Law: Act No. 110/2019 Coll. on Personal Data Processing (the Act) and the General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR)

Regulator: Office for Personal Data Protection (UOOU)

Summary: The Act No. 110/2019 Coll. on Personal Data Processing (the Act) is the main piece of privacy regulation in Czechia and transposes the GDPR. The Act establishes the Office for Personal Data Protection (UOOU) as the supervisory authority regarding data protection, designating the UOOU with supervisory responsibilities, including performing audits, publishing Standard Contractual Clauses (SCCs), investigating complaints in relation to breaches of obligations laid down by law, and imposing fines.

Furthermore, Article 89(3) of the Act No. 127/2005 Coll. Of 22 February 2005 on Electronic Communications and on Amendment to Certain Related Acts (the Electronic Communications Act) implements the Directive on Privacy and Electronic Communications (2002/58/EC) (as amended) (the ePrivacy Directive). Since the 2009 amendment of the ePrivacy Directive, Czechia has retained the 'opt-out' system, meaning that the Electronic Communications Law does not reflect the 'opt-in' consent requirement under the amended ePrivacy Directive.

Moreover, in relation to Data Protection Impact Assessments (DPIA), the UOOU has issued a list of activities that requires a DPIA (i.e., a blacklist) and a list of activities that do not require a DPIA (only available in Czech here).