The Office for Personal Data Protection (further as "the Office") was established by Act No.101/2000 Coll., on the Protection of Personal Data and on the Amendments to Some Related Acts (Personal Data Protection Act), starting on June 1, 2000, as an independent authority in the field of the personal data protection. By virtue of Act No.227/2000 Coll., on Electronic Signatures and on the Amendments to Some Related Acts (Electronic Signature Act), which came into force on October 1, 2000, the competence of the Office was expanded onto electronic signature issues.
By virtue of Government Resolution No. 609, dated June 14, 2000, Mr Karel Neuwirt was entrusted with undertaking the measures inevitable for the inception of the Office's activity.
In connection with the establishment of the Office, the Government undertook steps to secure personnel, financial and propertial resources required for the Office´s performance and adopted for this purpose Resolution No. 642, dated June 21, 2000. In this resolution the Government enjoined the authorized its members to present to the Government by July 31, 2000 the method of legislative arrangement of the position of the Office and its employees by delegating to it the same duties as are specified in article 73, par. 2 to 4 of the Labour Code.
Pursuant to this resolution, 11 positions were delimited, including the corresponding transfer of financial means from the budgetary allocation of the Office for the State Information System into the budgetary allocation of the Office for Personal Data Protection and the respective adjustments were made to the mandatory limits of the budgetary allocations of these offices.
On the basis of the proposal by the Senate of the Parliament of the Czech Republic, in August 2000 Mr Karel Neuwirt was appointed president of the Office by the President of the Czech Republic, effective from September 1, 2000.
With respect to the manner of the legislative arrangement of the position of the Office and of its employees, already in July of 2000 Mr Karel Neuwirt asked the authorized members of the Cabinet for a solution to this issue. The deadline for the submission of this task to the Government was extended until September 30, 2000, due to the difficult course of the negotiations with the ministries involved. On the basis of a recommendation by the Deputy Prime Minister responsible for legislation and the Government Legislative Council, dated August 8, 2000, the task was addressed by the draft amendment to the law. Upon the acceptance of this solution, the original task specified by Resolution No.642 was revoked and replaced by a new one, that the Minister and Head of the Office of the Czech Republic Government shall present to the Government by December 31, 2000 a draft act changing and supplementing the law. At the same time the recommendation was made that the President of the Office should take part in the completion of this task, which he proceeded to do.
The Office was able to include this point into the plan of the legislative tasks of the Government and before the end of 2000 prepare and present the mentioned amended law; this step, however, was not quite in conformity with the long-term intention of the Office, that an eventual amendment to the law should address in a comprehensive manner also other possible problems that may arise in connection with the competencies of the Office, and not solely this individual issue. The Office strove to take an active part in the resolution of these current problems and hence for the entire period the option was weighed of putting across the above-mentioned proposals through one of the deputies. Besides this, however, intensive discussions took place with the Minister of Labour and Social Affairs and the Minister of Finance, with the objective of finding the optimum solution to the question of the remuneration of the Office's employees.
On the basis of the results of all of this discussion a draft amendment to the law was presented as a legislative initiative of individual deputies (Parliamentary Imprint No. 774). The Government occupied itself with this proposal at its session of December 11, 2000 and adopted Resolution No. 1256 with respect to it, in the annex to which it expressed its position on this issue.
On December 12, 2000 another legislative initiative by individual deputies was presented to the Chamber of Deputies for an amendment to the law, given in Parliamentary Imprint No. 800. The Office elaborated a position statement for the Government´s deliberations in this matter, which it sent in the form of a letter of the President of the Office on December 28, 2000 to the Office of the Government. The Government did not address the issues raised in this Parliamentary Imprint before the end of 2000.
These Parliamentary Imprints were not discussed or approved by the Chamber of Deputies of the Parliament of the Czech Republic before the end of 2000.
Following the formation of the Office its employees were equipped with borrowed and delimited data processing technology, which enabled them to perform the basic activities connected with the operation of the Office. In order to inform the public on the first steps done by the new Office, a provisional web page was launched in July 2000. In addition, the JASU PC accounting system by MUZO Praha s. r. o. was put into operation, along with the wage book-keeping software (MZDY UNICOS) of the company Eccoma Ltd.
