BIICL, London, 15 February 2005 1

Data Protection in Data Protection in the Newthe New European European

Union Member StatesUnion Member StatesCzech RepublicCzech Republic Karel NeuwirtKarel Neuwirt

The Office for The Office for Personal Data Personal Data

ProtectionProtection

2BIICL, London, 15 February 2005

Historical Historical LandscapeLandscape

3BIICL, London, 15 February 2005

The Czech RepublicThe Czech Republic

10,2 million population10,2 million population 78 866 sq. km78 866 sq. km Borders with Germany, Poland, Borders with Germany, Poland,

Austria, SlovakiaAustria, Slovakia President (Vaclav Klaus)President (Vaclav Klaus) Two chambers’ ParliamentTwo chambers’ Parliament Government – Prime Minister Government – Prime Minister

StanislavStanislav GrossGross, , 16 16 MinistersMinisters

4BIICL, London, 15 February 2005

LegislationLegislation Czechoslovak Constitution (1920)Czechoslovak Constitution (1920) Czech Constitution + Charter of Czech Constitution + Charter of

Fundamental Rights and FreedomsFundamental Rights and Freedoms (1993)(1993)

Specific laws (regulate PD processing in Specific laws (regulate PD processing in specific areas) specific areas)

Ratification of Human Rights Convention Ratification of Human Rights Convention Ratification of the Convention 108 (2001)Ratification of the Convention 108 (2001) Ratification of the Additional Protocol to Ratification of the Additional Protocol to

C108 (2003)C108 (2003)

5BIICL, London, 15 February 2005

Data protectionData protection

19921992 – – Act no.256 - on Protection of no.256 - on Protection of Personal Personal Data in Information Data in Information SystemsSystems

20002000 - - Act no.101 - on Personal Act no.101 - on Personal Data Data Protection Protection (adopted April (adopted April 4)4)

Harmonization with C108 and GeneralHarmonization with C108 and General EU Directive – positions of CoE and EC EU Directive – positions of CoE and EC

6BIICL, London, 15 February 2005

DP DP Act 1992Act 1992

First DP law in the CR (former First DP law in the CR (former Federal Czech and Slovak Federal Czech and Slovak Republic Law)Republic Law)

Not harmonized with Convention Not harmonized with Convention 108108

Especially – no sanctions, no Especially – no sanctions, no supervisionsupervision

Art.24 – expected supervision bodyArt.24 – expected supervision body

7BIICL, London, 15 February 2005

Convention No.Convention No.108108

The 1The 1stst legally binding international legally binding international data protection instrumentdata protection instrument

Ratification – Ratification – „old“„old“ EU countries + EU countries + Bulgaria,Bulgaria, Estonia, Hungary, Estonia, Hungary, Poland, RomaniaPoland, Romania, , Slovenia,Slovenia, Slovakia, Lithuania, Latvia, Slovakia, Lithuania, Latvia, MaltaMalta

Czech Republic – signature Sept. 8, Czech Republic – signature Sept. 8, 20002000

ratification July 9, 2001ratification July 9, 2001

entry into force Nov.1, entry into force Nov.1, 20012001

8BIICL, London, 15 February 2005

Additional ProtocolAdditional Protocol NNoo.. 181 181

Additional Protocol to the Convention Additional Protocol to the Convention 108 regarding supervisory authorities 108 regarding supervisory authorities and transborder data flowsand transborder data flowsETS no.181 – 8.11.2001ETS no.181 – 8.11.2001 (open for signature)(open for signature)

Signature – 28 countriesSignature – 28 countries Slovakia, Lithuania, Slovakia, Lithuania, Czech Republic Czech Republic (Apr.10, 2002),(Apr.10, 2002), Poland Poland

Ratification – 7 countriesRatification – 7 countries Slovakia, Slovakia, LithuaniaLithuania, , Czech Republic Czech Republic

(Sept.24, 2003)(Sept.24, 2003)

