110

ACT

of 12 March 2019

about the processing of personal data

Parliament has agreed on the following act of the Czech Republic:

PART FIRST

PERSONAL DATA PROCESSING

TITLE I

BASIC PROVISIONS

§ 1

Subject matter

This Act incorporates the relevant European Union ¹) regulations, while building on the directly applicable European Union ²) regulation, and regulates the rights and obligations in the processing of personal data to fulfil everyone's right to privacy.

§ 2

Scope of the Act

This Act provides for

a) the processing of personal data pursuant to Regulation (EU) 2016/679 ²),

b) the processing of personal data by the competent authorities for the purpose of preventing, searching for or detecting crime, prosecuting criminal offences, executing penalties and protective measures, ensuring the security of the Czech Republic or ensuring public order and internal security, including the search for persons and things,

c) processing of personal data in the course of ensuring the defence and security interests of the Czech Republic,

d) other processing of personal data which are to be or are included in the register or the processing of which is carried out wholly or partly by automated means, unless the processing of personal data by a natural person is in the course of exclusively personal or domestic activities, and

e) the position and powers of the Data Protection Authority (the "Authority").

§ 3

Data Subject

Data subject means the natural person to whom the personal data relates.

TITLE II

PERSONAL DATA PROCESSING UNDER DIRECTLY APPLICABLE EUROPEAN UNION REGULATION

Volume 1

General provisions

§ 4

Scope

(1) The provisions of this Title shall apply to the processing of personal data under Regulation (EU) 2016/679.

(2) The provisions of this title and Regulation (EU) 2016/679 shall also apply to the processing of personal data, which are intended to be or are included in a register, and in the processing of personal data which is wholly or partly automated, unless the processing of personal data is carried out by a natural person in the course of exclusively personal or domestic activities,

a) in the performance of activities which do not fall within the scope of European Union law or Title III or IV, or

b) in the exercise of activities which fall within the scope of Title V, Chapter 2 of the Treaty on European Union.

§ 5

Authorisation to process personal data in the performance of a legal obligation or in the exercise of powers

The controller is authorised to process personal data where necessary for the performance of

a) obligation imposed on the controller by law, or

b) a task carried out in the public interest or in the exercise of public authority which the controller is entrusted with.

§ 6

Exception to the requirement to assess compatibility of purposes

(1) Unless otherwise provided by another legal provision, the controller is not required, in pursuit of a protected interest, to assess the compatibility of those purposes before processing personal data for a purpose other than that for which they were collected, if that processing is necessary and proportionate to fulfil

a) obligation imposed on the controller, or

b) a task carried out in the public interest, provided for by law or in the exercise of official authority vested in the controller.

(2) A protected interest under paragraph 1 means

a) the defence or security interests of the Czech Republic,

b) public order and internal security, the prevention, search or detection of crime, the prosecution of criminal offences, the execution of penalties and protective measures, the safeguarding of the security of the Czech Republic or the safeguarding of public order and internal security, including the search for persons and things,

c) other important objective of public interest of the European Union or a Member State of the European Union, in particular an important economic or financial interest of the European Union or a Member State of the European Union, including monetary, monetary, budgetary, tax and financial market, public health or social security matters,

d) protection of the independence of the courts and judges,

e) preventing, detecting, detecting, or prosecuting ethical violations in regulated professions,

f) supervisory, controlling, or regulatory functions related to the exercise of public authority in the cases listed in paragraphs (a)(a)-(e),

g) the protection of the rights and freedoms of persons, or

h) the enforcement of private law claims.

§ 7

Child's capacity to consent to processing of personal data

A child acquires the capacity to consent to the processing of personal data in connection with the offer of information society services directly upon reaching the age of fifteen.

§ ...