In July and August preparatory work was performed to prepare the call for tenders for the main supplier of the Office's information system. The activity was concluded with the elaboration of the bidding documents. The tenders were called for in September in the form of a request to a number of interested parties to submit a bid pursuant to article 49 of Act No.199/1994 Coll. on Public Procurement, as amended, on the basis of a professional estimate of the expenditures required for the purchase of the technology essential for the inception of registrations. The deadline for the inception of registrations, which was fixed by law, and hence also the date of the launching of the information system, was December 1, 2000. The commission for the assessment and evaluation of the bids was composed of the Office's employees as well as external experts and it elaborated a final report, wherein it recommended to the public procurer the bid of the company TESCO Ltd., from the town of Olomouc, as the most expedient one.
The procurer accepted the Committee's recommendation and on November 2, 2000 a performance contract was signed with TESCO Ltd., whereby the basic information system of the Office was implemented and in accordance to which the system will further be developed.
To facilitate the notification process both for controllers and for the Office, notification forms were drafted, printed and distributed. Following an agreement with the Ministry of Finance, distribution was secured in cooperation with the revenue authorities.
The basic information system of the Office was launched as planned on December 1, 2000 and the first Notification of Personal Data Processing through scanning and electronic recognition of filled out questionnaires, took place on December 12, 2000. At the end of the year 37 user computers were linked to this system.
The competence of the Office is specified primarily in the provisions of article 29 of the Personal Data Protection Act.
Pursuant to the provisions of article 30 par. 2 of the law, the supervisory activity of the Office is performed by inspectors and authorized employees. At the recommendation of the Senate of the Parliament of the Czech Republic, the President of the Republic appointed three inspectors, effective as of October 1, 2000: Mr Miloš Dokoupil, Mr Jiří Souček and Mr Miloš Šnytr.
In the course of the performance of supervision over compliance with statutory duties in the course of personal data processing and the imposition of remedial measures, it was necessary that the Office should respect the provisions of article 47, par. 2 of the Act; one of the measures specified therein was applicable to the transitional period, requiring that personal data processing be brought into conformity with the law within 1 year after its entry into force.
The creation of the information system of the Office made possible, among other things, the start registrating of permitted personal data processing. This provision of article 16 of the law came into force on December 1, 2000. In order to make the fulfillment of the notification obligation for personal data controllers as easy as possible, the Office issued notification forms and provided for their distribution.
The first registration was performed on December 12, 2000 and by the end of 2000 altogether 108 controllers performing personal data processing were registered.
In 2000 the Office dealt with about 40 written complaints concerning personal data processing. Besides this, a number of oral notifications were addressed to the Office. The complaints concerned primarily the following categories of issues:
Mail order commerce, Internet service providers, personal data processing in the course of collection of fees for communal waste disposal, excessive use of citizen ID numbers, disclosure of personal data in social columns, processing of personal data of passengers by the transportation companies, publication of names of the persons delinquent in the payment of rent, use of monitoring equipment, provision of data upon entry into restricted areas and buildings, maintenance of records of taxi drivers and the publication of data on political affiliation.
The Office has elaborated supporting materials for the Government of the Czech Republic and for the Parliament of the Czech Republic for the signing and ratification of Convention No. 108 for the Protection of Individuals with Regard to the Automatic Processing of Personal Data. The Convention was signed on behalf of the Czech Republic on September 8, 2000 by its ambassador, Jiří Mucha, in Strasbourg.
The Convention was then submitted to the Chamber of Deputies for approval and was ratified on October 5, 2000.
Further activities of the Office in this area, referring to international cooperation, are presented in the chapter entitled "Contacts with Foreign Countries."
After July 1, 2000 the ministries and other central authorities gradually began to send the Office specific legislative intents, bills and draft implementary legal regulations (government regulations and decrees) for its comments.
