Czech RepublicGDPR Article 22, Automated Decisions in the Czech Republic
Regulation (EU) 2016/679, Art. 22; Zákon č. 110/2019 Sb., § 11
In force since .
A data subject rights rule binding public and private bodies.
As of .
What it requires
- Give a person in the Czech Republic a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.
- You may apply this right in the Czech Republic proportionately, or postpone giving effect to it, where necessary and proportionate to protect an interest Section 6(2) lists, and must then notify the Office for Personal Data Protection without undue delay, under Act No. 110/2019 Sb. Section 11.
What this law does
General Data Protection Regulation (GDPR) Article 22 gives a person in the Czech Republic the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.
Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision. Section 11 of Act No. 110/2019 Sb. reaches this right too, allowing proportionate application or postponement to protect a listed interest, with notice to the Office for Personal Data Protection. The Act's own automated-decision provision (§ 39) applies only to competent authorities processing for law-enforcement purposes.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.