sanctioning powers of the Office for Protection of Personal Data pursuant to the
provisions contained in Article 83 and 84 of the GDPR.
4 Data Protection and Digital Forensics
The regulatory substance of the draft Personal Data Processing Act (see above) is
divided into three parts. The first part covers national legal harmonisation with
General Data Protection Regulation. The second part implements the Police Directive
29 and the third part stipulates general data protection framework for areas which
are outside of the scope of the EU law like security, intelligence or defence. Specific
rules for processing of personal data in criminal procedure are laid down in Act
No. 141/1961 Sb. Code of Criminal Procedure.
The Code of Criminal Procedure is a dated act that has been amended numerous
times. Nevertheless, up until today, there are no specific provisions on access to data
and their use. Therefore, the police, state prosecutors and other law enforcement
authorities (“LEA”) must rely on legal instruments which were originally used for
different purposes (e.g. seizure of assets). A common framework for accessing and
collecting digital evidence was established only after several years of interpretation
process of these rules by different institutions. Apart from court decisions, the most
influential document is Opinion No. 1/2015 of the Supreme Public Prosecutors
Office,
30 which unified processes of accessing and collecting digital evidence.
There are several provisions in the Code of Criminal Procedure that allow LEA to
collect and access digital evidence. These provisions contain both substantive and
formal prerequisites of the collection. The digital evidence may be basically divided
into three categories: i) data that are stored in computer systems or storage devices
that can be seized (hard drives, flash drives, mobile phones, computers, and similar);
ii) data that are can be accessed via networks; and iii) data that are transferred as
telecommunication traffic.
The computer systems and storage devices may be seized following provisions on
Seizure of property (section 79 of the Code of Criminal Procedure) or during a house
or personal searches (section 82 of the Code of Criminal Procedure). Section 79 of
the Code of Criminal Procedure reads as follows (informal translation from ASPI
system):
§ 79 Seizure of Property
29 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data by competent authorities
for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the
execution of criminal penalties, and on the free movement of such data, and repealing Council
Framework.
30 In Czech online: http://www.nsz.cz/images/stories/PDF/Stanoviska_Proces/2015/1_SL_7602014.pdf.
National Report: Czech Republic
137
provisions contained in Article 83 and 84 of the GDPR.
4 Data Protection and Digital Forensics
The regulatory substance of the draft Personal Data Processing Act (see above) is
divided into three parts. The first part covers national legal harmonisation with
General Data Protection Regulation. The second part implements the Police Directive
29 and the third part stipulates general data protection framework for areas which
are outside of the scope of the EU law like security, intelligence or defence. Specific
rules for processing of personal data in criminal procedure are laid down in Act
No. 141/1961 Sb. Code of Criminal Procedure.
The Code of Criminal Procedure is a dated act that has been amended numerous
times. Nevertheless, up until today, there are no specific provisions on access to data
and their use. Therefore, the police, state prosecutors and other law enforcement
authorities (“LEA”) must rely on legal instruments which were originally used for
different purposes (e.g. seizure of assets). A common framework for accessing and
collecting digital evidence was established only after several years of interpretation
process of these rules by different institutions. Apart from court decisions, the most
influential document is Opinion No. 1/2015 of the Supreme Public Prosecutors
Office,
30 which unified processes of accessing and collecting digital evidence.
There are several provisions in the Code of Criminal Procedure that allow LEA to
collect and access digital evidence. These provisions contain both substantive and
formal prerequisites of the collection. The digital evidence may be basically divided
into three categories: i) data that are stored in computer systems or storage devices
that can be seized (hard drives, flash drives, mobile phones, computers, and similar);
ii) data that are can be accessed via networks; and iii) data that are transferred as
telecommunication traffic.
The computer systems and storage devices may be seized following provisions on
Seizure of property (section 79 of the Code of Criminal Procedure) or during a house
or personal searches (section 82 of the Code of Criminal Procedure). Section 79 of
the Code of Criminal Procedure reads as follows (informal translation from ASPI
system):
§ 79 Seizure of Property
29 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data by competent authorities
for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the
execution of criminal penalties, and on the free movement of such data, and repealing Council
Framework.
30 In Czech online: http://www.nsz.cz/images/stories/PDF/Stanoviska_Proces/2015/1_SL_7602014.pdf.
National Report: Czech Republic
137