Czech RepublicAct on Personal Data Processing
Zakon c. 110/2019 Sb., o zpracovani osobnich udaju
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in the Czech Republic.
These lines are LexLint's reading of the law's text. Also read by: Úřad pro ochranu osobních údajů (Office for Personal Data Protection, Czech Republic) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://uoou.gov.cz/verejnost/zakladni-prirucka-k-ochrane-udaju
- Guidance body
- Úřad pro ochranu osobních údajů (Office for Personal Data Protection, Czech Republic)
- Open questions
- Does the age of 15 for a child's consent in Section 7 of Act No. 110/2019 Sb. apply to an information society service offered directly to a child in the Czech Republic by a provider established in another Member State?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record
Log retention
The logs are kept for 3 years from the erasure of the personal data they relate to. Documentation of each breach under Section 41(6) is kept for at least 3 years.
- Unit
- Years
- As of
- Basis
- Fixed
- Maximum value
- 3
- Minimum value
- 3
Logging duty
An authority processing personal data by automated means under Title III logs at least collection, entering, alteration, combining, consultation, transfer, disclosure and erasure. The logs of collection, entering, consultation and disclosure must show the reason and time of the operation, who performed it and who received the data, unless that cannot be established for technical reasons, and may be used only for criminal proceedings, checking lawfulness, data security and the authority's and users' duties. Section 32(3) and (4) add documentation of the technical and organizational measures and written overviews of typical processing activities, and Section 41(6) documentation of every breach, kept for at least 3 years. These duties bind authorities under Title III; Title II, which applies the GDPR, has its own Section 16 listing logging among optional research safeguards.
- Kind
- Explicit
- As of
- Provision
- Act No. 110/2019 Sb., Section 36 (automated logging by an authority processing for law-enforcement purposes), with Section 32(3) and (4) and Section 41(6)
- Trigger
- personal_data_processing
What this law does
The Czech Republic gives the General Data Protection Regulation (GDPR) domestic effect through Act No. 110/2019 Coll., in force since , replacing the pre-GDPR Act No. 101/2000 Coll. It is predominantly procedural: it establishes the supervisory authority's powers, administrative-offense and fine procedures, and processing by competent authorities for criminal-law purposes transposing Directive (EU) 2016/680.
Section 7 of the Act sets the age at which a child acquires the capacity to consent to the processing of personal data in connection with an offer of information society services made directly to them at 15.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .