Section 88
Securing the Protection of Personal, Traffic and Location Data and the Confidentiality of
Communications
(1) The undertaking providing publicly available electronic communications service is
obliged to:
a) take technical and organisational measures to safeguard the security of the service in
respect of the protection of natural persons’ personal information in accordance with a
special legal regulation [currently referring to the respective unified obligations pursuant to
the GDPR], protection of the traffic and location data, and confidentiality of the communications of natural persons and legal entities in providing the service; if necessary, the
provider concerned shall upon written agreement also co-operate with the undertaking
providing the communications network to provide the protection,
b) prepare internal technical and organisational regulations to provide data protection and
communications confidentiality in accordance with Clause a) above; secure data protection
and communications confidentiality with respect to the existing technical capabilities and the
costs needed to provide protection at a level adequate to the risks of compromising the
protection,
(. . .)
Section 88a
(1) The undertakings providing public communications networks or publicly available
electronic communications services shall secure that the traffic and location data collected
pursuant to Section 97 Subsection 3 have equal quality and underlay equal security and
protection from unauthorized access, modification, deletion, loss or theft or other
unauthorized processing or use as do the data pursuant to Section 88; this provision does
not preclude obligations under special legal regulation [currently referring to the respective
unified obligations pursuant to the GDPR].
(2) The undertakings providing public communications networks or publicly available
electronic communications services shall prepare an internal technical and organisational
regulation in order to assure the protection of the data pursuant to the Subsection 1; data
protection shall be secured with respect to the existing technical capabilities and the costs
needed to provide protection at a level adequate to the risks of compromising the protection.
For the protection of data under this provision shall accordingly apply the provisions in
Section 88 Subsections 2 to 7.
Further obligation can be derived from Section 88 subsection 1, lit. c) of the
Electronic Communications Act. It lays down that the undertaking providing publicly available electronic communications service is obliged to inform the subscribers about the specific risk of the disturbance of network security in relation to
data protection. If the risk is beyond the scope of the measures taken by the
undertaking providing publicly available electronic communications service, the
undertaking shall also inform the subscribers about all the possible ways of remedying the situation, including the costs associated therewith.
21 Pursuant to the technical
provisions contained in the Regulation (EU) 611/2013 on the notification of personal
data breaches in the electronic communication sector (Regulation 611/2013), such
21 See in Czech: Chudomelová et al. (2016), pp. 290–293.
132
R. Polčák et al.
Securing the Protection of Personal, Traffic and Location Data and the Confidentiality of
Communications
(1) The undertaking providing publicly available electronic communications service is
obliged to:
a) take technical and organisational measures to safeguard the security of the service in
respect of the protection of natural persons’ personal information in accordance with a
special legal regulation [currently referring to the respective unified obligations pursuant to
the GDPR], protection of the traffic and location data, and confidentiality of the communications of natural persons and legal entities in providing the service; if necessary, the
provider concerned shall upon written agreement also co-operate with the undertaking
providing the communications network to provide the protection,
b) prepare internal technical and organisational regulations to provide data protection and
communications confidentiality in accordance with Clause a) above; secure data protection
and communications confidentiality with respect to the existing technical capabilities and the
costs needed to provide protection at a level adequate to the risks of compromising the
protection,
(. . .)
Section 88a
(1) The undertakings providing public communications networks or publicly available
electronic communications services shall secure that the traffic and location data collected
pursuant to Section 97 Subsection 3 have equal quality and underlay equal security and
protection from unauthorized access, modification, deletion, loss or theft or other
unauthorized processing or use as do the data pursuant to Section 88; this provision does
not preclude obligations under special legal regulation [currently referring to the respective
unified obligations pursuant to the GDPR].
(2) The undertakings providing public communications networks or publicly available
electronic communications services shall prepare an internal technical and organisational
regulation in order to assure the protection of the data pursuant to the Subsection 1; data
protection shall be secured with respect to the existing technical capabilities and the costs
needed to provide protection at a level adequate to the risks of compromising the protection.
For the protection of data under this provision shall accordingly apply the provisions in
Section 88 Subsections 2 to 7.
Further obligation can be derived from Section 88 subsection 1, lit. c) of the
Electronic Communications Act. It lays down that the undertaking providing publicly available electronic communications service is obliged to inform the subscribers about the specific risk of the disturbance of network security in relation to
data protection. If the risk is beyond the scope of the measures taken by the
undertaking providing publicly available electronic communications service, the
undertaking shall also inform the subscribers about all the possible ways of remedying the situation, including the costs associated therewith.
21 Pursuant to the technical
provisions contained in the Regulation (EU) 611/2013 on the notification of personal
data breaches in the electronic communication sector (Regulation 611/2013), such
21 See in Czech: Chudomelová et al. (2016), pp. 290–293.
132
R. Polčák et al.