BIICL, London, 15 February Data Protection in the New European Union Member States Czech Republic Karel Neuwirt The Office for Personal Data Protection

2BIICL, London, 15 February 2005 Historical Landscape

3BIICL, London, 15 February 2005 The Czech Republic 10,2 million population 10,2 million population sq. km sq. km Borders with Germany, Poland, Austria, Slovakia Borders with Germany, Poland, Austria, Slovakia President (Vaclav Klaus) President (Vaclav Klaus) Two chambers’ Parliament Two chambers’ Parliament Government – Prime Minister Stanislav Gross, 16 Ministers Government – Prime Minister Stanislav Gross, 16 Ministers

4BIICL, London, 15 February 2005 Legislation Czechoslovak Constitution (1920) Czechoslovak Constitution (1920) Czech Constitution + Charter of Fundamental Rights and Freedoms (1993) Czech Constitution + Charter of Fundamental Rights and Freedoms (1993) Specific laws (regulate PD processing in specific areas) Specific laws (regulate PD processing in specific areas) Ratification of Human Rights Convention Ratification of Human Rights Convention Ratification of the Convention 108 (2001) Ratification of the Convention 108 (2001) Ratification of the Additional Protocol to C108 (2003) Ratification of the Additional Protocol to C108 (2003)

5BIICL, London, 15 February 2005 Data protection 1992 – no on Protection of Personal Data in Information Systems 1992 – Act no on Protection of Personal Data in Information Systems Act no on Personal Data Protection (adopted April 4) Act no on Personal Data Protection (adopted April 4) Harmonization with C108 and General EU Directive – positions of CoE and EC Harmonization with C108 and General EU Directive – positions of CoE and EC

6BIICL, London, 15 February 2005 DP Act 1992 First DP law in the CR (former Federal Czech and Slovak Republic Law) First DP law in the CR (former Federal Czech and Slovak Republic Law) Not harmonized with Convention 108 Not harmonized with Convention 108 Especially – no sanctions, no supervision Especially – no sanctions, no supervision Art.24 – expected supervision body Art.24 – expected supervision body

7BIICL, London, 15 February 2005 Convention No.108 The 1 st legally binding international data protection instrument The 1 st legally binding international data protection instrument Ratification – „old“ EU countries + Bulgaria, Estonia, Hungary, Poland, Romania, Slovenia, Slovakia, Lithuania, Latvia, Malta Czech Republic – signature Sept. 8, 2000 Czech Republic – signature Sept. 8, 2000 ratification July 9, 2001 entry into force Nov.1, 2001

8BIICL, London, 15 February 2005 Additional Protocol No. 181 Additional Protocol to the Convention 108 regarding supervisory authorities and transborder data flows Additional Protocol to the Convention 108 regarding supervisory authorities and transborder data flows ETS no.181 – (open for signature) Signature – 28 countries Signature – 28 countries Slovakia, Lithuania, Czech Republic (Apr.10, 2002), Poland Ratification – 7 countries Ratification – 7 countries Slovakia, Lithuania, Czech Republic (Sept.24, 2003) Slovakia, Lithuania, Czech Republic (Sept.24, 2003)

9BIICL, London, 15 February 2005 Czech DP activities in Europe Council of Europe Council of Europe CJ-PD (till the end 2003) T-PD (1 st vice-chair since 2003) member of the CoE’s expert missions (Russia, Bosnia & Herzegovina, Cyprus) European Commission European Commission WP 29 Committee 31, Joint Supervisory Bodies (vice-chair of JSB Europol, Berlin Group (DP in telecommunication) Committee 31, Joint Supervisory Bodies (vice-chair of JSB Europol, Berlin Group (DP in telecommunication) OECD OECD

10BIICL, London, 15 February 2005 EU Directive Transposition

11BIICL, London, 15 February 2005 DP Act no.101 of 2000 Application of the Law Application of the Law - Applies to any PD processing (unless special law otherwise specifies) - Applies to both public and private sectors - Applies to automatic and non-automatic processing - Exemptions (partly) for Third pillar processing

12BIICL, London, 15 February 2005 Competences of the Office Act no. 101/2000 Coll., - data protection Act no. 101/2000 Coll., - data protection Act no. 133/2000 Coll., - birth date certificate (identity number) Act no. 133/2000 Coll., - birth date certificate (identity number) Act no. 480/2004 Coll., - unsolicited messages Act no. 480/2004 Coll., - unsolicited messages CR cooperate in combat “spam” – see: CR cooperate in combat “spam” – see: European countries launch joint drive to combat “spam” EU Press release IP/05/146

13BIICL, London, 15 February 2005 Supervision Independent supervisory body – Independent supervisory body – The Office for Personal Data Protection Independence on the Government Independence on the Government Separate budget (independent on ministries) Separate budget (independent on ministries) Tasks given by law only, not by the Cabinet Tasks given by law only, not by the Cabinet

