CLFR - Czech Republic

Friday, January 5, 2018 - 16:06

PROVISION OF REAL-TIME LAWFUL INTERCEPTION ASSISTANCE

ELECTRONIC COMMUNICATIONS ACT

Section 97(1) of Act No. 127/2005 Coll. on Electronic Communications (the “Electronic Communications Act”) states that a network provider is obliged on request to set up and secure an interface to enable the following authorities to carry out surveillance and recording of end telecommunication devices:

  1. the Police of the Czech Republic for the purposes set out in Section 88 of the Act No. 141/1961 Coll., the Criminal Procedure Code (the “Criminal Procedure Code”);
  2. the Security Information Service (in Czech: “Bezpečnostní informační služba”) for the purposes set out in Sections 6-8a of the Act No. 154/1994 Coll., on the Security Information Service (the “Security Information Service Act”);
  3. the Military Intelligence (in Czech: “Vojenské zpravodajství”) for the purposes set out in Section 9-10 of the Act No. 289/2005 Coll., on Military Intelligence (the “Military Intelligence Act”).

There is no obligation imposed on the providers to directly intercept the communications.

The above authorities must evidence their authorisation to conduct the surveillance and recording by presenting a written request to the service provider which: (i) includes the file number under which the court decision is administered by the respective authority; and (ii) is signed by the person liable for the conduct of surveillance and recording at the respective authority. If the request is made by the Police of the Czech Republic, it must include the file number under which the subject’s consent to surveillance is administered (if applicable).

The technical requirements for connecting with end telecommunication devices are prescribed by the Decree No. 336/2005 Coll (the “Information Decree”). This sets out the form and extent of information provided from the database of the publicly-available telephone service subscribers and on the technical and operating conditions and connection points of the message interception and recording terminal equipment.

CRIMINAL PROCEDURE CODE

Under Section 88 of the Criminal Procedure Code, the Police of the Czech Republic may only conduct surveillance and recording on the basis of an order for the surveillance and recording of a telecommunication operation. This order is issued by the competent chairman of the senate or a judge provided that the following conditions are met:

  1. a criminal proceeding is underway for one of the crimes listed in the Criminal Procedure Code;
  2. it can be reasonably presumed that the surveillance and recording will obtain important facts for the criminal proceedings; and
  3. this aim cannot be achieved by different means, or would be substantially more difficult to achieve by different means.

The above order (which is a special type of judicial decision) must be issued by: (i) the chairman of the senate of the competent court; or (ii) the judge of the competent court within the preparatory proceedings, on the basis of a motion from the state prosecutor.

For certain crimes listed in the Criminal Procedure Code, surveillance and recording can be conducted without such an order, provided that the user of the respective device consents to the surveillance.

SECURITY INFORMATION SERVICE ACT

The authorisation of the Security Information Service to request that an interface be set up and/or secured is regulated by Section 8a of the Security Information Service Act.

Under Section 9(1) of the Security Information Service Act, the Security Information Service may only conduct surveillance and recording: (i) with the prior written approval of the chairman of the senate of the competent high court; and (ii) provided that the discovery or documentation of activities by any other means would be ineffective, substantially difficult or impossible.

MILITARY INTELLIGENCE ACT

The authorisation of Military Intelligence to request that an interface be set up and/or secured is regulated by Section 9(5) of the Military Intelligence Act.

Under Section 9(1) of the Military Intelligence Act, the Military Intelligence may only conduct surveillance and recording: (i) with the prior written approval of the chairman of the senate of the competent high court; and (ii) provided that the discovery or documentation of activities by any other means would be ineffective, substantially difficult or impossible.

