In this circular, we follow on from Legal Circular No. 1/2016, where, as part of an introduction to the issue of personal data processing, we focused primarily on the legislative definition of the term personal data. That is, what personal data actually is from a legal perspective.

The transfer or transferring of personal data (to another person) is then one of the forms of personal data processing. Specifically, this is mentioned in the provision of Section 4(e) of Act No. 101/2000 Coll., on the Protection of Personal Data and on Amendment of Certain Acts, as amended (hereinafter “the Act on the Protection of Personal Data”). This reads as follows: “processing of personal data means any operation or set of operations which the controller or processor systematically performs with personal data, whether by automated or other means. Processing of personal data means in particular collecting, storing on information carriers, making accessible, modifying or altering, retrieving, using, transferring, disseminating, publishing, retaining, exchanging, sorting or combining, blocking and destruction…”

For the purposes of this circular, the transfer of personal data is understood primarily as a case where personal data is to be or is being transferred to another data controller. It is naturally also possible to transfer personal data “internally”, that is, to a data processor who ensures certain operations with personal data for the controller (hosting company, etc.).

In general, it is necessary to distinguish between situations where personal data processing (including the transferring of personal data) takes place with the consent of the data subject (with the customer’s consent) and where it takes place without such consent. In the case where consent to the transferring of personal data is expressed by the data subject, the position of the data controller (trader) is not extremely complex, since the Office for Personal Data Protection considers even consent formulated in fairly general terms to be sufficient in this area. Nevertheless, even in such a case, the trader must comply with other obligations set out by the Act on the Protection of Personal Data, including the obligation to demonstrate the data subject’s consent to the processing of personal data throughout the entire period of processing (Section 5(4) of the Act on the Protection of Personal Data).

The situation is more complex in cases where personal data processing is to take place, including the transferring of personal data to third parties, without the data subject’s consent, as these cases are understood as an exception to the rule. In the case of traders in the internet environment, the exception enshrined in the provision of Section 5(2)(b) of the Act on the Protection of Personal Data is most frequently applied. This provision establishes that: “The controller may process personal data only with the data subject’s consent. Without this consent, it may process them if the processing is necessary for the performance of a contract to which the data subject is a party, or for negotiations on the conclusion or amendment of a contract carried out at the data subject’s request…” This means that the customer’s personal data may be transferred without their express consent, for example, to a transport company for the purpose of delivering goods pursuant to a contract of sale or to a company that ensures warranty repairs of goods from a contract of sale. In both of the mentioned cases, this concerns the performance of a contract by the trader.

Cases where personal data processing takes place without the data subject’s consent for the purpose of offering trade or services will be addressed in one of the forthcoming legal circulars.

Josef Aujezdský

Law Firm Mašek, Kočí, Aujezdský www.e-Advokacie.cz – online legal advisory

This text was originally prepared by the law firm Mašek, Kočí, Aujezdský in cooperation with the Association for Electronic Commerce (APEK) as Legal Circular No. 8/2016 intended for members of this association.

This text was translated from Czech to English using an AI translator.