Personal Data Processing Act Adopted, Including New Rules on the Handling of Personal Identification Numbers
29. 03. 2019
Almost a year after the entry into force of the General Data Protection Regulation (GDPR), the Parliament of the Czech Republic succeeded in adopting related adaptation legislation, namely the Personal Data Processing Act and the accompanying Amending Law to make partial changes to other legal regulations. The new Act in some aspects complements and slightly modifies the European rules and "settles" the General Regulation in the domestic legal order.
At this time, both pieces of legislation are awaiting the signature of the President of the Republic. If the President signs, they will come into effect on the day of publication in the Collection of Laws.
In addition to covering questions related to the role of the Office for Personal Data Protection and its powers in the context of the General Regulation, and questions related to processing of personal data exclusive of cases not covered by the Regulation (e.g. detection and investigation of crime, etc.), the Personal Data Processing Act complements the General Regulation in several aspects. For example: (a) it sets the age of a child in relation to the information society services to 15 years of age; (b) it specifies exemptions from the obligation to carry out the purpose compatibility test; (c) it defines exemptions from the obligation to assess the impact on the protection of personal data or the obligation to inform the data subject of the processing of personal data; and (d) it sets forth specific conditions for appointing a data protection officer, etc.
Furthermore, the accompanying law brings about a number of partial changes to many laws and regulations. Out of the many changes, it seems appropriate to mention a positive and needed change in the legislation covering personal identification numbers.
The hitherto rules limit access to and handling of personal identification numbers to (a) processing by ministries, other administrative authorities and, in general, to public administration (land records, health insurance policy holders registries, etc.); (b) to cases prescribed by law (employers are obliged to register employees in the sickness insurance system using their personal identification numbers, etc.); and (c) to cases when the personal identification number holder or their legal guardian have given their consent. Subject to the principle of necessity (it is not possible to give such consent where the personal identification number is not necessary for the purpose pursued), the consent must comply with the requirements set out in the data protection regulations.
In other words and in short, according to the existing legislation it is not possible, for example, to collect and further process personal identification numbers of debtors for the purpose of debt collection.
The accompanying law will change that paradigm in as much as it will make it possible to process personal identification numbers if it is necessary for the enforcement of private claims or to prevent the emergence of non-performing debt, that is to say in the case described above, under the condition that specific measures be adopted to protect the rights and freedoms of personal identification number holders. Such measures include, for example: (a) technical and organizational measures for the protection of personal data within the meaning of the General Regulation; (b) verification of the identity of the person accessing personal identification numbers and record-keeping of any access, insertion, alteration, etc.; (c) informing the persons concerned on the processing of their personal identification numbers, or (d) ensuring confidentiality of information.
When the Personal Data Processing Act and the accompanying Amending Law come into effect, the basic legal framework for the new legislation on personal data protection will be complete. It is therefore time to complete also the implementation of the General Regulation, i.e. inter alia and in the light of the content of the Personal Data Processing Act and the recently issued methodological guideline of the Office for Personal Data Protection, to carry out data protection impact assessment or to compile records of processing activities. Those who have been holding off, unconcerned about the protection of personal data despite the intensive media coverage should get to work, because the Office for Personal Data Protection will acquire (this late and at last) the possibility to impose sanctions for violations of the General Data Protection Regulation.Autor: JUDr. Jakub Morávek, Ph.D.
- Grace Period for Work Incapacity Abolished as of July 2019 (01. 03. 2019)
- Amended Trademark Law takes effect as of January 2019 (13. 02. 2019)
- Recording of beneficiary owners (26. 10. 2018)
- Laws and regulations in the pipeline businesses should watch out for towards the end of the year (13. 09. 2018)
- Amendment to the Public Procurement Act (30. 01. 2018)
- Vehicle transfer - registration (29. 01. 2018)
- Amendment to the act on special health-care services (31. 12. 2017)
- Labor code amendment (18. 12. 2017)
- Amendment of the employment act (14. 12. 2017)
- Amendment of the Labor Inspection Act (08. 12. 2017)
- The New Responsibility of Legal Persons to Disclose their Beneficiary Owner (21. 09. 2017)
- Amendment to the Building Act and Societies for the Protection of Nature and the Landscape (25. 08. 2017)
- Timely Preparation for the New Version of Personal Data Protection Regulation (30. 06. 2017)
- Prior Medical Instructions in Medical Law (13. 06. 2017)
- Copyright Act Amended (13. 04. 2017)
- The Insolvency Act Extensively Amended (07. 04. 2017)
- The Act on the Origin of Assets (30. 03. 2017)
- A New Legal Framework for the Protection of Personal Data (14. 11. 2016)
- The 2017 Minimum Wage (10. 11. 2016)
- CORPORATE CRIMINAL LIABILITY ACT AMENDED (14. 10. 2016)
- „RECAST“ OF THE LABOR CODE (05. 09. 2016)
- THE CZECH BAR ASSOCIATION CHARGED WITH ALTERNATIVE DISPUTE RESOLUTION (ADR) (05. 02. 2016)
- Consumer Protection Act Amended (25. 01. 2016)
- Travel Claims (01. 12. 2015)
- Entries to public registries recordable directly by notaries (03. 09. 2015)
- Code of Civil Procedure and Enforcement Rules Amended: more protection of the unencumbered spouse (02. 08. 2015)
- Notification of tax-exempt income - a new duty when filing individual income tax return (01. 06. 2015)
- Amendment to the Public Procurement Act (15. 05. 2015)
- HEALTH SERVICES AND HEALTHCARE IN THE LIGHT OF THE PRIVATE LAW RECAST – TWO-TRACK LEGISLATION (11. 03. 2015)
- Contract of Inheritance among Novelties in the Law of Succession (21. 01. 2015)
- Mandatory Electronic Communication with the Tax Administrator (19. 01. 2015)
- Topical Issue: Energy Performance of Buildings Certificate (03. 12. 2014)
- POSSIBILITY TO REGISTER MACHINES IN THE LAND REGISTRY, SO-CALLED RESERVATION FOR MACHINES (30. 05. 2014)
- NEW DUTY TO PUBLISH DATA ON THE INTERNET (28. 04. 2014)
- Beware of pre-contractual liability (31. 03. 2014)
- ARTICLES OF ASSOCIATION OF COMPANIES UNDER THE ACT ON CORPORATIONS (20. 02. 2014)
- CONTRACT ON PERFORMANCE OF DIRECTORSHIP AND CONCURRENCE OF OFFICES AFTER CIVIL CODE RECAST (19. 02. 2014)
- Private Law Recast and the Labor Code (11. 02. 2014)
- Compensation of Wage or Salary during Sick Leave as of January 1, 2014 (28. 11. 2013)
- Legislation Accompanying the New Civil Code (29. 10. 2013)
- New Civil Code (02. 09. 2013)