{"id":1732,"date":"2026-10-19T10:56:17","date_gmt":"2026-10-19T10:56:17","guid":{"rendered":"https:\/\/voiceguard-project.eu\/2026\/10\/19\/oznamovani-nekalych-praktik-a-gdpr-zkusenosti-z-nasi-prace-v-recku\/"},"modified":"2026-10-19T11:06:11","modified_gmt":"2026-10-19T11:06:11","slug":"oznamovani-nekalych-praktik-a-gdpr-zkusenosti-z-nasi-prace-v-recku","status":"publish","type":"post","link":"https:\/\/voiceguard-project.eu\/cs\/2026\/10\/19\/oznamovani-nekalych-praktik-a-gdpr-zkusenosti-z-nasi-prace-v-recku\/","title":{"rendered":"Oznamov\u00e1n\u00ed nekal\u00fdch praktik a GDPR: Zku\u0161enosti z na\u0161\u00ed pr\u00e1ce v \u0158ecku"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Oznamov\u00e1n\u00ed nekal\u00fdch praktik a GDPR: Zku\u0161enosti z na\u0161\u00ed pr\u00e1ce v<\/strong>&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u0158ecku<\/strong>&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Autor: MD Brainnovation, Manos Dimogerontakis<\/em>&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ve spole\u010dnosti MD Brainnovation p\u016fsob\u00edme p\u0159edev\u0161\u00edm jako konzultanti v oblasti dodr\u017eov\u00e1n\u00ed na\u0159\u00edzen\u00ed GDPR. Od p\u0159ijet\u00ed \u0159eck\u00e9ho z\u00e1kona \u010d. 4990\/2022 se velk\u00e1 \u010d\u00e1st na\u0161\u00ed pr\u00e1ce soust\u0159ed\u00ed na pomoc firm\u00e1m p\u0159i zav\u00e1d\u011bn\u00ed a revizi jejich syst\u00e9m\u016f pro oznamov\u00e1n\u00ed nekal\u00fdch praktik. Brzy jsme zjistili, \u017ee v\u011bt\u0161ina slo\u017eit\u00fdch ot\u00e1zek se v\u016fbec net\u00fdk\u00e1 samotn\u00e9ho z\u00e1kona o oznamov\u00e1n\u00ed nekal\u00fdch praktik. T\u00fdkaj\u00ed se osobn\u00edch \u00fadaj\u016f. V tomto \u010dl\u00e1nku se pod\u011bl\u00edme o to, co jsme se p\u0159i t\u00e9to pr\u00e1ci nau\u010dili z na\u0161eho pohledu.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">V\u00fdchoz\u00edm bodem je sm\u011brnice (EU) 2019\/1937 a \u0159eck\u00fd z\u00e1kon, kter\u00fd ji transponoval; oba se op\u00edraj\u00ed o GDPR. Identita oznamovatele mus\u00ed z\u016fstat pouze u osob opr\u00e1vn\u011bn\u00fdch k vy\u0159izov\u00e1n\u00ed ozn\u00e1men\u00ed. \u00dadaje, kter\u00e9 jsou zjevn\u011b irelevantn\u00ed, by nem\u011bly b\u00fdt uchov\u00e1v\u00e1ny. Ozn\u00e1men\u00ed by m\u011bla b\u00fdt uchov\u00e1v\u00e1na pouze po dobu nezbytn\u011b nutnou. Z\u00e1kon \u010d. 4990\/2022 d\u00e1le stanov\u00ed, \u017ee spole\u010dnosti s 50 a v\u00edce zam\u011bstnanci mus\u00ed jmenovat \u00fa\u0159edn\u00edka pro p\u0159ij\u00edm\u00e1n\u00ed a sledov\u00e1n\u00ed ozn\u00e1men\u00ed (\u03a5.\u03a0.\u03a0.\u0391.), a umo\u017e\u0148uje ur\u010dit\u00e1 omezen\u00ed pr\u00e1v subjekt\u016f \u00fadaj\u016f v p\u0159\u00edpadech, kdy by tato pr\u00e1va ohrozila oznamovatele nebo vy\u0161et\u0159ov\u00e1n\u00ed. Na pap\u00ed\u0159e je to jasn\u00e9. V praxi se v\u0161ak st\u00e1le znovu objevuj\u00ed \u010dty\u0159i probl\u00e9my.