UOOU Enforcement, GDPR Article 82, and the Act on Collective Civil Court Proceeding

Criminal exposureYes

Private right of actionYes

Criminal exposure note

Criminal Code (trestni zakonik, Act 40/2009 Sb.) Section 180, Unauthorised Handling of Personal Data, sits outside the Act 110/2019 Sb. administrative-offence (prestupek) scheme entirely: it is a true criminal offence, prosecuted in the ordinary criminal courts. Paragraph 1 covers, even through mere negligence, unlawfully publishing, communicating, making accessible, otherwise processing, or appropriating personal data collected about another person in connection with the exercise of public power, causing serious harm to that person's rights or legitimate interests, punishable by up to 3 years' imprisonment or a prohibition on activity. Paragraph 2 applies the same penalty to breaching a state-imposed or state-recognised confidentiality duty by unlawfully disclosing personal data obtained through one's profession, employment, or function, again causing serious harm; this paragraph is not limited to the public-power context and can reach a private-sector employee bound by such a duty. Paragraph 3 raises the penalty to 1 to 5 years' imprisonment or an activity ban for aggravating circumstances (an organised group, commission through the press, film, broadcast or a publicly accessible computer network, causing considerable damage, or acting with intent to gain a considerable benefit), and paragraph 4 raises it further to 3 to 8 years' imprisonment for large-scale damage or an intent to gain a large-scale benefit.

Penalty structure

GDPR Article 83(5) sets the higher administrative-fine tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, applied directly by the Office for Personal Data Protection (Urad pro ochranu osobnich udaju, UOOU) without restatement in Czech law, since the GDPR is directly applicable. Section 63 of Act 110/2019 Sb. separately sets a fine of up to CZK 10,000,000 (roughly EUR 400,000) for offences under the Act's Title III on processing for the prevention, detection and prosecution of crime, which bind the managing authority (spravujici organ) rather than a private-sector controller. Section 61(2) of the same Act separately lets the Office fine any natural or legal person up to CZK 1,000,000 (CZK 5,000,000 where the offence is committed by press, film, radio, television or a publicly accessible computer network) for publishing personal data in breach of a publication ban set by another law. Sections 61(3) and 62(5) each say that the UOOU refrains ("Urad upusti") from imposing an administrative penalty on the controllers and processors covered by GDPR Article 83(7) (the Member State public-body derogation), so for those bodies the exemption is automatic; Section 62(4) alone leaves the Office discretion ("muze upustit"), where it imposes a measure under Section 54(1)(e) or Section 60. Act 179/2024 Sb. (implementing EU Directive 2020/1828 on representative actions) separately gives a legal person entered on the list of qualified entities under the consumer protection act a collective-action procedure for a group (Section 8(1)); it does not mention the GDPR and creates no liquidated or per-person damages figure of its own.

Rule

Higher of

As of

2 September 2026

Currency

EUR

Fixed cap

20,000,000

Turnover percentage cap

4

Enforcement body

Office for Personal Data Protection (Urad pro ochranu osobnich udaju, UOOU), the Czech Republic's GDPR supervisory authority, which adjudicates the administrative offences (prestupky) created by Act 110/2019 Sb.

Settledness

As of

12 October 2026

Case link

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0300

Case citation

Case C-300/21 UI v Osterreichische Post AG, judgment of the Court of Justice of 4 May 2023 (Third Chamber)

Open questions

Does Section 4 of Act No. 179/2024 Coll., which confines collective proceedings to disputes between consumers and a business, reach an Article 82 claim of a data subject who is not a consumer of the controller?

How the hook was established

express

What makes it apply

Operator establishment, Market targeting, User location, Place of effect

Obligation class

Governance

Applicability criteria

As of

30 October 2026

Combinator

Any of

Criteria

• the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not
• the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union
• the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to the monitoring of their behaviour as far as their behaviour takes place within the Union

Logging duty

Article 82 gives a right to compensation and Section 62(1) of Act No. 110/2019 Sb. defines the administrative offenses for infringing the GDPR; Act No. 179/2024 Sb. governs collective proceedings. None states a duty to create, keep or produce a log or record. The GDPR record duties sit in Article 30 and Article 33(5), outside the articles this entry cites.

Kind

None

As of

12 October 2026