In this article we would like to draw your attention to the recent judgment of the Supreme Administrative Court (9 Afs 147/2020 – 34) concerning the use of police CCTV footage by the tax administrator in order to prove the right to deduct VAT on the purchase of a car, or to challenge the submitted logbook. Although the tax subject sent the logbook in response to the tax administrator’s request, the tax administrator first asked the seller of the car to provide data and documents related to the sale of the car and then, due to doubts about the submitted logbook, asked the Police of the Czech Republic to provide information about the movement of the vehicle. The Supreme Administrative Court found such a procedure of the tax administrator to be justified, in particular because the records themselves were obtained by the Police of the Czech Republic as part of its own activities and were already available at the time of the tax administrator’s request, and also because the logbook submitted by the taxpayer did not appear credible.
 
The Police Act allows the Police of the Czech Republic to collect personal data quite broadly, if it is necessary for the performance of its tasks. The task of the Police of the Czech Republic is, among other things, to protect public order and prevent crime, which is a very general and broad formulation. It is therefore very difficult to determine where the limits of what the Police of the Czech Republic can still collect lie. In this case, the Police of the Czech Republic provided data from the so-called automatic vehicle inspection system, which records and stores data on each vehicle. Although the system is used to perform these tasks, its use in this case may be considered questionable in the light of the adequacy principle.

This case took place before the General Data Protection Regulation (GDPR) came into force. Although the Code of Tax Procedure expressly allows the tax administrator to request data necessary for tax administration from a public authority, according to the principle of primacy of application, Community law (GDPR) takes precedence over national legislation. It is therefore debatable whether such a transfer would not currently be contrary to GDPR principles, in particular in terms of limiting the purpose of processing and minimising the personal data retention period.

Author: Richard Knobloch, Tomáš Brůha