Attitude of the CZSO to the Relationship of the GDPR and the Reporting Duty pursuant to the Act on the State Statistical Service
The Czech Statistical Office (hereinafter referred to also as “the CZSO”) hereby responses to frequent questions about performance of the reporting duty pursuant to the Act on the State Statistical Service1 (hereinafter referred to also as “the Act on the SSS”) after the General Data Protection Regulation,2 known under the abbreviation GDPR (hereinafter referred to also as “GDPR”), comes into force.
GDPR and its scope
The General Data Protection Regulation is a new uniform legal framework for personal data protection in the EU, which directly lays down rules for personal data processing. The GDPR unifies legal regime for personal data within the entire European Union and it is directly applicable in all EU Member States. Since the date it takes effect, i.e. since 25 May 2018, controllers and processors of personal data, i.e. also the Czech Statistical Office, are obliged to fulfil duties resulting from the GDPR.
The GDPR applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.3 “Personal data” means any information relating to an identified or identifiable natural person (“data subject”).4 The GDPR does not apply to processing of personal data of legal persons nor does it apply to processing of anonymous information, including its processing for statistical purposes.5
GDPR AND STATISTICS
The GDPR considers processing of personal data for statistical purposes to be one of the special types of processing. When personal data are processed for statistical purposes, the GDPR applies to such processing (with the exception of the aforementioned anonymous information or data rendered anonymous or information on legal persons). However, in many cases, the GDPR provides for exemptions regarding processing for statistical purposes, which means that some effects of the GDPR are mitigated in order not to endanger performance of the State Statistical Service.6
What results from Article 89 of the GDPR (that regulates safeguards and derogations from some special processing, including processing for statistical purposes) is especially the duty to thoroughly secure (technically as well as in terms of organization) personal data processed for statistical purposes and to respect the principle for data minimisation. Protection of confidential statistical data is already a priority for the CZSO and data are properly protected and secured in accordance with valid legal regulations.7
It has to be pointed out that the GDPR is a general regulation for personal data protection; however, statistical content, control of access, specifications for the processing of personal data for statistical purposes and appropriate measures to safeguard the rights and freedoms of the data subject and for ensuring statistical confidentiality are to be regulated by Union or Member State law.8 The Act on the State Statistical Service is such a special regulation for the performance of the State Statistical Service in the Czech Republic.
Processing of personal data for statistical purposes is therefore in no sense in contradiction to the principles of personal data protection under the GDPR; on the contrary, it is a special category of processing, which is provided not only a basic protection to (under the general regulation of the GDPR), but also a protection under special legal regulations.
REPORTING DUTY PURSUANT TO THE ACT ON THE SSS IN RELATION TO THE GDPR
The Czech Statistical Office, as a body performing the State Statistical Service pursuant to the Act on the SSS, ensures, inter alia, obtaining and processing of data for statistical purposes.9 One of the ways to ensure obtaining of these data is to impose a reporting duty.
The reporting duty is imposed by the Act on the SSS and it means the duty of reporting units to provide required individual statistical data timely, correctly, and truthfully for statistical surveys, which are enlisted in the Programme of Statistical Surveys,10 in which case a reporting unit is a legal person, organizational unit of the state, or a natural person that are requested to provide individual data in a statistical survey.11
The CZSO processes personal data from statistical surveys to fulfil its legal obligation, which applies to the CZSO under the Act on the SSS, and reporting units are obliged to provide the necessary pieces of data to the Czech Statistical Office for the performance of the State Statistical Service. Since processing of personal data is based on law, consent of the data subject is not necessary for the processing.
CONCLUSION
The Czech Statistical Office fully respects the new European legal framework for personal data protection and adds that confidential statistical data are already thoroughly protected and secured under special legal regulations.
The CZSO at the same time underlines that performance of the State Statistical Service is regulated by the Act on the State Statistical Service in particular, based on which it is also obliged to ensure obtaining and processing of data for statistical purposes, including personal data of reporting units. Consent of the data subject is not necessary for the aforementioned processing of personal data.
1 Act No 89/1995 Sb, on the State Statistical Service, as amended
2 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
3 Article 2 par. 1 of the GDPR
4 Article 4 (1) of the GDPR
5 Recitals 14 and 26 in the preamble to the GDPR
6 E.g. the exemption in Article 5 par. 1(b) of the GDPR lays down that a statistical purpose pursuant to Article 89 par. 1 is not considered to be incompatible with original purposes. Other exemptions e.g. in Article 5 par. 1(e), Article 9 par. 2(j), Article 14 par. 5(b), Article 17 par. 3(d), Article 21 par. 6.
7 E.g. Regulation (EC) No 223/2009 of the European Parliament and of the Council on European statistics; Act No 89/1995 Sb, on the State Statistical Service; Act No 181/2014 Sb on Cyber Security; Act No 101/2000 Sb on Personal Data Protection, etc.
8 Recital 162 in the preamble to the GDPR
9 Section 3 par. 1 and Section 4 par. 1 of the Act on the SSS
10 Section 2(j) of the Act on the SSS
11 Section 2(i) of the Act on the SSS