9BIICL, London, 15 February 2005

Czech DP activities in Czech DP activities in EuropeEurope

Council of EuropeCouncil of EuropeCJ-PD (till the end 2003)CJ-PD (till the end 2003)T-PD (1T-PD (1stst vice-chair since 2003) vice-chair since 2003)member of the CoE’s expert missions member of the CoE’s expert missions (Russia, Bosnia & Herzegovina, Cyprus)(Russia, Bosnia & Herzegovina, Cyprus)

EuropeanEuropean CommissionCommissionWP 29 WP 29

Committee 31, Joint Supervisory Bodies Committee 31, Joint Supervisory Bodies (vice-chair of JSB Europol, Berlin Group (vice-chair of JSB Europol, Berlin Group (DP in telecommunication)(DP in telecommunication)

OECDOECD

10BIICL, London, 15 February 2005

EU Directive EU Directive TranspositionTransposition

11BIICL, London, 15 February 2005

DP Act no.101 of 2000DP Act no.101 of 2000

Application of the LawApplication of the Law- Applies to any PD processing (unless Applies to any PD processing (unless

special law otherwise specifies)special law otherwise specifies)- Applies to both public and private Applies to both public and private

sectorssectors- Applies to automatic and non-Applies to automatic and non-

automatic processingautomatic processing- Exemptions (partly) for Third pillar Exemptions (partly) for Third pillar

processingprocessing

12BIICL, London, 15 February 2005

Competences of the Competences of the OfficeOffice

Act no. 101/2000 Coll., - Act no. 101/2000 Coll., - data data protectionprotection

Act no. 133/2000 Coll., - Act no. 133/2000 Coll., - birth date birth date certificatecertificate (identity number) (identity number)

Act no. 480/2004 Coll., - Act no. 480/2004 Coll., - unsolicited unsolicited messagesmessages

CR cooperate in combat “spam” – CR cooperate in combat “spam” – see:see:

European countries launch joint drive to combat European countries launch joint drive to combat “spam” EU Press release IP/05/146“spam” EU Press release IP/05/146

13BIICL, London, 15 February 2005

SupervisionSupervision

Independent supervisory bodyIndependent supervisory body – –

The Office for Personal Data The Office for Personal Data ProtectionProtection

Independence on the GovernmentIndependence on the Government Separate budget (independent on Separate budget (independent on

ministries)ministries) Tasks given by law only, not by the Tasks given by law only, not by the

Cabinet Cabinet

14BIICL, London, 15 February 2005

SanctionsSanctions

The Office competence to give The Office competence to give fines and sanctionsfines and sanctions

Fines up to EUR 312 000 (EUR 630 Fines up to EUR 312 000 (EUR 630 000 resp)000 resp)

Sanctions to natural person up to Sanctions to natural person up to EUR 1 500EUR 1 500

Chapter VII of the LawChapter VII of the Law

15BIICL, London, 15 February 2005

Amendment 2004Amendment 2004

Full harmonization with the Full harmonization with the General DirectiveGeneral Directive

Solve problem with:Solve problem with:

definitions, exemptions, forms definitions, exemptions, forms of consent,of consent,

transborder data flows, transborder data flows, notification to data subjectnotification to data subject

Biometric data as sensitive dataBiometric data as sensitive data

16BIICL, London, 15 February 2005

Harmonization issuesHarmonization issues

Processing of National identifierProcessing of National identifier is not is not regulate by DP Law (but by Law on regulate by DP Law (but by Law on Population register and Date of birth – Population register and Date of birth – Act no. 133/1999 Coll.)Act no. 133/1999 Coll.)

National identifier (Rodne cislo) is not National identifier (Rodne cislo) is not under regime of special categories of under regime of special categories of data – article 8 data – article 8

Codes of conduct (art.27)Codes of conduct (art.27) Notification – art.20(1) as problem (prior Notification – art.20(1) as problem (prior

examination)examination)

17BIICL, London, 15 February 2005

DPA DPA ApproachApproach

18BIICL, London, 15 February 2005

ActivitiesActivities

NotificationNotification

exemptions by DP law (low risks exemptions by DP law (low risks processing – small societies, processing – small societies, processing by special laws)processing by special laws)

21 700 controllers notified21 700 controllers notified

25 000 processing of data 25 000 processing of data (databases(databases))

