Czech Republic: New cookies and telemarketing regulation coming soon
Currently, the use of tracking technologies is based on the opt-out regime whereby website owners can use this technology if they inform the end-users of it and offer them an opportunity to refuse such processing. Users can refuse that in the settings of their web browsers.
As of 1 January 2022, the conditions for using tracking technology will change to the opt-in regime. Tracking will be permitted only after receiving prior explicit consent from individual end-users. Website administrators must also keep records of this consent. However, technical cookies and similar technologies will be allowed without consent based on a legal exception.
Consent will be required even if no personal data is collected through cookies or similar technology, and must meet the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). It must be free, specific, informed, and expressed by an unambiguous expression of will. It is crucial to ensure that the end user will have an easy option not to grant consent. Hidden or complicated options how not to grant the consent will most likely represent a breach of legal regulations.
Use these new rules as an opportunity to carry out an internal audit of all used tracking technologies on your platforms. Determine the key tracking technology and delete unnecessary or unused technology. You might be surprised how many unused tracking systems are already implemented on your platforms.
Then categorise the key cookies or other technologies based on their purposes. You should also identify all entities that manage individual cookies and entities to whom personal data is transferred. It is crucial to ensure that these entities have been engaged in line with legal regulations. Further, you must ensure that personal data is transferred outside the European Economic Area in line with the GDPR.
The new law introduced a new requirement to obtain consent before using the tracking technology. Therefore, you should select the most appropriate technical solution for recording the consent.
It is not just a theory
The Office for Personal Data Protection ('UOOU') is continuously auditing whether websites observe the conditions for processing personal data. According to its annual report, the UOOU made eight inspections in 2020. These inspections focused mainly on media-significant websites and search engines, and dealt with the correct identification of the purpose and legal grounds for processing personal data when using cookies. The UOOU also audited whether the conditions for the transfer of personal data abroad are met.
Other legislative change concerns telemarketing. When marketing products or services, companies can currently only use those phone numbers published in public registers which do not contain a specific note that the users do not wish to be contacted for marketing purposes. So, phone number owners must actively express their disagreement with telemarketing.
This will change as telemarketing will be allowed only on phone numbers published in public registers with a note that the owners wish to be contacted for marketing purposes. If the user numbers are not in the subscriber list, it will not be possible to contact them. Those who breach telemarketing restrictions face a fine up to CZK 50 million (approx. €1,958,000) or up to 10% of the net turnover for the previous financial year.
To conclude, the Czech Republic faces important changes. Privacy protection will be strengthened, and people will be better protected from unsolicited telemarketing. Using cookies and other tracking technology will require an explicit GDPR-compliant consent to be obtained from the end-users. These changes are certainly a step in the right direction towards the better protection of our privacy.