Recently, there has been an increase in queries from traders relating to the transfer of customers’ personal data to third parties. For these reasons, we have decided to address this issue in our legal circulars as well.

In order to address the question of transfer of personal data, it is necessary to briefly clarify at the outset what personal data actually are (within the meaning of the legislative definition of this term). In practice, it is possible to encounter a number of misinterpretations in this regard - for example, that an email address alone is never personal data, etc.

The provision of Section 4(1) of Act No. 101/2000 Coll., on the Protection of Personal Data and on Amendment of Certain Acts, as amended, provides that personal data means “any information relating to an identified or identifiable data subject. A data subject is considered to be identified or identifiable if the data subject can be identified directly or indirectly, in particular on the basis of a number, code or one or more factors specific to his physical, physiological, mental, economic, cultural or social identity…” The first part of this definition is particularly important, namely that “personal data means any information relating to an identified or identifiable data subject.” For our purposes, however, the wording of the Czech version of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data may be more illustrative. This Directive provides in its Article 2(a) that personal data means “any information relating to an identified or identifiable natural person”. This means that if a natural person can be identified on the basis of certain information, or if it is information about an identified natural person (even though such information does not in any way specify his physical, mental, economic, cultural or social identity), such information constitutes personal data. What does this mean in practice?

For example, the email address josef.aujezdsky@eadvokacie.cz will be personal data, since my person can be identified on the basis of this email address. However, a different situation will arise, for example, with email addresses such as eadvokacie@eadvokacie.cz or lkp@seznam.cz, which alone will probably not constitute personal data. If the email address josef.aujezdsky@eadvokacie.cz is associated with, for example, payment history or purchase history, then such information will also be personal data in the legislative sense (it is information relating to an identifiable data subject), even though information about payment history or purchase history would not in itself be personal data and, except in exceptional cases, does not in any way specify the physical, mental, economic, cultural or social identity of the purchaser.

In conclusion, it is appropriate to mention a decision of the Supreme Administrative Court which dealt primarily with a telephone number as personal data (however, this decision can also be extended to other information). The Supreme Administrative Court in its judgment ref. no. 9 As 34/2008 specifically stated that “the full identity of a natural person in the current conditions of a technologically advanced society, i.e. with a high degree of development of electronic and other media that are easily accessible to most of the population, essentially means nothing other than the possibility of contacting this person in a certain way, without the need to know the place of his current residence. Therefore, the interpretation of the concept of personal data cannot be limited strictly only to knowledge of, for example, the birth number, address or workplace of the data subject. From this perspective, the mobile telephone number of a particular person must also be considered personal data, even though such a number may be used by the person in question only temporarily, and at the same time does not in any way specify his physical, mental, economic, cultural or social identity. However, through this number it is possible to directly contact the subject in question during a certain period of time …, and this subject is thus reachable and in a certain way identifiable, possibly even without knowledge of his name and other data which already have a link to his physiological, mental, economic, cultural or social identity.”

We will address the individual possibilities and limitations in the transfer of personal data given by legal regulation in this area in one of our future legal circulars.

Josef Aujezdský

Law Office Mašek, Kočí, Aujezdský www.e-Advokacie.cz – on-line legal advice

This text was originally prepared by the law office Mašek, Kočí, Aujezdský in cooperation with the Association for Electronic Commerce (APEK) as legal circular No. 1/2016 intended for members of this association.

This text was translated from Czech to English using an AI translator.