amending Act No. 468/2011 Sb. removed the words ‘exclusively for the purposes’
from the sentence “This obligation does not apply to activities relating to technical
storage or access and serving exclusively for the purposes of performing or facilitating message transmission via the electronic communications network”, while the
wording of the first sentence remained the same as before the adoption of the
Directive 2009/136/EC, which brought opt-in principle for cookies to the
e-Privacy Directive. Thus, under the Czech law, the provider has only a duty to
offer an option to refuse the use of cookies. Interestingly, the explanatory note of the
amending act states that the opt-in principle is in fact introduced, which leaves space
for confusion among both providers and users.
To prevent unintended operational breaches of the EU law, The Czech Data
Protection Authority issued a guidance stating that the law should be interpreted in
the light of European provisions,
7 so that the opt-in principle should be applied even
though Czech law does not provide for such specific statutory obligation.
Pursuant to the coming into force of the GDPR, the Czech Data Protection
Authority issued in May 2018 a draft Recommendation regarding processing of
cookies and similar means of monitoring.
8 The document summarizes the applicable
combination of obligations implied from the Section 89 of the Electronic Communications Act and the GDPR. It highlights the personal data protection by default and
design pursuant to Article 25 GDPR; clear formulation of the purpose of processing
and identification of legal basis; duty to assess the related risk; duty to inform the
data subjects and provide them with an option to withdraw their consent. The draft
recommendation distinguishes between technical cookies necessary for proper functioning of the website, which do not require user consent and other cookies, which
require user consent through appropriate browser settings. The text further favours
the less demanding requirements on cookies of third parties, as it accepts as sufficient
a more general consent related to form of processing rather than specific consent
with particular cookie on particular website. The content of the draft recommendation was open to comments and as of now, there is not final wording of the
recommendation available. It is, however, probable that the recommendation will
be further amended in light of the received feedback, as some of the wording is
diverging from current academic view on the issue.
7 Cookies: přechod z principu opt-out na opt-in [Cookies: transfer from the opt-out principle to
opt-in], 2012, Available online (in Czech): http://www.uoou.cz/vismo/zobraz_dok.asp?id_
org¼200144&id_ktg¼1853&n¼cookies-prechod-z-principu-opt-out-na-opt-in&query¼cookie&
p1¼1099.
8 Doporučení k zpracování cookies a obdobných prostředků sledování od 25. května 2018 [Recommendation regarding processing of cookies and similar means of monitoring following 25th May
2018], 2018. Available online (in Czech): https://www.uoou.cz/vismo/dokumenty2.asp?id_
org¼200144&id¼29966&n¼cookies%2Da%2Dgdpr&p1¼1099.
National Report: Czech Republic
123
from the sentence “This obligation does not apply to activities relating to technical
storage or access and serving exclusively for the purposes of performing or facilitating message transmission via the electronic communications network”, while the
wording of the first sentence remained the same as before the adoption of the
Directive 2009/136/EC, which brought opt-in principle for cookies to the
e-Privacy Directive. Thus, under the Czech law, the provider has only a duty to
offer an option to refuse the use of cookies. Interestingly, the explanatory note of the
amending act states that the opt-in principle is in fact introduced, which leaves space
for confusion among both providers and users.
To prevent unintended operational breaches of the EU law, The Czech Data
Protection Authority issued a guidance stating that the law should be interpreted in
the light of European provisions,
7 so that the opt-in principle should be applied even
though Czech law does not provide for such specific statutory obligation.
Pursuant to the coming into force of the GDPR, the Czech Data Protection
Authority issued in May 2018 a draft Recommendation regarding processing of
cookies and similar means of monitoring.
8 The document summarizes the applicable
combination of obligations implied from the Section 89 of the Electronic Communications Act and the GDPR. It highlights the personal data protection by default and
design pursuant to Article 25 GDPR; clear formulation of the purpose of processing
and identification of legal basis; duty to assess the related risk; duty to inform the
data subjects and provide them with an option to withdraw their consent. The draft
recommendation distinguishes between technical cookies necessary for proper functioning of the website, which do not require user consent and other cookies, which
require user consent through appropriate browser settings. The text further favours
the less demanding requirements on cookies of third parties, as it accepts as sufficient
a more general consent related to form of processing rather than specific consent
with particular cookie on particular website. The content of the draft recommendation was open to comments and as of now, there is not final wording of the
recommendation available. It is, however, probable that the recommendation will
be further amended in light of the received feedback, as some of the wording is
diverging from current academic view on the issue.
7 Cookies: přechod z principu opt-out na opt-in [Cookies: transfer from the opt-out principle to
opt-in], 2012, Available online (in Czech): http://www.uoou.cz/vismo/zobraz_dok.asp?id_
org¼200144&id_ktg¼1853&n¼cookies-prechod-z-principu-opt-out-na-opt-in&query¼cookie&
p1¼1099.
8 Doporučení k zpracování cookies a obdobných prostředků sledování od 25. května 2018 [Recommendation regarding processing of cookies and similar means of monitoring following 25th May
2018], 2018. Available online (in Czech): https://www.uoou.cz/vismo/dokumenty2.asp?id_
org¼200144&id¼29966&n¼cookies%2Da%2Dgdpr&p1¼1099.
National Report: Czech Republic
123