TerraLex Cross-Border Guide to Global Crisis Management Regulatory Guide

Data breaches set out in Article 33 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (repealing Directive 95/46/EC (General Data Protection Regulation or GDPR) must be notified to the Office for Personal Data Protection (Data Protection Office), located in Prague.

The Data Protection Office is competent to lead any investigations related to actual and suspected data breaches.

Criminal offences Data breaches may be considered crimes under Act No. 40/2009 Coll., Criminal Code, as amended – specifically under Sections 180(2) (Unauthorized Use of Personal Data), 220 (Violation of Obligations of Trust), 230(2) (Unauthorized Access to Computer Systems and Information Media), 255 (Misuse of Information in Business Relations), 270 (Violation of Copyright, Rights Related to Copyright and Rights to Databases) and 248 (Violation of Regulations on Rules of Competition).

A company may be liable for committing the crimes described above under Act No. 418/2011 Coll., on the Criminal Liability of Legal Entities and on Proceedings against them, as amended.

Civil wrongs

Data subjects may raise civil claims in accordance with Article 82 of the GDPR and Section 81 et seq. (Personality rights of an individual) and Section 2894 et seq. (Obligations arising from torts, Compensation for pecuniary and non-pecuniary harm) of Act No. 89/2012 Coll., Civil Code, as amended.

The Office for the Protection of Competition (the Competition Office) in Brno is competent to lead any investigations into actual and suspected breaches of competition law (especially in relation to prohibited agreements between organizations).

Dawn raids are led by the Competition Office in general in accordance with Act No. 143/2001, on the Protection of Competition, as amended (Competition Act), Sections 1(4), 20a and 21 to 21h and Act No. 500/2004 Coll., on Administrative Procedures, as amended (as a general procedural Act).

The Competition Office may also directly apply Articles 101 and 102 of the Treaty on the Functioning of the European Union in individual cases should the investigated behavior have an impact on the European market (cf. especially Section 20a of the Competition Act).

As a general rule, during an investigation, organizations must provide the Competition Office with the assistance necessary to perform its powers and must submit to the exercise of those powers. The Competition Office’s officials are entitled to obtain access to business premises, open locked cabinets or cases, or otherwise gain access to business records. Every person in the business’s premises must submit to the investigation; if this obligation is not fulfilled, the Competition Office’s officials shall be entitled to obtain access to the business premises (with the assistance of locksmiths or the Police if necessary). If such access is not granted, severe sanctions may be imposed on the company, ie, up to 1% of the net early turnover (cf. Section 22a).

The Competition Office’s officials, or other persons authorized by the Competition Office, may, among other things, verify whether documents and records are business records, inspect business records found on or accessible from business premises regardless of the format in which they are stored (ie, in safes, hidden drawers, etc.) and copy or acquire copies or extracts from business records in any form. These rights can only be exercised within the defined scope of the investigated case.

The Competition Office is however not entitled to seize originals of documents or to take those documents off the business premises. The Competition Office is however allowed to make copies of any documents.

A company may refuse to submit any documentation that is covered by Attorney-Client privilege, and is thus labelled and recognizable. The Competition Office’s officials must stop investigating any document that is covered by this privilege immediately after being notified by the company that is covered by privilege or when realizing its nature.

A company may also label any information that is being provided to the Competition Office as confidential information (according to Section 504 of the Civil Code). Every person from the Competition Office is obliged to keep confidential such information, even after terminating his/her working relationship with the Competition Office. However, such company, if requested by the Competition Office, is obliged to submit a version of any document with the confidential information deleted. Confidentiality is not a legitimate reason for not providing access of the Competition Office to specific documents.

Czech law does not include any specific regulations regarding whistleblowing, so only relevant legislation applicable to all employees will apply. The employee may be protected by an internal regulation in compliance with general binding legislation.

Current Czech legislation does not include any specific protection for whistleblowers. The Czech Republic is, however, required to implement the contents of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law into Czech law by 17 December 2021. A bill on the protection of whistleblowers is currently being considered in the Czech parliament. Entities thus ought to expect new whistleblowing legislation coming into force in the near future which may require them to implement new whistleblowing policies or adjust their already existing ones

List: - Act No. 40/2009 Coll., the Criminal Code;

• Act No. 418/2011 Coll., on the Criminal Liability of Legal Entities and Proceedings against Them;

• Act No. 134/2016 Coll., on Public Procurement;

• Act No. 253/2008 Coll., on Certain Measures against the Legalization of Proceeds of Crime and the Financing of Terrorism;

• Act No. 254/2004 Coll., on Restrictions on Cash Payments;

• Act No. 37/2021 Coll., on Beneficial Owners.

Acts undertaken in the Czech Republic are judged under Czech criminal law. A crime is considered committed in the Czech Republic: - if the perpetrator committed the act in the Czech Republic even though an interest protected by criminal law was or allegedly was interfered with or jeopardized, in part or in its entirety, abroad or

• if the perpetrator committed an act abroad where an interest protected by Czech criminal law was infringed or jeopardized or the consequences of which, at least partly, occurred in the Czech Republic.

The criminality of acts undertaken by Czech citizens or stateless persons who have obtained a permanent residence permit in the Czech Republic is also considered to be under Czech law.

There are no specific enforcement bodies. The Police of the Czech Republic investigate all corruption cases and subsequently refer them to general courts. The Competition Office deals with certain aspects of public procurement tenders. Nevertheless, if the Competition Office concludes that an act of corruption occurred and consequently, that a crime was committed, it refers the matter to the Police.

Czech law does not include any specific regulation for internal investigations. In any internal investigation, the employer must always proceed in compliance with valid legislation; an internal investigation need not be notified to any specific body and no consent is required.

As there is no specific regulation regarding an internal investigation and the documents generated as part of such an investigation, only general binding legislation must be respected, specifically concerning personal data.

The rules for handling personal data obtained in an internal investigation are identical to those applicable to the handling of any other personal data. The rules for handling certain types of personal data (sensitive data) must be observed, but these rules apply to all cases of personal data processing (irrespective of the purpose for which they were obtained).

Czech law has specific legislation regarding the advice given by lawyers only in connection with legal advice given by attorneys-at-law registered with the Czech Bar Association.

There is no regulation regarding the advice given by an in-house lawyer (not an attorney-at-law) in relation to an investigation, so this advice should not be considered privileged or confidential.