Czechia illegally stored citizens’ phone data: here’s what it means

Millions of Czechs may have had their mobile phone call and location data collected by the government without legal basis, the Supreme Court ruled on Thursday.

The data included who citizens called or texted and roughly where they were located, but not the content of the messages. Authorities, including police and intelligence services, could access the information, which was stored for six months under national law.

The case was brought by journalist Jan Cibulka, who argued that the blanket collection of operational and location data violated his right to privacy and informational self-determination. He sought an apology from the Ministry of Industry and Trade for the non-material harm caused by the improper implementation of EU rules.

The Supreme Court rejected the ministry’s appeal and confirmed that it must apologize. Chairman David Vlacil of the Supreme Court panel said the law “heads towards the preventive retention of data of virtually all users of electronic communications virtually at all times in such scope of the data that allows sensitive conclusions to be drawn about people’s private lives.”

Under the Electronic Communications Act, network operators were required to retain operational and location data for six months. While the content of messages and calls was not stored, the records could reveal who communicated with whom and where they were located. The data could be requested by the police, the Security Information Service, Military Intelligence, and in some cases, the Czech National Bank.

Earlier courts in Prague had dismissed Cibulka’s lawsuit, saying the potential risk of misuse was not concrete and that the state is not responsible for legislative activity. The Supreme Court overruled these decisions, emphasizing that the Czech Republic is liable under EU law when national legislation incorrectly implements European directives.

The court noted that while blanket data retention can have practical security uses, current Czech legislation does not comply with EU standards. It also highlighted that discussions at the EU level could lead to amendments in how operational and location data are stored in the future.

For ordinary citizens, the ruling sets an important precedent. It confirms that governments cannot store citizens’ location and call records indiscriminately and without clear legal grounds. Individuals now have legal protection against blanket data collection and the potential misuse of sensitive information about their private lives.

This ruling brings Czechia in line with other EU countries, where blanket collection of mobile phone metadata has repeatedly been struck down as a violation of privacy rights.

Similar laws in Ireland, the UK, Germany, and Belgium were amended to limit retention periods and access by authorities. Experts say the decision signals that Czech citizens’ privacy protections are now being enforced to the same standard as those in the rest of the EU.