Česká národní banka


CNB > Information about the processing of personal data

Information about the processing of personal data

The Czech National Bank (hereinafter the “CNB”) is issuing this document to inform you about the processing of personal data at the CNB and about your rights relating to such processing.

1. Controller

The controller of personal data is the CNB.

You can contact the CNB at:

  • The CNB mailing centre
    Czech National Bank
    Na Příkopě 28
    115 03 Prague 1
    tel.: 224 411 111
    fax: 224 412 404
    Identification Number 48136450
  • The CNB mail room address
    Czech National Bank
    Senovážná 3
    115 03 Prague 1
    Mail room opening hours:
    Mon – Thu: 8:00 a.m. – 4:15 p.m.
    Fri: 8:00 a.m. – 3:00 p.m.
  • Electronic mail room
    e-mail: podatelna@cnb.cz
    Data box ID: 8tgaiej

2. Data protection officer

You can contact the CNB’s data protection officer at:

  • Czech National Bank
    DPO
    Na Příkopě 28
    115 03 Prague 1
  • e-mail: dpo@cnb.cz
  • Data box ID: 8tgaiej

3. Purpose of personal data processing

The purposes of personal data processing are determined by the CNB; the individual purposes of personal data processing, including more detailed information about those purposes, are given below. The CNB processes personal data only to the extent strictly necessary for the given purpose, on a proper legal basis and for as long as the personal data are necessary for the performance of the purpose.

After the purpose of personal data processing has been fulfilled, the CNB may also process the personal data for other purposes; this pertains mainly to the processing of personal data for archiving purposes in the public interest.

The CNB processes personal data for the following purposes:

performance of supervisory activities, including conduct of administrative proceedings

  • The CNB processes personal data as an administrative authority authorised to perform financial market supervision. The legal basis for this purpose of personal data processing is either the performance of a task carried out in the public interest or in the exercise of official authority, or the discharge of obligations laid down by law.
  • For this purpose, the CNB processes your essential personal data or financial personal data which it obtained either directly from you or from a different source in the exercise of its supervisory powers, or from public registers.
  • The CNB processes personal data for as long as necessary to discharge its obligations relating to financial market supervision, which means for a period of 17 years.
  • The processing of your personal data is necessary for the performance of tasks conferred on the CNB in the area of financial market supervision.
  • Your personal data may be transferred to a third country or international organisation as part of international cooperation in the area of financial market supervision. The CNB carefully considers each request for such a transfer taking into account the conditions laid down in the data protection legislation. In such cases, the CNB transfers your personal data where important grounds of public interest so require. In cases, where the derogations laid down in the personal data protection legislation, in particular the obligation of secrecy, are not applied, the CNB will notify you of this transfer before your personal data are transferred to the third country or international organisation. This notification includes information about the (non-)existence of a decision of the European Commission that the third country or international organisation to which your personal data are being transferred provides adequate personal data protection. If no such decision of the European Commission exists, this notification also includes information about appropriate safeguards to protect your personal data in connection with their transfer to the third country or international organisation.

maintenance of registers and statistics

  • The CNB processes personal data to the extent necessary to secure compliance with the duties laid down in legal regulations in the following areas:
    • administration of the Central Register of Accounts under the Act on the Central Register of Accounts, under which the CNB processes personal data in order to secure the means to detect crime and prosecute perpetrators of criminal acts and to safeguard the significant economic and financial interests and security of the Czech Republic or the European Union. In this case, the CNB processes personal data and financial information about account owners and persons authorised to operate accounts maintained by credit institutions in the Czech Republic.
    • maintenance of the Central Credit Register under the Act on Banks, under which the CNB processes personal data for the purpose of the exchange of information between banks and branches of foreign banks about the financial soundness and trustworthiness of their clients. Essential personal data, financial information and data on liabilities of natural persons carrying on business activities are processed.
    • compliance with the duties under the Act on the CNB in order to ensure statistical reporting, process and compile statistical information and compile EU statistics. The CNB processes essential personal data primarily of contact persons of reporting entities.
  • The processing of your personal data is necessary for the performance of tasks conferred on the CNB in the relevant legal rules.
  • The CNB processes information for as long as necessary to discharge its obligations arising from relevant legal rules, primarily for as long as the reason continues for including a person in the records or register as defined in relevant legal rules.

maintenance of bank accounts, provision of other financial services or sale of commemorative coins

  • In these cases, the CNB processes personal data for the purpose of entering into and duly performing a contract. The legal basis for this purpose of personal data processing is the performance of a contract or the taking of steps prior to entering into a contract.
  • For this purpose, the CNB processes your essential personal data or financial and family personal data which it obtained either directly from you or from public registers in connection with the contract.
  • The CNB processes personal data for the duration of the contractual relationship and also for as long as required by the legislation regulating the provision of banking services and measures against money laundering, which means for a period of 10 years after the contractual relationship has lapsed.
  • The provision of your personal data is necessary for the contract to be entered into and duly performed. If you do not provide your personal data, the contract cannot be entered into or duly performed, nor can steps be taken prior to entering into such a contract.

dealing with applications or suggestions

  • The CNB also processes personal data for the purpose of duly dealing with your applications or suggestions. The legal basis for this purpose of personal data processing is either the performance of a task carried out in the public interest or in the exercise of official authority, or the discharge of obligations laid down by law.
  • For this purpose, the CNB processes your essential personal data which it obtained directly from you.
  • The CNB processes personal data for as long as the application or suggestion are being dealt with and also for as long as may be necessary for exercising the CNB’s rights or claims, which means for the duration of a relevant limitation or lapse periods.

