Deputies pass GDPR-adapting act
In December of last year, the Chamber of Deputies passed a long-awaited bill on personal data processing, designed to replace the existing Act on Personal Data Protection. Its adoption follows the new rules set out in the EU General Data Protection Regulation (GDPR). Even though the GDPR is directly applicable in the EU member states and an implementing regulation is not therefore necessary, the member states may deviate from the wording of the GDPR in some aspects. This is what Czech lawmakers are indeed planning to do.
The bill primarily affects the public sector, but also determines certain deviations and clarifications for the private sector. It regulates, for example, personal data processing conditions for journalists who, under certain circumstances, will not have to inform about personal data processing (such as the taking of pictures of someone with the intention to publish them) especially when the provision of such information is not feasible or would require unreasonable effort. This may typically involve the filming of participants of a public gathering or demonstration. The bill also allows journalists to postpone their information duties for a necessary period of time. According to the relevant explanatory report, the bill aims to allow filming with a hidden camera or making news stories undercover or under a false identity.
Journalists will also be authorised to process sensitive personal data revealing, for example, racial or ethnic origins, political views, religious and philosophic beliefs where such processing is necessary to achieve the justified goal and when the justified interest in personal data processing prevails over the justified interest of data subjects concerned.
A large number of motions to amend this bill were submitted during the legislative process; some of them were passed and some dismissed. For example, deputies rejected a proposal to reduce the age limit to 13 years to be able to give consent with personal data processing in connection with an offer of services by search engine providers, e.g., to use social networks independently. The age limit of 15 years, proposed originally and corresponding to the age limit for criminal liability, thus remains applicable.
The bill also regulates the competencies and organisation scheme of the Personal Data Protection Office, which is to become, inter alia, a review administrative body dealing with instances when liable persons do not comply with requests pursuant to the Act on Free Access to Information or the Act on the Right to Environment Information.
The bill is now heading to the Senate where other amending proposals are to be expected.