Czech RepublicAct No. 480/2004 on Certain Information Society Services, Section 7, Commercial Communications by Electronic Means
In force since .
A commercial messages rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Prohibition
As of .
What it requires
- Obtain the user's prior consent before you use the details of an electronic contact to spread commercial communications by electronic means, unless you obtained a customer's electronic mail contact details in connection with a sale and use them only for commercial communications about your own similar products or services.NIST Privacy FrameworkCT.PO-P1
- Give that customer a clear and distinct, simple and free chance to refuse the use of the contact details, in every single message where the customer did not refuse that use originally.NIST Privacy FrameworkCT.PO-P3
- Do not send electronic mail that spreads a commercial communication if it is not clearly marked as a commercial communication, hides the identity of the sender on whose behalf it is sent, or is sent without a valid address to which the recipient can directly and effectively send a request to stop further commercial messages.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text, as of . Also read by: Úřad pro ochranu osobních údajů (ÚOOÚ) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
The Office for Personal Data Protection (Úřad pro ochranu osobních údajů), which Section 10(1)(a) names as the supervisory authority for the spreading of commercial communications under Section 7.
Settledness
- As of
- Guidance link
- https://uoou.gov.cz/cinnost/obchodni-sdeleni/casto-kladene-otazky-k-zakonu-c-4802004-sb
- Guidance body
- Úřad pro ochranu osobních údajů (ÚOOÚ)
What this law does
Section 7(2) allows the details of an electronic contact to be used to spread commercial communications by electronic means only toward users who have given prior consent.
Under Section 7(3), a person who obtained a customer's electronic mail contact details in connection with the sale of a product or service may use them to spread commercial communications about its own similar products or services, provided that the customer has a clear and distinct, simple and free chance to refuse that use, including in every single message where the customer did not refuse that use originally.
Section 7(4) bans sending electronic mail to spread a commercial communication if it is not clearly marked as a commercial communication, if it hides the identity of the sender on whose behalf it is sent, or if it is sent without a valid address to which the recipient can directly and effectively send a request to stop further commercial messages. Under Section 10(1)(a), the Office for Personal Data Protection supervises the spreading of commercial communications under Section 7.
Act No. 214/2006 rewrote Section 7 of Act No. 480/2004 in this structure. Act No. 214/2006 took effect on .
When LexLint raises it
When your app profile says your app sends automated outreach.