Úřad pro ochranu osobních údajů zveřejnil výroční zprávu za rok 2024

At the end of March 2025, the Office for Personal Data Protection (hereinafter referred to as the "Office") published its annual report for 2024. In this report, the Office traditionally informed about the conclusions of its control activities, as well as the conclusions of relevant administrative first-instance decisions, decisions of the Office's chairman, or decisions of the European Data Protection Board.

One of the main activities of the Office was the prevention of breaches of personal data protection regulations and the strengthening of the Office's control mechanisms. In this area, it is worth mentioning the highest fine imposed in the Czech Republic so far, amounting to CZK 351 million, for unauthorized processing of personal data.

Furthermore, the Office addressed the current model of obtaining consent for personal data processing called consent or pay. This model involves preventing interaction with websites until the user grants his/her consent for personal data processing, typically for targeted or behavioral advertising, or pays a fee. According to the Office, such obtained consent is highly problematic, especially from the perspective of its free and informed granting. Particularly in situations where the user has only the choice between granting the consent for advertising purposes or paying a fee, the consent cannot be considered valid under GDPR.

Similarly to 2023, the Office received nearly two thousand complaints and suggestions. These mainly concerned the processing of personal data for marketing purposes (15%), the publication or disclosure of personal data (13%), the monitoring of individuals through cameras (12%), violations of the obligations of personal data controllers (10%), or the exercise of data subjects' rights.

The Office also intensively dealt with the issue of unsolicited commercial communications, receiving nearly fifteen hundred complaints. Of these, 36% of complaints concerned unsolicited email messages containing proforma invoices for services that the recipients did not order. In this area, the Office imposed fines totalling to CZK 7,124,000.

The annual report also includes insights from the Office's consulting and analytical activities, as well as a summary of the most important legislative changes both in the Czech Republic and the European Union.

We continue to monitor developments in the field of personal data protection and will keep you informed. If you are interested in more detailed information, please contact the authors of the article or other members of the EY Law firm or EY team you collaborate with.

Authors:

Matěj Plšek

Kateřina Suchanová