Slovakia

Section 132(4) defines child pornography, for the purposes of the Trestny zakon, as a depiction of real or simulated sexual intercourse, another form of sexual contact, or similar sexual activity with a child or a person appearing to be a child, or a depiction of the exposed body parts of a child or a person appearing to be a child for sexual purposes.

Because that definition reaches a simulated depiction and a person merely appearing to be a child, it covers a computer-generated or otherwise AI-produced image regardless of whether any real child was involved. Section 368 punishes producing child pornography or a child-pornographic performance with imprisonment of four to ten years, rising to seven to twelve years, ten to fifteen years, or twelve to twenty years for aggravated forms.

Section 369 punishes reproducing, transporting, procuring, making accessible, or otherwise distributing child pornography with imprisonment of one to five years, rising to three to eight years, four to ten years, or seven to twelve years for aggravated forms. Section 370 punishes possessing child pornography, or acting with intent to access it through an electronic communication service, with imprisonment of up to two years.

A controller must notify the Office for Personal Data Protection of the Slovak Republic within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. CMS's commentary states there are no derogations from the General Data Protection Regulation (GDPR) for this dimension in Slovakia; no primary text was read.

Slovakia gives the General Data Protection Regulation (GDPR) domestic effect through Act No. 18/2018 Coll. on the Protection of Personal Data, effective 25 May 2018. The Act's own text has not been located at primary source. Every finding below rests on two commentary sources (CMS's expert guide and DLA Piper's Data Protection Laws of the World) rather than a primary-source read, and should be treated as unconfirmed until someone reads the Act directly.

A transfer of personal data outside the EEA requires an adequacy decision, appropriate safeguards, or a narrow Article 49 derogation, backed by the Article 83(5)(c) top fine tier. DLA Piper's commentary confirms no further Slovak derogation, describing free movement of personal data between Slovakia and other EU member states; no primary text was read.

General Data Protection Regulation (GDPR) Articles 12-22 apply directly. No Slovak-specific derogation was found in either commentary source consulted, but this was not exhaustively checked article by article and no primary text was read.

Urad na ochranu osobnych udajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic) is the supervisory authority, confirmed by both commentary sources; fine amounts and detailed procedure were not independently checked beyond the General Data Protection Regulation (GDPR) baseline.

GDPR Article 82 arms an individual with a direct private right of action; DLA Piper states Slovak private rights of action derive from Article 82 without further elaboration, and no Slovak transposition of the EU Representative Actions Directive was found or ruled out.

General Data Protection Regulation (GDPR) Article 9(1) treats biometric data processed for unique identification as a special category. Commentary (CMS) quotes the Act as permitting biometric, genetic, and health data processing on the basis of a special regulation or an international agreement, a general enabling clause rather than a substantive biometric-specific carve-out; no employment-biometric consent or works-council rule was found in either commentary source.

A separate, more specific commentary-sourced finding, Section 78, protects the Slovak birth number (rodne cislo): explicit consent is required to process it, and public disclosure is prohibited unless the data subject discloses it themself. None of this is independently verified against the Act's own text.

No commencement date is recorded for this instrument: no primary-source text was read and this rests entirely on commentary, so the status here is enacted rather than in force, rather than an asserted but unconfirmed effective date.

Section 247 punishes a person who overcomes a security measure and thereby obtains unauthorized access to a computer system or part of it with imprisonment of up to two years, rising to six months to three years where the act is committed in a more serious manner or causes significant damage, and to one to five years where it causes large-scale damage or is committed as a member of a dangerous grouping.

Because the offence's trigger is overcoming a security measure, reading a public, unauthenticated page without defeating any access control has not itself been held to violate this section.

Section 247a punishes unauthorized interference with a computer system's operation, section 247b unauthorized interference with computer data, section 247c unauthorized interception of non-public computer-data transmissions, and section 247d the production, import, or sale of a device, password, or access code created for unauthorized access to a computer system, each with its own escalating tiers running from six months up to eight years for the most serious forms.

Section 51b, inserted by Act No. 71/2022 Coll. transposing Article 3 of the EU Digital Single Market Copyright Directive, lets a library, archive, museum, school, or statutory depositary reproduce a lawfully accessible work for text-and-data-mining for research purposes without the author's consent, with no rightsholder opt-out, and lets the reproduction be retained for verifying the research results.

Section 51c, transposing Article 4 of the same Directive, gives any person a general text-and-data-mining exception, defeated where the rightsholder has expressly reserved that use; a reproduction made under it may be kept only as long as needed for the mining. Section 51b(2) defines data mining, for the purposes of the Act, as any automated analytical technique aimed at analysing data in digital form to obtain patterns, trends, correlations, or similar results.

Section 17 requires a person the sector annexes reach, including a central state-administration body and a digital provider named at Section 2(2) (DNS, domain-name registration, cloud computing, data centre, content delivery network, managed service, security service, online marketplace, online search engine or social-networking-services platform), to register as an essential-service operator (prevádzkovateľ základnej služby); a person meeting at least the medium-enterprise size threshold in an Annex 1 or Annex 2 sector registers under Section 17(1)(e).