For example, in August 2000 the President of the Office submitted comments to the bill on pre-school, elementary, secondary and higher professional and other education and on the amendments to further laws (the Education Act) and to the bill implementing changes to Act No.283/1991 Coll. on the Police of the Czech Republic, as amended; in November 2000 he submitted comments to the specific legal intent on military veterans and in December 2000 comments to the legislative proposal on the state borders. The draft amendment to the law on the Police of the Czech Republic was not elaborated in conformity with the Council of Europe Recommendation R(87) 15, the acceptance of which is one of the conditions for the accession of the Czech Republic to EUROPOL and to the Schengen Agreements. The draft amendment to the law on the Police of the Czech Republic was modified by its elaborator pursuant to the comments submitted by the President of the Office and the amendment to the law on the Police of the Czech Republic was promulgated in the Collection of Laws under No. 60/2001 Coll. Also the draft amendment to the law on Prison Guards and Judicial Security Guards of the Czech Republic was modified by its elaborator pursuant to the comments concerning the maintenance of records of persons being held in pre-trial detention and serving prison sentences, submitted by the Office for Personal Data Protection in the course of discussions with the elaborator, and the amendment to the law on Prison Guards and Judicial Security Guards of the Czech Republic was promulgated in the Collection of Laws under No. 460/2000 Coll.
In his comments the President of the Office for Personal Data Protection strove to ensure that the contents of the draft legal regulations submitted should not diverge from the legislation in force and the principles contained in Act No.101/2000 Coll., so as not to compromise the position of the data subjects with respect to the position of controllers and processors, and in order that the new legal regulations should not reduce the level of personal data protection following from the cited law.
As of October 1, 2000 a consulting team for the President was established for the purpose of consultations on legislative and legal matters.
During 2000 the Office received questions and applications for consultations in the area of personal data protection, which concerned all questions related to the establishment of the Office and its position within the scope of the state administration system, as well as the actual application of the new law in relation to separate legal regulations, in particular, the fulfillment of the obligation to notify and the extent of the exemptions from this obligation.
The Office issued its "Position Statement No. 1/2000" with respect to the exemption from the reporting duty for entities performing personal data processing while administering health records.
The second most frequent topic of the consultations regarding questions being answered were the legally stipulated rights and responsibilities in personal data processing, in particular, the conditions under which it is possible to process data without consent of the data subjects and, furthermore, cases in which the extent of the data gathered for the fulfillment of the specified purpose is exceeded, or cases in which the data does not correspond to this purpose. In this connection the Office was asked about the right to disclose some personal data without the consent of the respective data subject.
Informing the public on issues relating to the personal data protection is also the objective of the Office's web sites of www.uoou.cz.
Apart from the Official Journal of the Office, in which registered entities (controllers) are being published along with the official standpoints and notices of the Office, the Office also publishes an information bulletin titled "OPDP Informs." This bulletin is intended primarily for the collaborators of the Office and for news reporters who write on personal data protection.
Since the establishment of the Office, two press conferences were held in 2000. The first of them was held on September 14 with the topic focusing on creation and mission of the Office and the tasks that it should fulfill. On the second press conference on November 21, 2000 news reporters received information on the inception of registration of permitted personal data processing.
In this area the Office is above all required (pursuant to article 27, par. 4 and 5 of the Personal Data Protection Act) to conduct administrative proceedings and on their basis to issue decisions either permitting or refusing the transfer of personal data abroad. The starting position in the decision-making is the adequacy of the legislative protection of personal data in the country to which the personal data are to be transferred. By evaluating this issue the Office takes into consideration the practice of the European Union as well as the evaluation of the specific criteria followed by the Council of Europe (one of the criteria, for instance, being the signing or ratification of Council of Europe Convention No. 108 dated 1981). In the event of a data transfer into a country with inadequate legislative protection, the Office requires the fulfillment of one of the pre-requisites specified in article 27, par. 2 and 3 of the cited act (such as, for instance, the consent of the data subject), which are fully in harmony with the provisions of the respective Directive 95/46/EC of the European Parliament and of the Council.
As of December 31, 2000 the Office issued 29 decisions in total, of which 26 were permissions, 1 rejection and 3 permissions with partial rejection.
