Court case 10 As 190/2020 - 39 – Court Ruling (Czech Republic, 2022)

In 2018, the Czech DPA held that the controller, a hospital, had violated the duty to implement sufficient security safeguards under § 13 of the Czech Law on Data Protection 2000 (implementing the Data Protection Directive). The DPA issued a fine of 1,634 EUR to the controller. The controller requested a judicial review of the DPA's decision. In 2020, the City Court of Prague (MSPH) confirmed the DPA's decision. The controller subsequently requested a judicial review at the Supreme Administrative Court (NSS). The appeal's main line of argument was that under Article 40(6) of the Czech Charter of Fundamental Rights and Freedoms, the court must apply a legal act enacted after the relevant events had taken place, provided that it is more favourable to the offender. In the specific case, the controller claimed that the MSPH should have applied the new law, namely the GDPR and its implementing act - the Czech Law on Data Processing 2019 - instead of the old Law on Data Protection 2000. The controller considered the former to be more favourable in two respects. First, the controller considered that it would not have been found in violation of the duty to implement sufficient security standards under Article 32 GDPR in the same way as it was found to be under § 13 of the Law on Data Protection 2000. This is because the controller's duty to "keep electronic records" under § 13(4)(c) of the Law on Data Protection 2000§ 13(4)(c) stipulates that the controller must "keep electronic records that make it possible to identify and verify when, by whom and for what reason personal data were recorded or otherwise processed". is nowhere to be found in Article 32 GDPR which does not explicitly refer to such a specific obligation and is therefore more favourable. Second, the controller argued that even if it had been a violation of Article 32 GDPR, the DPA or the court could not have issued a fine against it. Indeed, under § 62(5) of the GDPR implementing act - the Law on Data Processing 2019 - an administrative fine shall not be issued against controllers or processors referred to in Article 83(7) GDPR which, in turn, refers to "public authorities and bodies". The controller considered itself to be a public authority or body (a hospital) and hence exempt from any administrative fine under the new law. Hence, the NSS had to consider if the newly introduced provisions were more favourable to the controller or not. Consequently, the NSS had to consider two questions. First, whether Article 32 GDPR was more favourable to the controller than § 13 of the Law on Data Protection 2000. Second, the NSS had to decide whether the controller could have benefitted from § 62(5) of the Law on Data Processing 2019 which states that the DPA shall not issue an administrative fine to public authorities and bodies as defined in Article 83(7) GDPR. First, the NSS held that the duty to implement sufficient security standards under the GDPR was not more favourable to the controller than the old law. Although § 13(4)(c) of the Law on Data Protection 2000 does not have an explicit corresponding counterpart in the GDPR, the controller also violated the more general § 13(1) which obliges the controller to "take such measures to prevent unauthorised or accidental access to, alteration, destruction or loss of personal data, unauthorised transfers, other unauthorised processing or other misuse of personal data." The NSS did not consider this duty to be less favourable to the controller than the corresponding duty under Article 32 GDPR. Second, the NSS held that the controller could not have benefitted from the exemption for public authorities and bodies from administrative fines under § 62(5) of the Law on Data Processing 2019. This was because the controller (a hospital) was not a public authority or body within the meaning of Article 83(7) GDPR. In interpreting what amounts to a public authority or body under Article 83(7) GDPR, the NSS held that such entity will normally be established by law and designed to perform tasks in the public interest. It will not have its own property and will be financed from public budgets. It is irrelevant whether it is a public institution within the meaning of Freedom of Information Act or the Public Procurement Act, or whether it keeps medical documentation. The NSS concluded that the controller is hence not such a public authority or body as it is a joint-stock company with its own assets and budget. Although it is predominantly financed by public health insurance, such funding is not public funding because the complainant receives it in return for specific services and patients not unlike private providers. Thus, although the complainant provides healthcare that is certainly in the public interest, it does not amount to a public authority or body within the meaning of Article 83(7) GDPR. Hence, the NSS held that the GDPR as implemented by the Law on Data Processing 2019 was not more favourable to the controller than the Data Protection Directive as implemented by the Law on Data Protection 2000. Consequently, the NSS held that the MSPH was correct in applying the latter and confirmed its decision.