1. Operational Programme and Personal Data Protection
František Nonnemann
Office for Personal Data Protection
Czech Republic

2. Introduction
How to provide control and evaluation of operational programme from personal data protection point of view?
Does Czech legislation enable us to control the effectiveness and correctness of particular projects?

3. Czech Republic situation
Operational programme in the Czech Republic are run by the public authorities – Ministry of Labour and Social Affairs, Ministry of Education, Youth and Sports, City of Prague.
Supervisor is the Ministry for Regional Development.

4. Limitation of competences
Art. 2 par 3 of the Constitution of the Czech Republic:
„State power shall serve all citizens and may be applied only in cases, within limits and by methods defined by law.“

5. Useful data For the control and evaluation are needed:
Microdata (about specific persons)
Specific aggregate data (age, gender, education etc., could be derived only from the microdata)
Microdata are personal data by term of Czech and European law.

6. Processing of personal data
Basic principle for processing of personal data is existence of legitimate and lawful purpose of processing.
Control of the effectiveness and correctness of particular operational programme (and of the use of the financial resources) is definitely legitimate.

7. Legality of processing
In order to be legal the processing of personal data has to be based on:
Consent of the data subject
Legal obligation to witch the controller is subject
Other possibilities… not applicable in this situation
Collecting, organizing, disseminating etc. Is the processing too.

8. Consent…
By the Czech DPA is the institute of consent generally problematic in the public sphere .
In this case we must think over the issue of the freedom of consent and the possibility to recall the consent too.

9. How to get the data Required data do exist. Possibilities:
Interconnection of existing databases
New central database
Both could be done only by the public authorities and on the basis of explicit legal mandate.

10. Absence of legal regulation
Lack of the legal regulation on operational programme, their control, evaluation etc. in the Czech Republic
No legal rule or act, this area is partially regulated only by the Government Resolution.

11. Conclusion
The legal regulation, genuine authorization in legal act, is necessity.
Until then the collecting and transferring of personal data about participants of operational programme is questionable and in violation of the personal data protection principles.

12. Questions?
Questions?
Thank you for your attention.