Offences relating to personal data
Pursuant to Article 61(1) of the Data Protection Act, any natural or legal person commits an offence when it publishes personal data, and such a publication was prohibited by any act or other legislation. Pursuant to Article 61(2) of the Data Protection Act, the Czech Data Protection Authority may impose a fine up to 1,000,000 CZK, or, in the case that the person committed an offence by publishing the personal data in print media, movie, radio, television, publicly available computer network or other similar method, up to 5,000,000 CZK.
Exceptions to imposing a fine
Pursuant to Article 61(3) and 62(5) of the Data Protection Act, the Czech Data Protection Authority will not impose a fine for specific categories of controllers or processors pursuant to Article 83(7) of the GDPR – e.g. public authorities and bodies established in that Member State.
Criminal sanctions
Czech Penal Code (Act No. 40/2009 Coll.) includes penalties for several violations of personal data processing, including:
- unlawful publication, communication or other type of unlawful processing of personal data that were collected in connection with the public authority and that resulted in serious harm to the data subject, pursuant to Article 180 of the Penal Code
- stalking using personal data, pursuant to Article 354 of the Penal Code
The Penal Code specifies the penalties for such behaviour, including possible imprisonment.