performance of contracts of supply or similar contracts

  • The CNB processes personal data for the purpose of entering into and duly performing a contract. The legal basis for this purpose of personal data processing is the performance of a contract or the taking of steps prior to entering into a contract.
  • For this purpose, the CNB processes your essential personal data which it obtained either directly from you or from public registers in connection with the contract.
  • The CNB processes personal data for the duration of the contractual relationship and also for as long as parties to the contract may exercise their rights and duties arising from the contract, which means for a period of 15 years after the contractual relationship has lapsed.
  • The provision of your personal data is necessary for the contract to be entered into and duly performed. If you do not provide your personal data, the contract cannot be entered into or duly performed, nor can steps be taken prior to entering into such a contract.

interest in working for the CNB

  • Before an employment contract or an agreement to work outside the scope of employment is signed, the CNB processes personal data for the purpose of assessing the aptitude of persons interested in working for the CNB. The legal basis for this purpose of personal data processing is the taking of steps prior to entering into a contract or the protection of the CNB’s legitimate interests.
  • For this purpose, the CNB processes your essential personal data, information about education and professional experience and information relating to criminal judgements and crimes (the extract from the Criminal Register) in cases where the integrity of the person interested in working for the CNB is being ascertained due to the nature of the work to be performed. The CNB obtains this personal data directly from you.
  • Personal data obtained from persons interested in working for the CNB, with whom no employment contract was signed, will be processed for as long as either of the parties may raise claims relating to negotiations about the contract, usually for a period of four years after the data have been obtained.
  • The provision of your personal data is necessary for steps to be taken prior to entering into the contract. If you do not provide your personal data, the contract cannot be entered into, nor can steps be taken prior to entering into such a contract.

organisation of social and educational events or competitions, entry to CNB buildings

  • In these cases, the CNB processes personal data for the purpose of control of participation in events and free capacity, also for the purpose of the protection of the CNB’s property, control of the movement of persons in CNB buildings and education about and promotion of the CNB. The legal basis for this purpose of personal data processing is therefore the protection of the CNB’s legitimate interests in those areas.
  • For this purpose, the CNB processes your essential personal data which it obtained directly from you, including your image on CCTV video recordings.
  • The CNB processes personal data for the period following an application for a social or educational event or for a competition, for the duration of the event and for as long as may be necessary for exercising the CNB’s rights or claims, which means for the duration of the relevant limitation or lapse periods. As regards the protection of property, this period is 15 years after the event was held or after entry to the CNB building was gained.

use of the services of the CNB’s special library or the CNB Archive’s research room

  • In these cases, the CNB processes personal data for the purpose of providing users with library, information and other services, providing information about services and also protecting its property, including library or archive collections. The legal basis for this purpose of personal data processing is the performance of a contract and the protection of the CNB’s legitimate interests in those areas.
  • For this purpose, the CNB processes your essential personal data which it obtained directly from you, including your image on CCTV video recordings. It also processes data about your visits, loans, orders, reservations, reminders, etc.
  • The CNB processes personal data for as long as may be necessary for exercising the CNB’s rights or claims, which means for the duration of a relevant limitation or lapse periods.

4. Manner of personal data processing and security of personal data

When processing personal data, the CNB proceeds at all times in a manner that ensures maximum security of your personal data and prevents abuse thereof. The CNB processes personal data both by automated means and manually. The CNB does not make automated decisions, i.e. decisions based solely on automated processing, which produce legal effects concerning you or similarly significantly affect you.

5. Processors and recipients of personal data

In cases where processors participate in personal data processing for the CNB, the CNB only uses processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing in which they are to participate for the CNB meets the requirements of the personal data protection legislation and ensures the protection of your rights. For this purpose, the CNB has entered with all processors into a written personal data processing contract which places an emphasis on the protection of your personal data and on safeguards for the processors’ personal data processing processes.

If the CNB discloses your personal data to another subject as a recipient, it does so solely on the basis of existing legal acts, or where necessary for protecting or exercising the rights of the CNB.

6. Transfer of personal data to third countries

We process your personal data in the Czech Republic. Nevertheless, your personal data may be transferred to a third country (a non-EU or non-EEA country for which there is no comparable level of personal data protection) or to an international organisation in connection with the individual purposes of personal data processing at the CNB. The CNB transfers personal data mainly on the basis of administrative arrangements between public authorities or bodies or where important grounds of public interest so require. More detailed information about the transfer of personal data to third countries or international organisations are provided in the sections discussing the relevant purposes of personal data processing.

7. Rights with regard to the processing of personal data

As regards your personal data, you have the right at any time to request from the CNB confirmation as to whether or not personal data are being processed, and, where that is the case, access to the personal data, rectification or erasure of the personal data and restriction of processing of the personal data, the right to receive the personal data in a structured, commonly used and machine-readable format and the right to transmit those personal data to another controller.

Where the legal basis for personal data processing is the performance of a task carried out in the public interest or in the exercise of official authority or the legitimate interests of the CNB or a third party, you have the right to object to the processing of your personal data.

In accordance with the personal data protection legislation, in order to protect your personal data, it is verified as part of each such request whether the applicant is the same person as the data subject whose personal data the request concerns. We verify this fact by comparing the applicant’s identity and information about the data subject whose personal data the request concerns. We deem delivery of the request to the data box or the applicant’s qualified electronic or authenticated signature to be sufficient verification of the applicant’s identity.

It should also be noted that some requests to exercise the above-mentioned rights may not be met due to legal restrictions.

If you consider that the CNB is processing your personal data in non-compliance with the personal data protection legislation, you may file a complaint with the Office for Personal Data Protection at any time.