Operator’s and Bank’s Tracking Obligations

March 20, 2020  |  Crisis and emergency measures

By Resolution No. 250 dated 18 March 2020, the Czech Government set rules and established a legal framework for tracking (on an indicative basis) the whereabouts of individuals in which COVID-19 has been confirmed. The Minister of Health is the authority assigned to implement the measure.

On 19 March 2020, the Minister of Health issued a Special Emergency Measure that takes effect on 19 March 2020 at 12:00 PM and that imposes the following rules:

Businesses engaged in providing public mobile communications network services (operators) are required to provide the Ministry of Health or an authorized Regional General Health Authority (the “Recipients”) with tracking data associated with the traffic on a particular telephone number of a particular individual during a particular period.

Banks are required to provide the Ministry of Health or an authorized Regional General Health Authority (the Recipients) with data on the time and place where an electronic payment instrument has been used by individuals who were at a place defined by the Recipients, based on the data obtained from the operators.

The data can be processed and transmitted only if ordered by the Recipient(s) and only for the particular mobile telephone number. A Recipient is only entitled to request data if the data subject is an individual infected with SARS-CoV-2 and if such individual explicitly and unambiguously grants his/her prior informed consent to data processing under the emergency measure.

Before the consent is granted, the Recipient is required to clearly inform the user at least that:

  1. the operators and banks will transmit the data or the processing results to the Recipients, who will be the data controllers;
  2. the only purpose of the data processing is to carry out an epidemiological tracking of how COVID-19 transmits and to identify at-risk population groups at the level of individual users who are at risk of COVID-19;
  3. the operators will process and transmit tracking data for up to three weeks retrospectively, and the banks will process and transmit some existing data on the use of electronic payment instruments;
  4. the data subjects may revoke their consent anytime. Data may be retained only for as long as is necessary for the given purpose. This period must never exceed 6 hours. Data that is no longer necessary, on a case-to-case basis, for achieving the purpose will be deleted immediately after the end of the processing period, but no later than by the deadline referred to in the previous clause.