Section 19(1) then requires the operator to adopt, maintain and carry out general security measures, within 12 months of registration and graded by its own risk analysis, covering at minimum the 18 domains Section 20(2) lists (security governance, vulnerability and threat management, asset and risk management, incident handling, business continuity and backup, secure development and acquisition, compliance monitoring, cryptography, human-resources security, identity and access management, network operations security, malware and unwanted-content protection, system, network and communications security, event logging and monitoring, physical and endpoint security, records and privacy protection, supply-chain security, and the use of certified ICT products, services and processes), and Section 19(6)(h) requires the operator to build an effective mechanism for promptly informing its statutory body and responsible senior staff about cyber threats, incidents, near-misses and risk-treatment status.

Section 18 defines a "critical basic service" (kritická základná služba) to include the exercise of a central state-administration body's functions.

It also includes, broadly, a large enterprise (above the medium-enterprise threshold) active in an Annex 1 sector other than public administration, and separately a qualified trust service, a top-level domain (TLD) registry, a DNS service, or an at-least-medium-sized public electronic communications network or service; an operator with this status must itself report it to the Authority, and it draws a higher administrative-penalty tier for the same duties.

The Act transposes NIS2 Article 21 without adopting NIS2's own "essential entity"/"important entity" labels; the National Security Authority's implementing Vyhláška (Decree) on security measures, referenced at Section 20(3), specifies the manner and scope in which these measures are carried out.

Section 24(1) requires an essential-service operator to report every significant cyber security incident (závažný kybernetický bezpečnostný incident), defined at (2) as a large-scale incident, or one that has caused or may cause serious disruption to the operator or large-scale damage or lost profit, or that has affected or may affect others with significant harm.

Section 24(3) sets the graduated clock NIS2 Article 23 requires, beginning with an early warning reported without undue delay and no later than 24 hours from detection. No later than 72 hours from detection, the operator must report a notification updating that early warning with an initial severity and impact assessment, and must report further updates on the CSIRT unit's request.

A final report is due no later than one month after that 72-hour notification, and, where a cross-border-impact incident is still ongoing at that point, an updated final report is due within 30 days of restoring normal network operation or, if it is still unresolved then, within 30 days of its eventual resolution.

Section 24(5) extends the same reporting channel to a significant cyber threat the operator becomes aware of, a near-miss event that could have caused a significant incident, and a vulnerability in the operator's own publicly available networks or systems that it could not remediate or mitigate in reasonable time.

Section 24(8) lets an operator that is a financial entity under the EU Digital Operational Resilience Regulation (Regulation (EU) 2022/2554) satisfy this duty instead by reporting a major ICT-related incident through DORA's own competent-authority channel.

Separately, Section 5(5) gives the Authority, acting through its national CSIRT unit, a coordinator role for communication about a discovered or reported vulnerability among the essential-service operator, the manufacturer or supplier of the affected ICT product or ICT service, and other affected persons, a duty the Act places on the Authority rather than on the manufacturer directly.

Section 48(1)(a) requires a video-sharing platform provider to adopt appropriate measures to protect minors from programmes, user-created videos, and audiovisual commercial communications that may impair their physical, psychological, or moral development.

Section 49 lists measures the provider may take depending on the case, including embedding the protective rules in the platform's terms of use, a reporting and flagging mechanism for content covered by section 48, a complaints procedure, and media-literacy tools. Among those listed measures is a parental-control system controlled by the user. Section 49 also lists an age-verification system for users in relation to content that may impair minors' development.

Section 50 lets the regulator request data from the provider to assess whether its measures are suitable, and to request further information where the data supplied does not let the regulator make that assessment. Personal data collected under the parental-control or age-verification measures may not be processed for commercial purposes.

Section 129c(1) to (2), inserted by Act No. 71/2022 Coll. transposing Article 15 of the EU Digital Single Market Copyright Directive, gives a periodical's publisher the exclusive right to use the periodical and to authorise its use, so an information-society service provider may reproduce or make the periodical available online only with the publisher's consent unless the Act provides otherwise.

Section 129c(4) exempts an individual user's private, non-commercial use, hyperlinking, and the use of a headline, individual words, or a very short extract incapable of substituting for the whole periodical. Section 129d limits the right's duration to two years from the periodical's publication, ending on the last day of the calendar year in which that term lapses.

A transitional provision excludes any periodical first published before 6 June 2019 from section 129c. Section 129h requires the publisher to pay rightsholders whose works are included in the periodical an appropriate share of the remuneration it receives from licensing an information-society service provider, within six months of the right's expiry.

Section 51c, inserted by Act No. 71/2022 Coll. transposing Article 4 of the EU Digital Single Market Copyright Directive, does not require an author's consent to reproduce a work for text-and-data-mining, unless the rightsholder has expressly reserved that use. A reproduction made under the exception may be retained only for as long as the mining requires it.

Section 51b gives a library, archive, museum, school, or statutory depositary a separate, unconditional exception for text-and-data-mining carried out for research.