Almost every job involves data about people. A receptionist writes down a visitor's name. A shop assistant takes a delivery address. A payroll accountant knows what everyone in the company earns. The rules on personal data protection therefore concern you too, not only your employer. Together they are known as the GDPR.
Which rules apply in the Czech Republic
- The General Data Protection Regulation (GDPR) is EU Regulation 2016/679. It applies directly in the Czech Republic.
- Act No. 110/2019 Sb., on personal data processing, supplements the Regulation with Czech rules. For example, it sets the age of a child for consent (§ 7) and establishes administrative penalties.
- The Labour Code (zákoník práce, Act No. 262/2006 Sb.) protects employees' privacy, mainly in § 316.
- The Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ) is the supervisory authority in the Czech Republic. You can find it at uoou.gov.cz.
The GDPR applies when personal data is processed by automated means, for example on a computer. It also applies to paper data if it is organised in a filing system or folder by names or numbers. Purely personal activity is exempt, for example your phone book at home.
What is personal data
Personal data is any information about an identified or identifiable natural person (Article 4(1) GDPR). It includes:
- name, address, e-mail, telephone number
- rodné číslo (the Czech personal identification number), employee number, customer number
- a photograph or camera recording in which a person can be recognised
- IP address and location data
- salary, appraisals, sickness absence, information about family
Personal data does not have to be secret. It is enough that it can identify a person. A name together with a company and a job title is personal data, even if the person puts it on a business card. Data about legal persons (a company as such) is not personal data. The name of a managing director or contact person is.
What is processing
Processing is practically anything you do with data: collection, recording, storage, viewing, use, transfer, publication, erasure. Even just looking into a database is processing.
Who is who
- The data subject is the person the data relates to.
- The controller decides why and how data is processed. At your workplace it is usually the employer.
- The processor processes data for the controller under a contract, for example an external payroll company or a cloud provider.
- The data protection officer (DPO, pověřenec pro ochranu osobních údajů) advises the controller and monitors compliance. One is mandatory only in certain cases. Under § 14 of Act No. 110/2019 Sb., public authorities and bodies established by law that perform tasks in the public interest set by law must have one. Private companies must have one mainly where they monitor people on a large scale or process special categories of data on a large scale (Article 37 GDPR).
Your role as an employee
As an employee you are usually not the controller. The employer is responsible for lawful processing. But you process data on its instructions (Article 29 GDPR), and under § 301 of the Labour Code you must follow your supervisors' instructions and comply with the legal rules relating to your work. That is why you need to know the basic rules and who to turn to when you are not sure.
The exception: if you start processing data for your own purposes, for example by copying the customer database for your own business, you become the controller yourself in that matter and you are responsible for it too.
What to remember
- Personal data is any information about an identifiable person, not only secret information.
- Processing includes merely looking at data.
- The controller is usually the employer; you act on its instructions.
- Supervision in the Czech Republic is carried out by the Office for Personal Data Protection.