19BIICL, London, 15 February 2005

LegislationLegislation

The Office is responsible for The Office is responsible for DP legislationDP legislation

- common DP law- common DP law

- special sectorial legislation : - special sectorial legislation : according legislative rules it is according legislative rules it is obligation to submit bills to obligation to submit bills to OPDP for comments OPDP for comments

20BIICL, London, 15 February 2005

Specific problemsSpecific problems

Application DP principles into Application DP principles into practicepractice

Conflicts with old legislationConflicts with old legislation Change meaningful of citizens, Change meaningful of citizens,

controllers, processors, low controllers, processors, low willingness change till today willingness change till today practicespractices

Historical “stones” Historical “stones”

21BIICL, London, 15 February 2005

Application DP principlesApplication DP principles

ConsultationsConsultations PopularizationPopularization Written answers to questionsWritten answers to questions Web sitesWeb sites Annual ReportAnnual Report

Position papers, opinions – Position papers, opinions – regularly issued; no regularly issued; no guidelines till nowguidelines till now

22BIICL, London, 15 February 2005

Mass mediaMass media

Contacts with mass mediaContacts with mass media - - 354 354 in 2004in 2004

agencies agencies

newspapersnewspapers

TVTV

BroadcastingBroadcasting

23BIICL, London, 15 February 2005

PublicationsPublications

The Office Official Journal (36 The Office Official Journal (36 issues)issues)

Bulletin (quarterly)Bulletin (quarterly) Articles in magazinesArticles in magazines Books (2)Books (2)

24BIICL, London, 15 February 2005

InquiriesInquiries

Year 2004 – Year 2004 – 6 539 inquiries6 539 inquiries

975 by e-mail 975 by e-mail

5 207 by phone5 207 by phone

357 by post 357 by post

Complaints Complaints 641 (incl. 306 for 641 (incl. 306 for unsolicited messages)unsolicited messages)

25BIICL, London, 15 February 2005

Changes aheadChanges ahead

26BIICL, London, 15 February 2005

DP and accession to EUDP and accession to EU

DP legislation – harmonized with DP legislation – harmonized with DirectiveDirective

EC Peer Review evaluationEC Peer Review evaluation Regular Reports on the CR progress Regular Reports on the CR progress

toward accession …toward accession … International Conference AccreditationInternational Conference Accreditation European DP Commissioners ConferenceEuropean DP Commissioners Conference EC Phare projects – co-operation with EC Phare projects – co-operation with

Spain (DP authority)Spain (DP authority)

27BIICL, London, 15 February 2005

ChangesChanges DP Act no.101 amended in 2004DP Act no.101 amended in 2004 Directive 2002/58/EC Directive 2002/58/EC

implemented by implemented by

- Act no. 480/2004 Coll., on some - Act no. 480/2004 Coll., on some services in the information society services in the information society ;;

- new law on electronic - new law on electronic communications (Bill in the communications (Bill in the Parliament)Parliament)

28BIICL, London, 15 February 2005

Changes Changes cont.cont.

Changes of special laws Changes of special laws (sectorial) – permanent task (sectorial) – permanent task

Need to change legislation on Need to change legislation on public registers public registers

Need to change medical law (on Need to change medical law (on care on people health)care on people health)

29BIICL, London, 15 February 2005

The rights of men must be held The rights of men must be held sacred,sacred,however much sacrifice it may however much sacrifice it may costcostthe ruling power.the ruling power.

Immanuel Immanuel KantKant

Perpetual Perpetual Peace, Peace,

17951795

30BIICL, London, 15 February 2005

ContactsContacts

• The Office for Personal Data The Office for Personal Data ProtectionProtection

Pplk. Sochora Pplk. Sochora 2277, CZ-1, CZ-1770 00 Prague 0 00 Prague 77

Czech RepublicCzech Republic

tel.: +420 2tel.: +420 234 665 44234 665 442

fax: +420 2fax: +420 234 665 51234 665 512

info@uoou.czinfo@uoou.cz

http://http://www.uoou.czwww.uoou.cz