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Pou\u010den\u00ed 1: Spole\u010dnosti v r\u00e1mci skupiny a p\u0159ed\u00e1v\u00e1n\u00ed \u00fadaj\u016f&nbsp;<\/strong>&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Mnoho na\u0161ich klient\u016f jsou \u0159eck\u00e9 dce\u0159in\u00e9 spole\u010dnosti mezin\u00e1rodn\u00edch skupin. Skupina obvykle ji\u017e disponuje glob\u00e1ln\u00ed horkou linkou, \u010dasto provozovanou extern\u00edm poskytovatelem, p\u0159i\u010dem\u017e ozn\u00e1men\u00ed jsou posuzov\u00e1na v centr\u00e1le. P\u0159irozenou reakc\u00ed je zapojit do tohoto syst\u00e9mu \u0159eckou spole\u010dnost a pokra\u010dovat d\u00e1l. To m\u016f\u017ee fungovat, ale vy\u017eaduje to v\u00edce \u00favah, ne\u017e v\u011bt\u0161ina o\u010dek\u00e1v\u00e1. \u0158eck\u00e1 spole\u010dnost z\u016fst\u00e1v\u00e1 zodpov\u011bdn\u00e1 za sv\u016fj vlastn\u00ed kan\u00e1l, tak\u017ee \u0159e\u0161en\u00ed skupiny mus\u00ed spl\u0148ovat \u0159eck\u00e9 po\u017eadavky, v\u010detn\u011b jmenov\u00e1n\u00ed m\u00edstn\u00edho pov\u011b\u0159en\u00e9ho pracovn\u00edka. Pokud hl\u00e1\u0161en\u00ed sm\u011b\u0159uj\u00ed k mate\u0159sk\u00e9 spole\u010dnosti, je t\u0159eba definovat roli ka\u017ed\u00e9ho subjektu: kdo je spr\u00e1vcem, kdo je zpracovatelem a zda existuje spole\u010dn\u00e1 kontrola. A pokud se centr\u00e1la nebo poskytovatel platformy nach\u00e1z\u00ed mimo EHP, je vy\u017eadov\u00e1n mechanismus p\u0159ed\u00e1v\u00e1n\u00ed, jako jsou standardn\u00ed smluvn\u00ed dolo\u017eky, a posouzen\u00ed dopadu p\u0159ed\u00e1v\u00e1n\u00ed. To, co klient\u016fm rad\u00edme, je jednoduch\u00e9: zmapujte, kudy se hl\u00e1\u0161en\u00ed skute\u010dn\u011b pohybuje, od okam\u017eiku jeho pod\u00e1n\u00ed a\u017e po jeho uzav\u0159en\u00ed. Velmi \u010dasto to nikdo neud\u011blal a samotn\u00e1 mapa odhal\u00ed mezery.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Pou\u010den\u00ed \u010d. 2: \u017d\u00e1dosti o p\u0159\u00edstup od osob zapojen\u00fdch do hl\u00e1\u0161en\u00ed&nbsp;<\/strong>&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">D\u0159\u00edve \u010di pozd\u011bji n\u011bkdo, kdo je v hl\u00e1\u0161en\u00ed uveden, pod\u00e1 \u017e\u00e1dost o p\u0159\u00edstup podle GDPR. N\u011bkdy jde o up\u0159\u00edmnou snahu zjistit, jak\u00e9 \u00fadaje o n\u011bm jsou uchov\u00e1v\u00e1ny. Jindy se jedn\u00e1 o pokus zjistit, kdo ho nahl\u00e1sil. \u0158eck\u00fd z\u00e1kon umo\u017e\u0148uje spole\u010dnosti omezit pr\u00e1va za \u00fa\u010delem ochrany oznamovatele a vy\u0161et\u0159ov\u00e1n\u00ed. Vid\u011bli jsme v\u0161ak, \u017ee n\u011bkter\u00e9 spole\u010dnosti to pova\u017euj\u00ed za povolen\u00ed k \u00fapln\u00e9mu zam\u00edtnut\u00ed \u017e\u00e1dosti, a to je chyba. Omezen\u00ed je t\u0159eba posuzovat p\u0159\u00edpad od p\u0159\u00edpadu a zdokumentovat. Dot\u010den\u00e1 osoba m\u00e1 st\u00e1le n\u00e1rok na \u00fadaje o sob\u011b, pokud nic neprozrazuje toto\u017enost oznamovatele ani neohro\u017euje vy\u0161et\u0159ov\u00e1n\u00ed. V praxi to znamen\u00e1 pe\u010dliv\u00e9 redigov\u00e1n\u00ed, jasn\u00e9 od\u016fvodn\u011bn\u00ed ve spisu a odpov\u011b\u010f v lh\u016ft\u00e1ch stanoven\u00fdch GDPR. Na\u0161\u00edm doporu\u010den\u00edm je p\u0159ipravit si kr\u00e1tk\u00fd intern\u00ed postup pro tyto \u017e\u00e1dosti je\u0161t\u011b p\u0159edt\u00edm, ne\u017e doraz\u00ed prvn\u00ed z nich. Pr\u00e1v\u011b p\u0159i jejich vy\u0159izov\u00e1n\u00ed pod tlakem doch\u00e1z\u00ed k v\u011bt\u0161in\u011b chyb.