Úřad pro ochranu osobních údajů zveřejnil výroční zprávu za rok 2023

The Office for Personal Data Protection published its annual report for 2023

The Office for Personal Data Protection reported on the results of the 2023 audits, which focused in particular on the processing of personal data through cookies.

On 25 March 2024, the Office for Personal Data Protection (the "Office") published its annual report for 2023. In this report, in addition to the conclusions of its audit activities, it reported on the conclusions of relevant administrative first instance decisions, decisions of the President of the Office or decisions of the European Data Protection Board.

One of the most significant areas audited was the processing of personal data through cookies, in which the number of decisions of the Office increased significantly. The following infringements were found by the Office during the audits:

• in more than 70% of cases, the processing of personal data through cookies had already taken place before the website visitor's consent to upload them had been obtained,
• in 50% of cases, deficiencies in the fulfilment of the information obligation were identified,
• in almost 30 % of cases, the infringement consisted in the misplacement of the option to consent and refuse the uploading of non-technical cookies in different layers of the cookie bar; and
• furthermore, deficiencies in consent to the processing of personal data and the impossibility or significant complication of withdrawing consent to the processing of personal data through cookies were identified.

The Office received more than two thousand complaints and suggestions in relation to the protection of personal data, which is a similar number to the previous two years. Complaints and suggestions mainly concerned the processing of data for marketing purposes (22%), the disclosure or access to personal data (16%), the monitoring of natural persons through CCTV cameras (11%) or the breach of the information obligation of data controllers towards data subjects.

The Office also controlled the dissemination of unsolicited commercial communications. Last year, 1,388 complaints were lodged on this issue, an increase of almost a quarter compared to the previous two years. The Office imposed the highest ever final fine in the area of commercial communications, amounting to almost CZK 8 million. In the case in question, the fined company had been disseminating third-party commercial communications to the e-mail addresses of its customers since 2015 without the prior consent of the recipients.

The annual report also includes findings based on the Office's consultative and analytical activities and a summary of the most important legislative changes in both the Czech Republic and the European Union.

We continue to monitor further developments in the field of personal data protection and will keep you informed. If you are interested in more detailed information, please contact the authors of the article or other members of EY Law or the EY team with whom you work.

Authors:

Kateřina Suchanová

Magdalena Hamáčková