PDPO can no longer fine public authorities and entities

The first of the mentioned cases involved the insufficient protection of personal data – in 2013 and 2014, the ministry provided access to its citizens’ register to Český rozhlas and Česká televize, public service radio and television companies. The ministry challenged the penalty in court, but the action was dismissed. In its judgment, the Supreme Administrative Court stated that consistent and strict personal data protection and compliance with statutory duties must especially be demanded from governmental institutions.

Recently, the office detected another error on the part of the ministry involving access to data from citizens’ register, and imposed a penalty of 1.1 million Czech crowns. The ministry again appealed the decision, and this time was successful. In the appeal procedure, the office agreed with the conclusion that while the ministry was responsible for unlawfully giving access to personal data, the administrative sanction cannot be imposed, since the new Personal Data Protection Act has entered into effect.

The new law stipulates that the Personal Data Protection Office shall waive administrative sanctions in cases involving public authorities or public entities established in the given member state. Czech legislators have used the possibility provided by the GDPR to set different rules of whether and how far administrative sanctions shall be imposed on these entities.

The office has now lost the power to impose penalties for offences connected with personal data protection on public authorities and public entities, such as ministries, administrative authorities or cities and municipalities; however, the office still retains its power to impose remedy measures on these entities.