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Pou\u010den\u00ed 3: Anonymita a pseudonymizace<\/strong>&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Anonymn\u00ed pod\u00e1n\u00ed st\u00ed\u017enosti zn\u00ed jako nejbezpe\u010dn\u011bj\u0161\u00ed mo\u017enost a pro oznamovatele j\u00ed \u010dasto i je. Pro organizaci v\u0161ak zt\u011b\u017euje n\u00e1sledn\u00e9 kroky, proto\u017ee nen\u00ed koho po\u017e\u00e1dat o dal\u0161\u00ed podrobnosti nebo komu poskytovat informace. Kvalitn\u00ed platformy tento probl\u00e9m \u0159e\u0161\u00ed pomoc\u00ed anonymn\u00ed schr\u00e1nky, tak\u017ee t\u00fdm pov\u011b\u0159en\u00fd p\u0159\u00edpadem m\u016f\u017ee s oznamovatelem komunikovat, ani\u017e by v\u011bd\u011bl, o koho se jedn\u00e1. Pokud je oznamovatel zn\u00e1m, doporu\u010dujeme v r\u00e1mci p\u0159\u00edpadu pou\u017e\u00edt pseudonymizaci. Toto\u017enost je uchov\u00e1v\u00e1na odd\u011blen\u011b, p\u0159\u00edstupn\u00e1 pouze pov\u011b\u0159en\u00e9mu pracovn\u00edkovi, a spis se vede pod referen\u010dn\u00edm \u010d\u00edslem. To omezuje \u0161kody v p\u0159\u00edpad\u011b sd\u00edlen\u00ed nebo \u00faniku spisu. Je v\u0161ak d\u016fle\u017eit\u00e9 m\u00edt na pam\u011bti, \u017ee pseudonymizovan\u00e9 \u00fadaje jsou pro spole\u010dnost, kter\u00e1 dr\u017e\u00ed kl\u00ed\u010d, st\u00e1le osobn\u00edmi \u00fadaji, tak\u017ee i nad\u00e1le plat\u00ed v\u0161echny povinnosti vypl\u00fdvaj\u00edc\u00ed z GDPR. Nejv\u011bt\u0161\u00edm rizikem podle n\u00e1s nen\u00ed jm\u00e9no. Je to v\u0161e kolem n\u011bj: odd\u011blen\u00ed, data, detail, kter\u00fd by mohla zn\u00e1t pouze jedna osoba. Ne\u017e jak\u00e9koli shrnut\u00ed opust\u00ed t\u00fdm pracuj\u00edc\u00ed na p\u0159\u00edpadu, m\u011bl by si ho n\u011bkdo p\u0159e\u010d\u00edst s jednou ot\u00e1zkou na mysli: mohlo by to identifikovat oznamovatele?&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Pou\u010den\u00ed \u010d. 4: Posouzen\u00ed dopadu na ochranu osobn\u00edch \u00fadaj\u016f (DPIA) nen\u00ed v \u0158ecku voliteln\u00e9<\/strong>&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u010casto se n\u00e1s ptaj\u00ed, zda je pro kan\u00e1l pro oznamov\u00e1n\u00ed podez\u0159en\u00ed z protipr\u00e1vn\u00edho jedn\u00e1n\u00ed skute\u010dn\u011b nutn\u00e9 posouzen\u00ed dopadu na ochranu osobn\u00edch \u00fadaj\u016f. V \u0158ecku je odpov\u011b\u010f ano. Seznam operac\u00ed zpracov\u00e1n\u00ed, kter\u00e9 vy\u017eaduj\u00ed posouzen\u00ed dopadu na ochranu osobn\u00edch \u00fadaj\u016f (rozhodnut\u00ed \u010d. 65\/2018, zve\u0159ejn\u011bn\u00e9 ve Vl\u00e1dn\u00edm v\u011bstn\u00edku \u010d. 1622 ze dne 10. 5. 2019), vydan\u00fd \u0158eck\u00fdm \u00fa\u0159adem pro ochranu osobn\u00edch \u00fadaj\u016f, v\u00fdslovn\u011b uv\u00e1d\u00ed zaznamen\u00e1v\u00e1n\u00ed osob v syst\u00e9mech pro oznamov\u00e1n\u00ed nekal\u00fdch praktik jako p\u0159\u00edklad zpracov\u00e1n\u00ed, kter\u00e9 m\u016f\u017ee br\u00e1nit lidem ve v\u00fdkonu jejich pr\u00e1v. Podle tohoto seznamu sta\u010d\u00ed spln\u011bn\u00ed tohoto krit\u00e9ria k tomu, aby bylo posouzen\u00ed dopadu na ochranu osobn\u00edch \u00fadaj\u016f povinn\u00e9. Z na\u0161\u00ed zku\u0161enosti je posouzen\u00ed dopadu na ochranu osobn\u00edch \u00fadaj\u016f tak\u00e9 neju\u017eite\u010dn\u011bj\u0161\u00edm dokumentem v r\u00e1mci cel\u00e9ho projektu. Nut\u00ed spole\u010dnost odpov\u011bd\u011bt na v\u00fd\u0161e uveden\u00e9 ot\u00e1zky: kam data sm\u011b\u0159uj\u00ed, kdo je vid\u00ed, jak dlouho jsou uchov\u00e1v\u00e1na a jak budou vy\u0159izov\u00e1ny \u017e\u00e1dosti o uplatn\u011bn\u00ed pr\u00e1v. M\u011blo by b\u00fdt provedeno p\u0159ed spu\u0161t\u011bn\u00edm kan\u00e1lu a revidov\u00e1no v\u017edy, kdy\u017e dojde ke zm\u011bn\u011b platformy, poskytovatele nebo struktury skupiny.