Article 29, par. 1, letters g) and i) of the cited law furthermore charges the Office with securing compliance with requirements ensuing from international treaties, by which the Czech Republic is bound, and to cooperate with similar offices in other countries. In connection with the European (Association) Agreement, the Office provides for the harmonization of the national legislation with the EU law. With this objective, direct contacts were established with the respective unit within the European Commission's DG Internal Market, which will be assessing the harmonization of the Czech Republic's national legislation with the EU law with respect to the personal data protection. Within the scope of cooperation with analogous offices in other countries, particularly close contacts were established with the Spanish Data Protection Agency and with the German Office of the Federal Data Protection Commissioner. With the Spanish Agency a project is being in preparation for longer-term expert assistance within the scope of the so-called twinning projects financed by the EC Phare 2000 National Program. The first official visit of the Office's representatives took place at the beginning of September at the Federal Data Protection Office in Germany (Der Bundesbeauftragte für den Datenschutz). In December a visit took place at the Netherlands Supervisory Office (Registratiekamer).
The Office is contributing to the Czech Republic's preparations for the EU accession through participation in the common efforts of the interdepartmental Working Committee for Integration in the European Union (WCIEU) under the Ministry of Foreign Affairs of the Czech Republic and in several of its subcommittees. Also significant is the activity of the Office with the Ministry of the Interior of the Czech Republic in the preparation for accession to the Europol Convention, and in particular to the so-called Schengen Convention (Convention on the implementation of the Schengen Agreement on the gradual removal of controls on common borders) and the establishment of the National Schengen Information System.
The Office is cooperating with the Council of Europe and taking part in its activities in this area. The Office represents the Czech Republic in the data protection task force (CJ-PD) and the President of the Office is an elected member of the Coordination Group (CJ-PD/CG). The President of the Office takes part in the formulation of Council of Europe documents on these issues and has been charged with the elaboration of documents on personal data protection in relation to the use of Smart Cards.
The Office further cooperates with the OECD (Organization for Economic Cooperation and Development), namely with its Working Party on Information Security and Privacy (WPISP under the ICCP Committee).
By means of Act No. 227/2000 Coll., (Electronic Signature Act), which came into force on October 1, 2000, the Office was entrusted with duties relating to electronic signature. The primary task was to establish an appropriate workplace and to start works on the preparation of a decree promulgating the above mentioned act. An electronic signature department was constituted. The President of the Office appointed an electronic signature expert working group, which is the Office's consulting body for this area. The Office's employees, in cooperation with the members of this group, commenced the preparation of the draft decree even before the act became effective.
At the beginning of December, extensive theses related to the decree were published and submitted for open professional discussion. The theses were published on servers which are dealing systematically electronic signature issues.
Furthermore, the Office asked more than 20 firms and individuals involved actively in the respective area for the elaboration of comments on the published theses. The comments received by the Office helped in the further stage of drafting of the decree. At the same time this communication made possible the clarification of a number of aspects of the Electronic Signature Act, technological procedures, as well as unification of terminology.
The Office accommodated all persons interested in receiving consultations with respect to the Electronic Signature Act and responded to all questions raised.
In view of the fact that the Office started to perform its activity after September 1, 2000 and in view of the temporary provisions of the law, it is not possible to perform an evaluation of the overall state of the personal data protection in the Czech Republic. The first assessment of this state will be performed only in the next annual report (for 2001).
The Office for Personal Data Protection was established on June 1, 2000 as a separate chapter No.343 of the state budget - "Personal Data Protection". In view of the fact that this chapter was formed only after the approval of the state budget for 2000, its budget was made up exclusively by means of additional reallocations. The revenues of the chapter were not currently budgeted in 2000.
The question of permanent headquarters of the Office, which is temporarily using a limited office space in the building of the Office for Public Information Systems, has not yet been resolved.
Drawing on the state budget (in thousands of CZK)
|1. Summary indicators:|
|Total expenditures||33 505.28|
|2. Individual expenditure indicators:|
|Salaries and other payments for work performed||4 806.06|
|of which: salaries||4 580.06|
|Mandatory insurance paid by the employer||1 620.27|
|Transfer to the cultural and social needs fund||91.60|
|Data earmarked for the financing of renewal of capital assets||17 584.71|
Mode No graphics is currently switched on. Therefore you see the web page with no decorative graphics as well as any advanced formatting. If your browser supports CSS2, you can switch a graphic mode on.