The Czech Data Protection Act finally passed by the Parliament

Czech Republic

While the General Data Protection Regulation (“GDPR”) became directly effective almost a year ago, no Czech Data Protection Act (“DPA”) has been passed so far, making the Czech Republic one of the last countries in the EU to implement a DPA. The DPA is a national law through which a member state is able to derogate from certain GDPR provisions. A draft of the Czech DPA (“Draft”) has recently been approved by Parliament.

The Draft does not include as many derogations from the GDPR as some of its counterparts in other EU member states. Among the most business-relevant derogations is the age limit, from which a minor can independently but validly grant consent to the processing of his or her personal data. While the GDPR states that a person needs to be no younger than 16 to grant consent, the Draft states that anyone of 15 or older can do so. This is highly relevant for various business sectors, e.g. registration to social networks or any kind of registration associated with the sending out of newsletters etc.

Among other things, the Draft encompasses provisions regarding the Data Protection Office as well as the prohibition on imposing fines to public administration authorities. Inequality between public and private entities will thus be significant in this respect. Furthermore, journalists, artists and academics are subject to less regulation when it comes to obligations arising out of the GDPR (e.g. information obligation).

Along with the Draft, Parliament also approved a bill (“Bill”) amending certain other acts in connection with the adoption of the DPA. In particular, the Bill regulates the processing of personal data for the purposes of public interest.

The President shall sign the Draft and the Bill before the end of April and will come into force shortly afterwards when published in the collection of laws.