DISCLOSURE OF COMMUNICATIONS DATA

ELECTRONIC COMMUNICATIONS ACT

Under Sec. 97(3) of the Electronic Communications Act, a legal entity providing a public communications network or a publicly available electronic communications service (such as Vodafone) is obliged to store traffic and location data for a period of 6 months and is obliged to disclose such data (including metadata) to the following authorities on request:

  1. the police taking part in criminal proceedings, for the purposes and under the conditions prescribed by Sec. 88a of the Criminal Procedure Code;
  2. the police of the Czech Republic for the purposes listed in the Electronic Communications Act (such as preventing terrorism) and under the conditions prescribed by Sec. 66(3) of the Act No. 273/2008 Coll., on the Police of the Czech Republic (the “Police Act”);
  3. the Security Information Service for the purposes and under the conditions prescribed by Sec. 8a of the Security Information Service Act;
  4. the Military Intelligence for the purposes and under the conditions prescribed by Sec. 9 of the Military Intelligence Act; and
  5. the Czech National Bank for the purposes and under the conditions prescribed by Sec. 8 of the Act No. 15/1998 Coll, on Supervision over the Capital Market (the “Supervision Act”).

The traffic and location data (including metadata) shall be provided to the authorities listed above in the manner described in particular by Sec. 3 of the Decree No. 357/2012 Coll, on the preservation, transfer and deletion of traffic and location data”). In relation to the form and extent of the data, Sec. 97 of the Electronic Communications Act prescribes further conditions for the request of the traffic and location data, including the prior written approval of the chairman of the senate of the competent high court.

CRIMINAL PROCEDURE CODE

Under Sec. 88a of the Criminal Procedure Code, the police of the Czech Republic may only request traffic and location data on the basis of an order for the provision of such data. This order is issued by the competent chairman of the senate or a judge provided that the following conditions are met:

  1. a criminal proceeding is underway for one of the crimes listed in the Criminal Procedure Code; and
  2. this aim cannot be achieved by different means, or would be substantially more difficult to achieve by different means.

The above order (which is a special type of judicial decision) must be issued by: (i) the chairman of the senate of the competent court; or (ii) the judge of the competent court within the preparatory proceedings, on the basis of a motion from the state prosecutor.

The traffic and location data can be requested without such an order, provided that the user of the respective device consents to the provision of the data.

The government and law enforcement agencies in the Czech Republic do not appear to have any specific powers in order to compel Vodafone to disclose the content of stored communications.

Under Sec. 97(5) of the Electronic Communications Act, a provider of a publicly-available telephone service is obliged to provide the Police of the Czech Republic and the General Inspection of the Security Force on request with information from its database of participants, to the extent and in the form prescribed by the Information Decree.

NATIONAL SECURITY AND EMERGENCY POWERS

ELECTRONIC COMMUNICATIONS ACT

Under Sec. 99 of the Electronic Communications Act, a legal entity providing a public communications network or a publicly-available electronic communications service (such as Vodafone) must provide priority access to the network for emergency communication participants (i.e. Ministries and other authorities) on the basis of a request from the Ministry of the Interior. The provider is entitled to restrict or interrupt the provision of publicly-available telephone services for this purpose. The provider is obliged to inform the Czech Telecommunication Office of the restriction or interruption. The restriction or interruption must not last any longer than necessary, and access to the emergency numbers must be maintained.

POLICE ACT

The authorisation of the police of the Czech Republic and the General Inspection of the Security Forces is regulated by Sec. 35(3) of the Act No. 341/2011 Coll., on the “General Inspection of the Security Forces and Sec. 66(2) of the Police Act”.

Under Sec. 39(11) of the Police Act, the police force has the right to interfere with the operation of electronic communication devices, the network and the provision of electronic communications services in the event of a threat to human lives, health or property with a value exceeding CZK 5 million. This typically includes situations where there is a threat of terrorism.

The police are obliged to inform the integrated rescue system information point, the Czech Telecommunication Office, and to the necessary extent, the operator (provided that informing the operator will not jeopardise the police force’s fulfilment of its duties).

ACT NO. 222/1999

Act No. 222/1999 Coll, on Securing the Defence of the Czech Republic imposes further duties on legal entities and natural persons which can be requested by the Ministry of Defence and further authorities in order to ensure national security. However, this Act does not regulate any specific duties from communication service providers.

The request is filed through the competent contact points of the Police of the Czech Republic.

ACT NO. 239/2000

Moreover, under Sec. 18 of the Act No. 239/2000 Coll., on the Integrated Rescue System, providers of communication services are obliged to cooperate with the Ministry of the Interior on the preparation and resolution of emergency communications and European unified emergency numbers.

