech Republic has a specific
legislation on cyber security—the Act No. 181/2014 Sb., on Cybersecurity. This Act
does not contain any particular provisions on the protection of personal data, but it
provides for a regulation of gathering and processing of specific dataset that consists
of data collected by the Governmental Cybersecurity Incident Response Team
(govCERT)
2 and might also include IP addresses. Given that the Court of Justice
of the European Union (CJEU) confirmed through decision on 19th October 2016 in
the case C-582/14, Breyer, that static as well as dynamic IP address has the capacity
to be considered as personal data, the Czech legislation on cyber security can
therefore be seen as relevant. From organisational perspective, it should be noted
that the formal institutional assignment of govCERT was recently transferred from
the Czech National Security Authority to the newly established National Office for
Cybersecurity and Information Security.
2.1 Commercial Communication
The Sections 7 and 8 of the Act No. 480/2004 Sb., on Certain Information Society
Services contain specific legislation on commercial communication constituting the
transposition of the Articles 6 to 8 of the Directive (EU) 2000/31/EC on electronic
commerce.
3 These provisions set conditions for dissemination of the commercial
communication. Pursuant to Section 2 lit. f) of the Act No. 480/2004 Sb.; “commercial communication” includes any form of communication, including advertisement or invitation to visit the website, designed to direct or indirect promotion of
goods, services or image of a commercial entity, who or which is regarded as
entrepreneur or exercising a regulated profession pursuant to the Czech law.
The prior consent of the recipient of the communication is required, unless the
contact details were obtained from the recipient during a conduct of sale of goods or
services and in compliance with general personal data protection framework. In such
a case, the contact details may be used for commercial communication to the
recipient concerning similar products of the commercial entity in question, if the
recipient is always provided by clear instructions to withdraw consent with such
communication for free. The commercial communication through electronic mail is
2 See in Czech: Maisner and Vlachová (2015), pp. 126–128.
3 See in Czech: Maisner (2016), pp. 138–147.
120
R. Polčák et al.
in the Czech law for the rectification and erasure of personal data. In particular, the
Czech law did not, as of now, pursue specific legal framework for personal data
processing on social networks. There are therefore so far no tailored provisions
regarding personal data protection in this context and the general data protection
framework as introduced above applies.
Despite there is no specific legislation regarding electronic processing of personal
data, it might be found relevant in this context that the Czech Republic has a specific
legislation on cyber security—the Act No. 181/2014 Sb., on Cybersecurity. This Act
does not contain any particular provisions on the protection of personal data, but it
provides for a regulation of gathering and processing of specific dataset that consists
of data collected by the Governmental Cybersecurity Incident Response Team
(govCERT)
2 and might also include IP addresses. Given that the Court of Justice
of the European Union (CJEU) confirmed through decision on 19th October 2016 in
the case C-582/14, Breyer, that static as well as dynamic IP address has the capacity
to be considered as personal data, the Czech legislation on cyber security can
therefore be seen as relevant. From organisational perspective, it should be noted
that the formal institutional assignment of govCERT was recently transferred from
the Czech National Security Authority to the newly established National Office for
Cybersecurity and Information Security.
2.1 Commercial Communication
The Sections 7 and 8 of the Act No. 480/2004 Sb., on Certain Information Society
Services contain specific legislation on commercial communication constituting the
transposition of the Articles 6 to 8 of the Directive (EU) 2000/31/EC on electronic
commerce.
3 These provisions set conditions for dissemination of the commercial
communication. Pursuant to Section 2 lit. f) of the Act No. 480/2004 Sb.; “commercial communication” includes any form of communication, including advertisement or invitation to visit the website, designed to direct or indirect promotion of
goods, services or image of a commercial entity, who or which is regarded as
entrepreneur or exercising a regulated profession pursuant to the Czech law.
The prior consent of the recipient of the communication is required, unless the
contact details were obtained from the recipient during a conduct of sale of goods or
services and in compliance with general personal data protection framework. In such
a case, the contact details may be used for commercial communication to the
recipient concerning similar products of the commercial entity in question, if the
recipient is always provided by clear instructions to withdraw consent with such
communication for free. The commercial communication through electronic mail is
2 See in Czech: Maisner and Vlachová (2015), pp. 126–128.
3 See in Czech: Maisner (2016), pp. 138–147.
120
R. Polčák et al.