Information society, data protection and digital public services
Data protection
Regulation (EU) 2016/679 (GDPR) is directly applicable; Act No. 110/2019 Sb. supplements it. Processing must be lawful, fair and transparent, limited to a defined purpose, minimised, accurate, kept no longer than necessary, secure and accountable. A legal basis is required: consent, contract, legal obligation, vital interest, public task or legitimate interest. Data subjects have rights of access, rectification, erasure, restriction, portability and objection. The Office for Personal Data Protection (ÚOOÚ) supervises.
Digital public services
Act No. 365/2000 Sb. governs public administration information systems. Act No. 300/2008 Sb. governs electronic acts and data boxes (datové schránky); delivery to a data box has legal effect. Act No. 250/2017 Sb. implements electronic identification (eIDAS). Act No. 12/2020 Sb. establishes the right to digital services. Basic registers (Act No. 111/2009 Sb.) provide reference data. Czech POINT is a public administration contact point. The right to digital services means that a person may choose a digital channel where the law allows it, but it does not abolish paper filing.
Cyber security
Act No. 181/2014 Sb. governs cyber security and establishes the National Cyber and Information Security Agency (NÚKIB). Operators of essential services and digital service providers have security duties and incident reporting obligations.
Worked example
An office wants to publish a list of subsidy applicants with names, addresses and ID numbers. Reasoning: publication is processing of personal data. It needs a legal basis, a defined purpose and minimisation. Publishing full ID numbers is excessive; the office should anonymise or publish only the legally required data. Consent is not the right basis if publication is a statutory duty.
Traps
Do not say GDPR always requires consent. Do not confuse a data box with ordinary email; data box delivery has legal consequences. Do not ignore the difference between the GDPR and the Czech implementing act. Do not assume the ÚOOÚ can award damages; courts decide compensation.