CRISIS MANAGEMENT ACT

The Act No. 240/2000 Coll, on Crisis Management (the “Crisis Management Act”) imposes further duties on legal entities and people conducting business in case of emergency. In particular, these subjects are obliged to cooperate on request in the preparation of the emergency plan (i.e. a plan which includes a list of emergency measures and procedures for emergency situations) and fulfil the duties prescribed in it. Moreover, legal entities and people can also be required to perform duties above and beyond the duties prescribed by the emergency plan. The Crisis Management Act does not regulate any specific duties from communication service providers.

A legal entity providing a public communications network or a publicly-available electronic communication service has a statutory obligation to provide the above assistance.

OVERSIGHT OF THE USE OF THESE POWERS

CRIMINAL PROCEDURE CODE

Under Sec. 88(3) of the Criminal Procedure Code, the police of the Czech Republic must continuously evaluate whether the issuance of the surveillance and recording order is still justified. If the grounds no longer exist, the police are obliged to immediately cease surveillance and recording, and notify the chairman of the senate or the competent judge who issued the order. Moreover, the state prosecutor may supervise the activities of the police of the Czech Republic (including surveillance and recording).

SECURITY INFORMATION SERVICES ACT

Under Sec. 11 of the Security Information Service Act, the competent judge is authorised to request information from the Security Information Service for the purpose of considering whether the use of surveillance and recording is still justified. The judge will cancel the approval if he/she concludes that this is not the case.

MILITARY INTELLIGENCE ACT

Under Sec. 11 of the Military Intelligence Act, the competent judge is authorised to request information from the Military Intelligence for the purpose of considering whether the use of surveillance and recording is still justified. The judge will cancel the approval if he/she concludes that this is not the case.

In addition, the activities of all of the authorities listed in this report are supervised by special supervision bodies comprising members of the Chamber of Deputies.

CENSORSHIP RELATED POWERS

SHUT-DOWN OF NETWORK AND SERVICES

CRISIS MANAGEMENT ACT

Under present law there are currently no specific regulations which would enable the Czech government to shut down Vodafone’s network or services.

Theoretically, any provider’s network could be shut down in responding to a crisis under the general principles of Act No. 240/2000 Coll. on Crisis Management but this is considered highly unlikely.

ACT ON CYBER SECURITY

Under Act no. 181/2014 Coll. on the Cyber Security, which becomes valid on 1st of January 2015, the Czech National Security Authority (“NSA”) shall be entitled to issue decisions on reactive measures to address cyber security incidents or secure information systems or networks and electronic communication services from cyber security incidents. The Act on Cyber Security provides the NSA with wide authority which may impose an obligation on Vodafone to shut down its network to the necessary extent.

BLOCKING OF URLS & IP ADDRESSES

CRIMINAL PROCEDURE CODE

Vodafone could be asked to block specific IP addresses or ranges of IP addresses under Section 8(1) of the Criminal Procedure Code. Under Section 8(1) all legal entities are generally obliged to assist police in tackling criminal matters. The police may therefore request an internet service provider (such as Vodafone) to block websites featuring illegal content. However the police do not in practice request this type of assistance from internet service providers.

ACT ON CYBER SECURITY

Under Act no. 181/2014 Coll. on the Cyber Security, the NSA shall be entitled, inter alia, to impose an obligation on Vodafone to block URLs and/or IP addresses if it concerns reacting to a cyber-security incident.

POWER TO TAKE CONTROL OF VODAFONE’S NETWORK

The government does not have legal authority to take control of Vodafone’s network.

OVERSIGHT OF THE USE OF POWERS

CRISIS MANAGEMENT ACT

There is no judicial oversight of the government’s powers under the Crisis Management Act.

ACT ON CYBER SECURITY

Act on Cyber Security does not include any special regulation and therefore decisions of the NSA are subject to judicial review.

CRIMINAL PROCEDURE CODE

A police request to an internet service provider to block certain IP addresses may be reviewed by the state prosecutor. This can be at the state prosecutor’s request; at the request of the internet service provider subject to the order; or at the request of another party to the criminal proceedings.

This information was originally published in the Legal Annexe to the Vodafone Group Law Enforcement Disclosure Report in June of 2014, which was updated in February of 2015.