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Z\u00e1v\u011bre\u010dn\u00e9 \u00favahy<\/strong>&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kan\u00e1l pro pod\u00e1v\u00e1n\u00ed st\u00ed\u017enost\u00ed funguje pouze tehdy, pokud mu lid\u00e9 d\u016fv\u011b\u0159uj\u00ed. Pokud se zam\u011bstnanci ob\u00e1vaj\u00ed, \u017ee se jejich jm\u00e9no dostane na ve\u0159ejnost, budou ml\u010det, a\u0165 u\u017e z\u00e1kon \u0159\u00edk\u00e1 cokoli. Z na\u0161eho pohledu jako konzultant\u016f v oblasti ochrany osobn\u00edch \u00fadaj\u016f je spr\u00e1vn\u00e9 dodr\u017eov\u00e1n\u00ed na\u0159\u00edzen\u00ed GDPR z\u00e1kladem pro budov\u00e1n\u00ed t\u00e9to d\u016fv\u011bry a je to n\u011bco, s \u010d\u00edm m\u016f\u017ee ka\u017ed\u00e1 organizace za\u010d\u00edt ji\u017e nyn\u00ed.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Zdroje<\/strong>&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Sm\u011brnice (EU) 2019\/1937 o ochran\u011b osob, kter\u00e9 oznamuj\u00ed\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>poru\u0161en\u00ed pr\u00e1va Unie\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Na\u0159\u00edzen\u00ed (EU) 2016\/679 (GDPR)\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0158eck\u00fd \u00fa\u0159ad pro ochranu osobn\u00edch \u00fadaj\u016f, rozhodnut\u00ed \u010d. 65\/2018, seznam posouzen\u00ed dopadu na ochranu osobn\u00edch \u00fadaj\u016f podle \u010dl. 35 odst. 4 GDPR\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>EY \u0158ecko, pr\u00e1vn\u00ed aktualita k z\u00e1konu \u010d. 4990\/2022\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Zepos &amp;amp; Yannopoulos, pozn\u00e1mka k z\u00e1konu \u010d. 4990\/2022\u00a0<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Oznamov\u00e1n\u00ed nekal\u00fdch praktik a GDPR: Zku\u0161enosti z na\u0161\u00ed pr\u00e1ce v&nbsp; \u0158ecku&nbsp; Autor: MD Brainnovation, Manos Dimogerontakis&nbsp; Ve spole\u010dnosti MD Brainnovation p\u016fsob\u00edme p\u0159edev\u0161\u00edm jako konzultanti v oblasti<span class=\"excerpt-hellip\"> [\u2026]<\/span><\/p>\n","protected":false},"author":1,"featured_media":1706,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[44],"tags":[],"class_list":["post-1732","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-centrum-znalosti"],"_links":{"self":[{"href":"https:\/\/voiceguard-project.eu\/cs\/wp-json\/wp\/v2\/posts\/1732","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/voiceguard-project.eu\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/voiceguard-project.eu\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/voiceguard-project.eu\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/voiceguard-project.eu\/cs\/wp-json\/wp\/v2\/comments?post=1732"}],"version-history":[{"count":1,"href":"https:\/\/voiceguard-project.eu\/cs\/wp-json\/wp\/v2\/posts\/1732\/revisions"}],"predecessor-version":[{"id":1733,"href":"https:\/\/voiceguard-project.eu\/cs\/wp-json\/wp\/v2\/posts\/1732\/revisions\/1733"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/voiceguard-project.eu\/cs\/wp-json\/wp\/v2\/media\/1706"}],"wp:attachment":[{"href":"https:\/\/voiceguard-project.eu\/cs\/wp-json\/wp\/v2\/media?parent=1732"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/voiceguard-project.eu\/cs\/wp-json\/wp\/v2\/categories?post=1732"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/voiceguard-project.eu\/cs\/wp-json\/wp\/v2\/tags?post=1732"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}