The Czech Data Protection Authority (ÚOOÚ) shared its perspectives on several key GDPR topics during the "Privacy Days" conference held in Prague on October 1 and 2.

The Vice-President of the ÚOOÚ, Petr Jäger, addressed the "consent or pay" model, indicating that the European Data Protection Board (EDPB) adopted a position considered restrictive in its 2024 opinion. He mentioned that the "Digital Omnibus" package project could offer more flexibility, but the guidelines expected next year will have to comply with current legislation. Another Vice-President, Josef Mička, called for caution regarding GDPR amendments through this project, notably on the redefinition of the notion of personal data, in the absence of impact assessments.

The authority reported a growing workload, with the number of complaints in 2026 already exceeding the total of about 2,500 from the previous year, and warned about the insufficiency of its current capacities in view of a future amendment to the national law. Furthermore, Renáta Zbranková, Director of the Legislative and Legal Department, discussed legislative work aimed at adapting the Czech procedural framework for complaint handling in compliance with Article 77 of the GDPR and case law.

Regarding facial recognition in stadiums, Josef Mička reiterated the authority's position that such technology requires a specific and high-quality legal basis, including safeguards for individuals' rights, such as mechanisms to review access bans. He also warned that the authority's capacity to supervise areas related to artificial intelligence will depend on resources currently deemed very insufficient.

Finally, the importance of early cooperation between public sector controllers and the authority was emphasized by Renáta Zbranková to prevent privacy infringements and violations of the fundamental principles of the GDPR.