Cookies and marketing calls only with prior consent
From 1 January 2022, an amendment to the Electronic Communications Act will allow obtaining and processing cookies only with provable user consent. The requirement to obtain consent will not apply to technical cookies. Similarly, it will be possible to contact the public by phone for marketing purposes only with the prior consent of the persons concerned.
Cookies
Czech legislation on cookies (short text files that the visited websites save in the end device and that are then sent back to the websites when visited again, making it possible to keep track of the users' visits and behaviour on the web) is currently based on the opt-out principle, i.e. cookies can be obtained and processed without user consent until the user refuses this. This approach, however, is (and has been for several years) contrary to EU directives, which are based on the opposite, i.e. the opt-in principle, which allows cookies to be obtained and processed only with the user’s explicit consent.
The current amendment to the Electronic Communications Act introduces the opt-in principle for cookies. Under the amendment, it will no longer suffice for e-shop and website operators to just inform the user of the processing of cookies and give them the possibility to refuse it. Now, they will have to obtain provable consent from the users as to the extent and purpose of processing cookies. Consent will not have to be obtained for technical cookies. In the context of the GDPR (in particular the obligation to inform pursuant to Art. 13 and Art. 14, and the requirement of voluntary and informed consent) operators’ obligation to inform users of processing cookies should continue to apply, even though it has been left out from the wording of the amendment, probably due to redundancy.
The requirement of consent to the processing of cookies will not be fulfilled if e-shop or website operators obtain the consent using ’cookie walls’, i.e. a setup that prevents access to the website or use of certain functions without consenting to cookies. The reason is that consent thus obtained (a rather common practice) cannot be considered voluntary. Similarly, the GDPR requirement that consent must be given by a specific indication of the individual’s wishes shall not have been met if the box indicating the consent has already been pre-filled by the website or e-shop. Instead, any processing of cookies based on consent thus obtained will be contrary to the law.
Telemarketing
The amendment will also have a fundamental effect on call centre operators. Under the new rules, if the user of a particular phone number does not explicitly give consent to telemarketing, it means that they do not wish to be contacted by the call centre for marketing purposes. If this provision is breached, entrepreneurs may be facing a penalty up to the higher of CZK 50 million and 10% of their net turnover for the last completed accounting period.
The amendment will already enter into effect on 1 January 2022. We therefore recommend that you verify as soon as possible what types of cookies you process, to what extent, and whether you properly inform the user of their processing. If you process non-technical cookies without asking for user consent to the processing, you should reset the way the cookies are processed so that they are obtained and processed only with the consent of the users of your website. The approach to telemarketing calls will also have to be reviewed. In view of the above, we also recommend carrying out an overall review of the personal data protection policy to ensure it complies with the requirements of the amendment to the Electronic Communications Act, and those of the GDPR.