1. František Nonnemann Skopje, 10th October 2012 JHA 48785 Data protection and re-use of PSI as a tool for public control–CZ approach

2. Content of presentation Introduction Public sector information European legislation Czech legislation Special regime for processing of lawfully published personal data in Czech Republic Discussion 2

3. Introduction Public sector processes big number of information (PSI). Private sector could use them for different purposes – commercial aim, public control… Some categories of PSI has specific nature, like personal data, their processing must fulfill DP legislation. CZ has specific regulation for processing published personal data – inspiration? 3

4. Public sector information All information which are collected, produced, disseminated and processed in other ways by public sector. For example social, economic, geographical, weather, tourist, business, patent or educational information. 4

5. European legislation Directive 2003/98/EC on the re-use of public sector information. Definitions, general principles, not concrete regulation Proposal for ammendment to PSI-Directive, COM 2011/0877 final – 2011/0430 (COD). Extension of the scope, charges, formats of published documents etc. 5

6. Re-use and data protection Directive 2003/98/EC, Recital 21: This Directive should be implemented and applied in full compliance with the principles relating to the protection of personal data in accordance with Directive 1995/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and of the free movement of such data. 6

7. Re-use and data protection Directive 1995/46/EC, Recital 72: Whereas this Directive allows the principle of public access to official documents to be taken into account when implementing the principles set out in this Directive. 7

8. Re-use and data protection No specific regulation of data protection within the re-use of PSI. Problems: Legal title (Art. 7/f Directive 1995/46/EC?) Purpose limitation. Preservation period. Might be PSI – personal data re-used, under what conditions? Specific Czech approach. 8

9. Czech legislation PSI Directive is not transposed by one legal act. FoI Act – providing information on or without request, publishing of provided information. Several public databeses including personal data for free (re-)use: List of company registers, trade register, property declarations, annual reports of political parties, NGOs, companies… Cadastre – limited possibility of re-use. 9

10. Public and public Public database (web) vs. Publicly available information (somewhere). May be physically publicly available information transferred to web? CZ DPA: same purpose (public release), same term of use. 10

11. Lawfully published data Public and publicly available databases include a lot of personal data – about politicians, sponsors of political parties, public employees, bussinesmans etc. Collecting, storing, combining, using, publishing them – personal data processing. How they could be processed by DP Act? 11

12. Lawfully published data Czech DP Act has a special regime for processing of lawfully published data. Lawfully published personal data. Complex approach, solution of question about legal title, purpose limitation, information and notification obligation etc. 12

13. Legal title Art. 5/2/d DP Act: The controller may process personal data without the consent of data subject in relation to personal data that were lawfully published in accordance with special legislation. However, this shall not prejudice the right to the protection of private and personal life of the data subject. 13

14. Purpose limitation Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Controller (re-user) determines the purpose – (non)commercial re-use of PSI – on his own, he processes data for this specified purpose. 14

15. Information obligation Controller is obliged to inform data subject about several aspects of data processing. Art. 11/3/c DP Act: The controller shall not be obliged to provide the information in cases where the personal data were not obtained from the data subject, if he is processing exclusively lawfully published personal data. 15

16. Notification obligation Obligation to notify the intent of personal data processing to DPA. Art. 18/1/a: The notification obligation shall not apply to processing of personal data that are part of data files publicly accessible on the basis of a special Act. 16

17. Transfer to third countries Transfer of personal data to third countries is subject to DPA authorization. Art. 27/3/c DP Act: The transfer of personal data may be carried out if the controller proves that the personal data concerned are part of publicly accessible data files on the basis of a special Act. 17

18. Remaining obligations Some obligations remain: Data subject's right to access to information Data subject's right to correct inaccurate personal data. Controller obligation to secure processed personal data. Minimization of invasion of privacy – test of proportionality. 18

19. Summary of CZ regulation Special regime for processing of lawfully published personal data. Exemption from some obligation – redundancy, formalism. The regime covers whole processing – purpose, legal title, notification, information to the data subjects, processing itself. 19

20. Practical possibilities Anyone may search in all public databases and obtain, combine and publish all information from the databases including personal data. For example: network of family members or friends in political parties and companies which are sponsoring parties and get public contracts, property declaration does not correspond with real ownership etc. 20

21. Conclusion Re-use of PSI might be strong tool for public control. Depends on state which information will make public. Regulation of other aspects of re-use is a necessity: personal data protection, copyright, trade secrets etc. 21

22. Thank you for your attention. Questions? frantisek.nonnemann@uoou.cz 22