An elite outlaw force: how the NCOZ systematically crosses borders

In a state governed by the rule of law, there is a tacit agreement between the citizen and the state: the stronger the powers of the public authority, the more strictly it must obey the law. This is doubly true for the elite units of the Police of the Czech Republic. It is precisely for this reason that it is extremely worrying when there are repeated cases where the actions of such a body - specifically the National Organized Crime Agency (NCOZ) - depart from these basic safeguards.

At the same time, these are not individual excesses that could be explained by the failure of an individual. The repetition of a similar procedure points to something much more serious: a systemic problem in the handling of personal data. Indeed, in specific cases, there is not a selective and justified transfer of relevant information, but the provision of extensive sets of documents, which together create a complex personal and psychological profile of an individual. Such a procedure cannot be characterized other than as an unreasonable invasion of privacy.

At the same time, the legal framework is unambiguous. According to § 115, paragraph 3 of the Law on the Police of the Czech Republic, data can only be provided if they are necessary for the performance of the tasks of the recipient. In Article 5, the GDPR Regulation expressly establishes the principle of minimization and purposeful limitation. In other words: the state may hand over only what is really necessary. Nothing more.

However, the reality is different in some cases. In lieu of the necessary data, entire files are handed over - including psychological assessments, their justifications, appendices, historical materials and evaluation conclusions. These documents often contain sensitive information about an individual's mental state and personality traits. According to Article 9 GDPR, this is a special category of data subject to increased protection. Making them widely available without a demonstrable limitation of scope constitutes an intervention that cannot be considered proportionate.

However, the fundamental problem is not only the scope of the handover. Even more significant is the fact that these decisions are not haphazard or marginal. On the contrary, they bear the marks of a conscious and systematic procedure. If the documents are repeatedly signed by the director of the department, there can be no talk of administrative misconduct. It is a decision made at the highest level of management, i.e. the exercise of the authority of a leading official.

This takes the matter to a completely different level. Responsibility is no longer dispersed among individual officers, but concentrated at the management level. And this is where the crucial question arises: how is it possible that an elite body tasked with upholding the rule of law repeatedly treads on the edge of the law - and sometimes apparently oversteps it?

Even more worrying is the reaction of the control mechanisms. If supervisory authorities conclude that "substantive jurisdiction is not given" without objectively addressing the intensity of the intervention, the nature of the data transferred and the decision-making role of the department's management, another shift occurs. Control becomes formal, not real. Instead of ensuring accountability, it diffuses it.

Such a situation is dangerous for the rule of law. The right to privacy under Article 10 of the Charter of Fundamental Rights and Freedoms is not an empty declaration. It is a basic guarantee to protect individuals from unreasonable state intervention. However, if the state begins to treat personal data as material that can be transferred between institutions as needed without strict restrictions, this guarantee will be emptied.

The argument that it is cooperation with the court does not hold up in this context. Collaboration is not limitless. It is always limited by the principle of necessity. Once this principle is repeatedly ignored, it is not an interpretation of the law, but a distortion of it.

The wider implications cannot be overlooked either. If an elite police force sends a signal that the scope of intrusion into privacy can be expanded at internal discretion, it undermines public confidence in the legality of the exercise of public authority. And without that trust, the rule of law becomes an empty construct.

So this is not an individual case or a personal dispute. The question is whether the basic balance between the power of the state and the protection of the individual will be maintained. If this balance is to be maintained, a simple rule must apply: the higher the authority's status and authority, the stricter its responsibility must be.

Otherwise, we end up in a situation where the elite, who have the right to protect, bend the rules themselves. And that is not the failure of an individual. This is a system problem.

Source:

EU (2016)Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Article 5 - Principles for the processing of personal data. Available from:https://gdpr-ext.com/cs/read/article-5/
Ministry of the Interior of the Czech Republic (n.d.)Principles of personal data processing according to the GDPR. Available from:https://mv.gov.cz/gdpr/clanek/zasady-zpracovani-osobnich-udaju.aspx

Police of the Czech Republic (n.d.)Processing of personal data by the Police of the Czech Republic. Available from:https://policie.gov.cz/clanek/zpracovani-osobnich-udaju-policii-ceske-republiky.aspx