Sb.), and upon the general civil law liability for damage or harm (Act No. 89/2012
Sb.)
No fines or other direct sanctions are available for breaches of obligations that fall
outside the scope of jurisdiction of the Czech DPA, i.e. when personal data are
processed for security and defence purposes or in cases when data are processed for
exercise of juridical powers. However, subsequent sanctions are available in these
cases against responsible staff upon general disciplinary liability. Also, there still
applies the liability for illegal acting of a public body and there is available
respective court claim under the rules of administrative court procedure.
In addition to above administrative sanctions and remedies for recovery of
damage or harm, serious misuse of personal data might be subject to criminal law
sanctions. The Czech Criminal Code (Act No. 40/2009 Sb.) uses specific type of
criminal conduct indicated as ‘Unauthorised Use of Personal Data’ and laid down in
Section 180 (informal translation):
§ 180 Unauthorised Use of Personal Data
(1) Whoever, even out of negligence, publishes, discloses, makes available, or otherwise
processes or appropriates personal data that was collected on another person in connection with the execution of public authority without authorisation, and thus causes serious
harm to the rights or legitimate interests of the person whom the personal data concerns,
shall be punished by a prison sentence of up to three years or punishment by
disqualification.
(2) Whoever, even out of negligence, violates the State imposed or recognised obligation of
confidentiality by publishing, disclosing, making available, or otherwise processing or
appropriating personal data that was collected on another person in connection with the
execution of their employment, profession, or function without authorisation, and thus
causes serious harm to the rights or legitimate interests of the person whom the personal
data concerns, shall be similarly punished.
(3) An offender shall be punished by a prison sentence of one to five years, monetary
penalty, or punishment by disqualification, if,
a) they committed an act referred to in Subsection 1 or 2 as a member of an organised
group,
b) they committed such act by the press, film, radio, television, publicly accessible
computer networks, or other similarly effective means,
c) they caused substantial damage by committing such an act, or
d) they committed such an act with the intention of gaining a substantial benefit for
themselves or someone else.
(4) An offender shall be punished by a prison sentence of three to eight years, if,
a) they caused large-scale damage by committing an act referred to in Subsection 1 or
2, or
b) they committed such an act with the intention to procure another large-scale benefit
for themselves or someone else.
National Report: Czech Republic
153
Sb.)
No fines or other direct sanctions are available for breaches of obligations that fall
outside the scope of jurisdiction of the Czech DPA, i.e. when personal data are
processed for security and defence purposes or in cases when data are processed for
exercise of juridical powers. However, subsequent sanctions are available in these
cases against responsible staff upon general disciplinary liability. Also, there still
applies the liability for illegal acting of a public body and there is available
respective court claim under the rules of administrative court procedure.
In addition to above administrative sanctions and remedies for recovery of
damage or harm, serious misuse of personal data might be subject to criminal law
sanctions. The Czech Criminal Code (Act No. 40/2009 Sb.) uses specific type of
criminal conduct indicated as ‘Unauthorised Use of Personal Data’ and laid down in
Section 180 (informal translation):
§ 180 Unauthorised Use of Personal Data
(1) Whoever, even out of negligence, publishes, discloses, makes available, or otherwise
processes or appropriates personal data that was collected on another person in connection with the execution of public authority without authorisation, and thus causes serious
harm to the rights or legitimate interests of the person whom the personal data concerns,
shall be punished by a prison sentence of up to three years or punishment by
disqualification.
(2) Whoever, even out of negligence, violates the State imposed or recognised obligation of
confidentiality by publishing, disclosing, making available, or otherwise processing or
appropriating personal data that was collected on another person in connection with the
execution of their employment, profession, or function without authorisation, and thus
causes serious harm to the rights or legitimate interests of the person whom the personal
data concerns, shall be similarly punished.
(3) An offender shall be punished by a prison sentence of one to five years, monetary
penalty, or punishment by disqualification, if,
a) they committed an act referred to in Subsection 1 or 2 as a member of an organised
group,
b) they committed such act by the press, film, radio, television, publicly accessible
computer networks, or other similarly effective means,
c) they caused substantial damage by committing such an act, or
d) they committed such an act with the intention of gaining a substantial benefit for
themselves or someone else.
(4) An offender shall be punished by a prison sentence of three to eight years, if,
a) they caused large-scale damage by committing an act referred to in Subsection 1 or
2, or
b) they committed such an act with the intention to procure another large-scale benefit
for themselves or someone else.
National Report: Czech Republic
153