PRIVACY LAWS
Navigating GDPR in Slovakia: Key Deviations and Act No. 18/2018 Coll.
While the General Data Protection Regulation (GDPR) establishes a harmonized privacy framework across the European Union, it is not a standalone rulebook. Through “opening clauses,” member states have the authority to introduce national deviations to adapt the regulation to their local legal landscape.
In Slovakia, the GDPR is implemented through Act No. 18/2018 Coll. on Personal Data Protection. Regulated by the Office for Personal Data Protection of the Slovak Republic (ÚOOÚ SR), the Slovak landscape is known for its strict stance on the processing of the national birth number (rodné číslo) and a specific approach to administrative fines for public bodies.
At Complico Consulting GmbH, we specialize in decoding these localized laws to keep your operations secure, compliant, and thriving in the Heart of Europe. Here is your guide to the essential GDPR deviations in Slovakia.
1. The Age of Digital Consent Remains at 16
Under Article 8 of the GDPR, the default age for a child to provide valid digital consent (for social media, apps, and online services) is 16, though member states can lower it to 13.
The Slovak Stance: Slovakia opted not to lower this threshold. The age of valid digital consent remains firmly at 16 years old.
Compliance Action: Any business offering “information society services” directly to minors in Slovakia must ensure that users under 16 have verifiable consent from a parent or legal guardian. This is a common trap for international platforms that assume a lower threshold across the region.
2. Rigid Rules for Processing the Birth Number (Rodné číslo)
Slovakia has specific, strict requirements for the processing of the Birth Number, a unique national identifier assigned to every citizen.
The Slovak Deviation: Under Act No. 18/2018 Coll., the birth number is considered a highly sensitive identifier.
Prohibition on Publication: It is strictly prohibited to make the birth number public.
Limited Processing: Processing the birth number is generally only allowed if required by a specific law or if the data subject has provided explicit consent.
Minimization: Even when permitted, the birth number should not be used as a primary internal identifier or visible on non-essential documents.
3. Workplace Monitoring and Employee Privacy
Workplace surveillance, including video monitoring and the tracking of electronic communications, is governed by a combination of the GDPR and the Slovak Labour Code (Act No. 311/2001 Coll.).
The Slovak Deviation:
The “Prior Consultation” Rule: Before implementing any monitoring mechanism (CCTV, GPS tracking, or email monitoring), an employer must consult with employee representatives (trade unions or works councils).
Information Obligation: Employees must be informed in advance about the scope of the monitoring, the method of its implementation, and its duration.
Direct Necessity: The monitoring must be “necessary for the performance of the employer’s tasks” and must not violate the dignity of the employee.
4. Specific Exemptions for Journalism and Scientific Research
Slovakia has utilized opening clauses to provide derogations for processing data in the public and scientific interest.
The Slovak Specificity:
Journalism: Broad exemptions apply to the processing of data for journalistic, academic, artistic, or literary expression. In these cases, specific GDPR requirements (like the right to erasure or certain information obligations) may be limited to balance the right to privacy with the right to information.
Research & Statistics: Data processing for scientific, historical, or statistical purposes is allowed under specific safeguards, often involving pseudonymization to protect the identities of data subjects.
5. Administrative Fines for Public Authorities
While private companies face the full force of GDPR fines (up to €20 million or 4% of global turnover), Slovakia has established a specific cap for the public sector.
The Slovak Specificity: Under Slovak law, the ÚOOÚ SR can impose fines on public authorities and bodies. However, these fines are often capped differently than for private enterprises to ensure they are “effective, proportionate, and dissuasive” without crippling public services.
Why Partner with Complico Consulting GmbH?
Expanding into the Slovak market requires a partner who understands the high standards of the ÚOOÚ SR and the unique constraints of Act No. 18/2018 Coll. A generic EU privacy policy is rarely sufficient to meet the strict “consultation” requirements for employee monitoring or the sensitive handling of the rodné číslo.
At Complico Consulting GmbH, we provide the localized expertise you need:
Localized Compliance Audits: We evaluate your HR and marketing data flows against the specific requirements of Slovak law.
Monitoring & HR Strategy: We help you manage the mandatory consultation process with employee representatives for workplace surveillance.
Birth Number Security: We ensure your use of national ID numbers is backed by the required legal safeguards and minimization protocols.
DPO Services & Representation: We act as your bridge to the Slovak Office for Personal Data Protection, managing correspondence and representing your interests during audits.
Secure Your Presence in Slovakia
Don’t let the specificities of Slovak implementation slow down your business. Contact Complico Consulting GmbH today for a comprehensive review of your Slovak data protection strategy.