Term
Personal Data Protection Act
Act No. 18/2018 supplementing the GDPR with Slovak specifics, such as the age of a child's consent, processing of birth numbers and the powers of the Office for Personal Data Protection. It also covers areas outside the GDPR, such as criminal proceedings.
Updated
What it means
The Personal Data Protection Act is Act No. 18/2018, which supplements the EU GDPR with Slovak specifics. The GDPR applies directly in all EU countries but leaves room for national rules on some issues, which Slovakia used through this act.
The act sets, for example, the age from which a child can give consent for information society services, the processing of birth numbers, processing for journalistic and academic purposes, and the status and powers of the Office for Personal Data Protection.
It also covers areas outside the GDPR, such as the processing of personal data by competent authorities for preventing, detecting and prosecuting crime. For ordinary companies, however, what matters most is how it works together with the GDPR itself.
How it works in practice
For companies, a key point is the restriction on processing birth numbers, which may be used for identification only where a specific law allows it. Birth numbers should therefore not be collected from customers or published without reason, for example in contracts or on invoices.
A company must ensure the rights of data subjects, such as access, rectification, erasure and objection, and keep records of processing activities. Some entities must appoint a data protection officer to oversee compliance.
In the event of a personal data breach, the controller must notify the Office within the set deadline and, where the risk is high, also the data subjects. It helps to have a ready procedure for assessing, documenting and reporting incidents.
What to watch out for
The Office for Personal Data Protection can carry out inspections and impose fines for breaches of both the GDPR and the Slovak act. Fines can be high and add to reputational risk, so data protection is more than a formality.
When interpreting the rules, one should follow not only the Slovak act but also guidance from European bodies and Court of Justice case law interpreting the GDPR. The Slovak act cannot contradict the GDPR, so it is always read together with it.
Need the term explained on your own situation? Consulting from €55 / hour excl. VAT, depending on topic and complexity.