If personal data are demanded from persons at the entrance of certain types of buildings, it must be established, whether this can be classified as personal data collection within the meaning of Article 4 of Act No.101/2000 Coll., on Personal Data Protection, as amended (hereinafter referred to as “Personal Data Protection Act”). If the answer is yes, the warden of the building is in the position of a data controller (or data processor, if he performs this task for another entity on the basis of a contract).
The Office holds that, in certain cases where the building is not designed for normal public use, the owner or warden (manager) of the building has the right to demand (with regard to his responsibility for the property and the running of the building as well as for security reasons) that visitors provide their basic personal data – that is, their name and surname – and if they are entering the building on duty, also submit their professional identity card. The number on the card as well as the name of the sending institution can be written down on this occasion. If the visitors enter the building on their own personal business, they should submit for inspection their personal identity card or passport, the number of which may again be recorded. If the authorised person demands additional data, e.g. the visitor’s address, this may already constitute a breach of the duty stipulated in Article 5(1)(d) of the Personal Data Protection Act, that is, the duty to collect only those types of personal data that correspond to the asserted purpose and only to the extent that is necessary to achieve that purpose. The purpose in this context is the subsequent identification of the visitor in case of some kind of emergency that might take place during his or her stay in the building. As a rule, such emergency would be investigated by the Police Forces of the Czech Republic that do not require other than the aforementioned data to identify and seek out the person. According to Article 5(1)(f) of the Personal Data Protection Act, the data collected for this purpose may not be used for any other purpose without the consent of the data subject. According to Article 5(1)(e), personal data may be stored only for the period of time necessary for their processing. In the aforementioned case, this means several weeks or, at most, several months. When this time elapses, the said purpose clearly no longer exists. It must also be pointed out that, depending on concrete circumstances, every building warden should consider whether the collection of visitors’ personal data is really necessary and whether it could not be replaced by other solution (e.g. a visitors room could be set up at the entrance to the building, or every visitor could be accompanied by the employee whom he or she visits).
If the warden of the building is in the position of a data controller or data processor, he must fulfil duties stipulated by the Personal Data Protection Act. Consequently, without the consent of the visitor, he may process personal data only under the exceptional conditions defined in Article 5(2)(a) of the Personal Data Protection Act, i.e. only if he carries out data processing under lex specialis – a special law (e.g. Article 36 of Act No. 202/1990 Coll., on Lotteries and Other Games of Similar Nature, as amended). He may also process the data if the processing is necessary for the fulfilment of duties stipulated by a special law, or if the case meets the criteria for an exception under Article 5(2)(e), i.e. if the processing is necessary for the protection of the individual’s rights. Also, if the case does not meet the criteria for an exception under Article 18(b) of the Personal Data Protection Act, it is necessary to fulfil the notification duty under Article 16 of the said Act. However, if the processing of the visitors’ personal data is not required by law, the question of whether the aforementioned exceptions apply depends on concrete circumstances and must therefore be answered independently for each case.
Mode No graphics is currently switched on. Therefore you see the web page with no decorative graphics as well as any advanced formatting. If your browser supports CSS2, you can switch a graphic mode on.