Responsibility for complying with the GDPR lies mainly with the controller, that is the employer. But you too can face consequences if you handle personal data without authorisation. This lesson summarises who supervises, what they can impose and what an individual risks.
The Office for Personal Data Protection
The ÚOOÚ is the supervisory authority under Article 51 GDPR and Act No. 110/2019 Sb. Under Article 58 GDPR it can, among other things:
- carry out inspections and audits and demand access to data and premises
- warn a controller that intended processing is likely to infringe the Regulation
- reprimand a controller and order it to bring processing into compliance with the Regulation
- restrict or ban processing
- impose an administrative fine
The Office also handles complaints from people, issues opinions and guidance, and receives notifications of personal data breaches.
Fines under the GDPR
Article 83 sets two levels of fines:
- up to EUR 10,000,000 or 2% of worldwide annual turnover (whichever is higher), for example for infringing the obligations of controllers and processors, the record of processing activities and breach notification
- up to EUR 20,000,000 or 4% of turnover for infringing the principles of processing, the conditions for consent, the rights of data subjects and for failing to comply with an order of the Office
The exact amount depends on the circumstances: gravity, duration, intent, the number of people, cooperation with the Office. A fine should be effective, proportionate and dissuasive.
Fines are imposed by an administrative authority, that is the Office. For offences under § 62 of Act No. 110/2019 Sb., proceedings follow the Czech rules on administrative penalties. Article 83(7) GDPR leaves it to Member States whether to fine public authorities and public bodies. The Czech Republic decided not to: for controllers and processors named in that article, the Office waives the imposition of an administrative penalty (a fine) under § 62(5) of Act No. 110/2019 Sb. Other corrective measures, for example an order to remedy or a reprimand, remain open to it.
Compensation for damage
Anyone who has suffered material or non-material damage as a result of an infringement of the Regulation has the right under Article 82 GDPR to compensation from the controller or processor. The person may turn to a court.
Criminal liability of an individual
The Criminal Code (trestní zákoník, Act No. 40/2009 Sb.) contains in § 180 the criminal offence of unauthorised handling of personal data. In brief:
- Whoever, even through negligence, without authorisation publishes, communicates, makes accessible, otherwise processes or appropriates personal data about another person that was gathered in connection with the exercise of public authority, and thereby causes serious harm to the rights or legitimate interests of the person concerned, faces imprisonment of up to three years or a ban on activity (paragraph 1).
- The same punishment applies to anyone who, even through negligence, breaches a duty of confidentiality imposed or recognised by the state by unlawfully publishing, communicating or making accessible to a third party personal data obtained in the course of their profession, employment or function, and thereby causes serious harm (paragraph 2).
- A harsher penalty (1 to 5 years) threatens a member of an organised group, an offender who acts through the press, radio, television or a publicly accessible computer network, which includes the internet, or where there is considerable damage or an intent to obtain considerable benefit (paragraph 3). Where the damage or benefit is large-scale, it is 3 to 8 years (paragraph 4).
The condition is therefore serious harm. An ordinary mistake without such consequences will not be a criminal offence. Misuse, sale or publication of data that causes someone serious harm, however, can be.
Consequences under employment law
A breach of duties in handling data may be a breach of duties under § 301 of the Labour Code, that is to follow instructions and comply with regulations. Depending on its gravity, the employer may give notice (§ 52) or, in exceptional cases, terminate the employment immediately if the employee has breached a duty arising from legal regulations in a particularly gross manner (§ 55(1)(b)). It may also claim compensation for damage under the conditions of the Labour Code.
What the employer must do itself
This course does not replace the duties of your employer. It must provide, for example:
- an internal policy or rules for handling personal data
- information for employees about the processing of their data (Article 13)
- a record of processing activities, if it is required to keep one (Article 30)
- instructions for your post: which data, in which system, to whom you may pass it
- a contact for the data protection officer or for the person to whom requests and incidents are reported
- contracts with processors, risk assessments and a procedure for personal data breaches
What to remember
- Supervision is carried out by the ÚOOÚ; GDPR fines reach up to EUR 20 million or 4% of turnover.
- For public authorities and public bodies the Office waives the fine (§ 62(5)); its other measures remain.
- § 180 of the Criminal Code punishes unauthorised handling of personal data that causes serious harm.
- The employer must have its own policies, information, records and instructions.