14BIICL, London, 15 February 2005 Sanctions The Office competence to give fines and sanctions The Office competence to give fines and sanctions Fines up to EUR (EUR resp) Fines up to EUR (EUR resp) Sanctions to natural person up to EUR Sanctions to natural person up to EUR Chapter VII of the Law

15BIICL, London, 15 February 2005 Amendment 2004 Full harmonization with the General Directive Full harmonization with the General Directive Solve problem with: Solve problem with: definitions, exemptions, forms of consent, definitions, exemptions, forms of consent, transborder data flows, notification to data subject transborder data flows, notification to data subject Biometric data as sensitive data Biometric data as sensitive data

16BIICL, London, 15 February 2005 Harmonization issues Processing of National identifier is not regulate by DP Law (but by Law on Population register and Date of birth – Act no. 133/1999 Coll.) Processing of National identifier is not regulate by DP Law (but by Law on Population register and Date of birth – Act no. 133/1999 Coll.) National identifier (Rodne cislo) is not under regime of special categories of data – article 8 National identifier (Rodne cislo) is not under regime of special categories of data – article 8 Codes of conduct (art.27) Codes of conduct (art.27) Notification – art.20(1) as problem (prior examination) Notification – art.20(1) as problem (prior examination)

17BIICL, London, 15 February 2005 DPA Approach

18BIICL, London, 15 February 2005 Activities Notification exemptions by DP law (low risks processing – small societies, processing by special laws) exemptions by DP law (low risks processing – small societies, processing by special laws) controllers notified controllers notified processing of data (databases) processing of data (databases)

19BIICL, London, 15 February 2005 Legislation The Office is responsible for DP legislation The Office is responsible for DP legislation - common DP law - common DP law - special sectorial legislation : according legislative rules it is obligation to submit bills to OPDP for comments - special sectorial legislation : according legislative rules it is obligation to submit bills to OPDP for comments

20BIICL, London, 15 February 2005 Specific problems Application DP principles into practice Application DP principles into practice Conflicts with old legislation Conflicts with old legislation Change meaningful of citizens, controllers, processors, low willingness change till today practices Change meaningful of citizens, controllers, processors, low willingness change till today practices Historical “stones” Historical “stones”

21BIICL, London, 15 February 2005 Application DP principles Consultations Consultations Popularization Popularization Written answers to questions Written answers to questions Web sites Web sites Annual Report Annual Report Position papers, opinions – regularly issued; no guidelines till now Position papers, opinions – regularly issued; no guidelines till now

22BIICL, London, 15 February 2005 Mass media Contacts with mass media in 2004 agencies agencies newspapers newspapers TV TV Broadcasting Broadcasting

23BIICL, London, 15 February 2005 Publications The Office Official Journal (36 issues) The Office Official Journal (36 issues) Bulletin (quarterly) Bulletin (quarterly) Articles in magazines Articles in magazines Books (2) Books (2)

24BIICL, London, 15 February 2005 Inquiries Year 2004 – inquiries 975 by 975 by by phone by phone 357 by post 357 by post Complaints 641 (incl. 306 for unsolicited messages) Complaints 641 (incl. 306 for unsolicited messages)

25BIICL, London, 15 February 2005 Changes ahead

26BIICL, London, 15 February 2005 DP and accession to EU DP legislation – harmonized with Directive DP legislation – harmonized with Directive EC Peer Review evaluation EC Peer Review evaluation Regular Reports on the CR progress toward accession … Regular Reports on the CR progress toward accession … International Conference Accreditation International Conference Accreditation European DP Commissioners Conference European DP Commissioners Conference EC Phare projects – co-operation with Spain (DP authority) EC Phare projects – co-operation with Spain (DP authority)

27BIICL, London, 15 February 2005 Changes DP Act no.101 amended in 2004 DP Act no.101 amended in 2004 Directive 2002/58/EC implemented by Directive 2002/58/EC implemented by - Act no. 480/2004 Coll., on some services in the information society ; - Act no. 480/2004 Coll., on some services in the information society ; - new law on electronic communications (Bill in the Parliament) - new law on electronic communications (Bill in the Parliament)

28BIICL, London, 15 February 2005 Changes cont. Changes of special laws (sectorial) – permanent task Changes of special laws (sectorial) – permanent task Need to change legislation on public registers Need to change legislation on public registers Need to change medical law (on care on people health) Need to change medical law (on care on people health)

29BIICL, London, 15 February 2005 The rights of men must be held sacred, however much sacrifice it may cost the ruling power. Immanuel Kant Perpetual Peace, 1795

30BIICL, London, 15 February 2005 Contacts The Office for Personal Data ProtectionThe Office for Personal Data Protection Pplk. Sochora 27, CZ Prague 7 Pplk. Sochora 27, CZ Prague 7 Czech Republic Czech Republic tel.: tel.: fax: fax: