Úřad pro ochranu osobních údajů zveřejnil plán kontrol pro rok 2023

The Office for Personal Data Protection published the inspection plan for 2023

The Office for Personal Data Protection (the "Office") is the only supervisory authority for personal data protection in the Czech Republic. One of the main duties of the Office is to monitor and enforce the application of the General Data Protection Regulation (GDPR). To fulfil these duties, the Office mainly carries out two types of inspections - inspections based on complaints and submissions and inspections in accordance with the annual inspection plan.

In particular, the Office carries out inspections based on complaints and submissions from data subjects (i.e., natural persons) or other entities, organisations, or associations. In addition to these unscheduled inspections, the Office publishes the annual inspection plan setting out the planned inspections for the year. The inspection plan always specifies the subjects to be inspected and the expected period during which the inspection shall take place.

In 2023, the Office will focus on the following areas:

• Compliance with and exercise of data subjects' rights under Articles 15 to 21 of the GDPR, specifically in the case of two executors;
• Processing of personal data by the system Eurodac, i.e., the fingerprint matching system, and the overall set-up of the corresponding processes for such data processing by the Ministry of the Interior;
• Inspection of the personal data processing received in the framework of the visa process by the Ministry of Foreign Affairs or by selected embassies;
• Operation of CCTV systems with focus on the collection, storage and access to biometric personal data by the private entity;
• Compliance with the obligations of the processor in case of the private entity, in particular with regard to the involvement of other processors, notification of changes in the involvement of other processors, evidence of how changes in the involvement of other processors have been discussed with the controller or compliance with the contract concluded between the processors;
• Checking the legal titles for the personal data processing in the context of telemarketing and fulfilment of the information obligation towards data subjects by the private entity;
• Creation of databases by the private entity, in particular with regard to the sources of personal data, the legal title for the personal data processing within the databases, the manner in which the information obligation is fulfilled and the manner in which the rights of data subjects are exercised;
• Personal data processing of in connection with the issuance of identity cards by the Ministry of the Interior, including a mapping of the subjects involved in the personal data processing;
• Setting of the retention period for personal data processing, fulfilment of the information obligation towards data subjects, exercise of data subjects' rights and involvement of the Data Protection Officer;
• Personal data processing by employers within the attendance systems, in particular with regard to which categories of personal data are processed, for how long and to what extent;
• Compliance with the principles on the personal data processing when using the social networks by ministries in their communication with the general public;
• Position of the Data Protection Officers within the coordinated supervisory action in cooperation with other European supervisory authorities; and
• Compliance with the conditions for the dissemination of commercial communications via SMS at two private entities.

In case of planned inspections, the Office focuses mainly on pressing current issues in the area of personal data processing or on assessing the compliance with new obligations in relation to personal data arising from the amended legislation. Thus, even though the above-mentioned inspections will only be carried out with selected entities, the annual inspection plan provides valuable information to other data controllers and processor on what areas the Office is focusing on and in which areas to double-check whether the personal data processing is carried out in compliance with legal regulations.

We keep monitoring further developments -not only in the area of personal data and will keep you informed. If you would like more detailed information, please contact the authors of this article or other members of EY Law or the EY team with whom you work.

Authors:

Eliška Mandíková

Kateřina Suchanová

Hana Gutová