Information about the processing of personal data

The Czech National Bank (hereinafter the “CNB”) is issuing this document to inform you about the processing of personal data at the CNB and about your rights relating to such processing.

We regularly update the information about the processing of personal data. This information was last updated on 1 March 2024.

The information about the processing of personal data (pdf, 319 kB) available for download.

1. Controller

The controller of personal data is the CNB.

You can contact the CNB at:

  • The CNB mailing centre
    Czech National Bank
    Na Příkopě 28
    115 03 Prague 1
    phone: 224 411 111
    fax: 224 412 404
    Identification Number 48136450
  • The CNB mail room address
    Czech National Bank
    Senovážná 3
    115 03 Prague 1
    Mail room opening hours:
    Mon–Thu: 8:00 a.m.–4:15 p.m.
    Fri: 8:00 a.m.–3:00 p.m.
  • Electronic mail room
    e-mail: podatelna@cnb.cz
    Data box ID: 8tgaiej

2. Data protection officer

The CNB’s data protection officer is Mr. Jan Rataj. You can contact him at:

  • Czech National Bank
    DPO
    Na Příkopě 28
    115 03 Prague 1
  • e-mail: dpo@cnb.cz
  • Data box ID: 8tgaiej

3. Purpose of personal data processing

The purposes of personal data processing are determined by the CNB; the individual purposes of personal data processing, including more detailed information about those purposes, are given below. The CNB processes personal data only to the extent strictly necessary for the given purpose, on a proper legal basis and for as long as the personal data are needed for the performance of the purpose.

After the purpose of processing personal data has been fulfilled, the CNB may also process the personal data for other purposes; this pertains mainly to the processing of personal data for archiving purposes in the public interest.

The CNB processes personal data for the following purposes:

  • The CNB processes personal data as an administrative authority authorised to perform financial market supervision. The legal basis for this purpose of processing personal data is either the performance of a task carried out in the public interest or in the exercise of official authority, or compliance with a legal obligation.
  • For this purpose, the CNB processes your identification data, identification numerical data, contact information and, where appropriate, qualification information, professional information, financial information and, in prescribed cases, also information about integrity or information about criminal judgements and crimes which it obtained either directly from you or from a different source in the exercise of its supervisory powers, or from public registers.
  • The CNB processes personal data for as long as is necessary to discharge its obligations relating to financial market supervision, which means for a period of 17 years.
  • The processing of your personal data is necessary for the performance of the financial market supervision tasks conferred on the CNB in compliance with the relevant legal rules. If you do not provide your personal data, the financial market supervision tasks conferred on the CNB by the relevant legal rules cannot be performed.
  • Your personal data may be transferred to a third country or an international organisation as part of international cooperation in the area of financial market supervision. In such cases, the CNB will transfer your personal data on the basis of a relevant decision of the European Commission that the third country or the international organisation ensures an adequate level of protection (Article 45 of the General Data Protection Regulation (external link)) or an administrative arrangement that covers appropriate safeguards and enforceable and effective data subject rights (Article 46(3)(b) of the General Data Protection Regulation (external link)), concretely the Administrative arrangement for the transfer of personal data between European Economic Area (“EEA”) Financial Supervisory Authorities and non-EEA Financial Supervisory Authorities. In the absence of such a decision or administrative arrangement, the CNB transfers your personal data where necessary for important reasons of public interest (Article 49(1)(d) of the General Data Protection Regulation (external link)). The CNB carefully considers each request for such a transfer taking into account the conditions laid down in the data protection legislation. In cases where the derogations laid down in the personal data protection legislation, in particular the obligation of secrecy, are not applied, the CNB will notify you of this transfer before your personal data are transferred to the third country or the international organisation. This notification includes information about the (non-)existence of a decision of the European Commission that the third country or the international organisation to which your personal data are being transferred provides adequate personal data protection. If no such decision of the European Commission exists, this notification also includes information about appropriate safeguards to protect your personal data in connection with their transfer to the third country or the international organisation.

  • The CNB processes personal data to the extent necessary to discharge the obligations laid down by law in the following areas, or to perform a task carried out in the public interest or in the exercise of official authority in the monetary policy area:
    • administration of the Central Register of Accounts under the Act on the Central Register of Accounts, under which the CNB processes personal data in order to supply funds used to detect crime and prosecute perpetrators of criminal acts and to uphold the economic and financial interests and ensure the security of the Czech Republic or the European Union. In this case, the CNB processes identification data, identification numerical data, contact information and financial information about account owners and persons authorised to operate accounts maintained by credit institutions in the Czech Republic which it obtained from entities obliged to provide data to the relevant register.
    • maintenance of the Central Credit Register under the Act on Banks, under which the CNB processes personal data for the purpose of exchanging information between banks and branches of foreign banks about the financial soundness and trustworthiness of their clients. The CNB processes identification data, identification numerical data, contact information and financial information of natural persons carrying on business activities which the CNB obtained from entities obliged to provide data to the relevant register.
    • the discharge of obligations or the performance of tasks carried out in the public interest or in the exercise of official authority in the monetary policy area under the Act on the CNB in order to ensure a statistical survey or reporting, to process and compile statistical information and to compile EU statistics. The CNB processes the identification data and contact information primarily of contact persons of reporting entities which it obtained from the reporting entities.
  • The CNB processes information for as long as is necessary to discharge its obligations arising from the relevant legal rules, in particular for as long as the reason continues for including a person in records or a register as defined in the relevant legal rules.

  • In such cases, the CNB processes personal data for the purpose of entering into and duly discharging the obligations arising from a contract. The legal basis for this purpose of processing personal data is the performance of a contract or the taking of steps prior to entering into a contract, or the CNB’s legitimate interest in performing a contract concluded with a client or a contractual partner or compliance with a legal obligation.
  • For this purpose, the CNB processes your identification data, identification numerical data, contact information, financial information and, where appropriate, family information which it obtained either directly from you or from public registers in connection with the contract.
  • The CNB processes personal data for the duration of the contractual relationship and also for as long as required by the legislation regulating the provision of banking services and measures against money laundering, which means for a period of 10 years after the contractual relationship has been terminated.
  • The provision of your personal data is necessary for the contract to be entered into and duly performed. If you do not provide your personal data, the contract cannot be entered into or duly performed, nor can steps be taken prior to entering into such a contract.

  • The CNB also processes personal data for the purpose of duly dealing with your applications or suggestions. The legal basis for this purpose of processing personal data is the performance of a task carried out in the public interest or in the exercise of official authority, or compliance with a legal obligation; where the procedure for dealing with applications or suggestions (especially complaints about CNB employees or about a process or procedure of the CNB) is not laid down by law, the legal basis is the CNB’s legitimate interest in ensuring the sound functioning of the CNB and the transparency and credibility the CNB.
  • For this purpose, the CNB processes your identification data and contact information which it obtained directly from you.
  • The CNB processes personal data for as long as the application or suggestion are being dealt with and also for as long as may be necessary for exercising the CNB’s rights or claims, which means for the duration of the relevant limitation or lapse periods.

  • The CNB processes personal data of its supplier or other business partner (hereinafter the “contractual partner”) and an employee or representative of the contractual partner for the purpose of entering into a contract and duly discharging the obligations arising therefrom and also for the purpose of maintaining a list of potential contractual partners and their employees or representatives. The legal basis for processing personal data of a contractual partner is the performance of a contract or the taking of steps prior to entering into a contract; the legal basis for processing personal data of an employee or representative of the contractual partner is the CNB’s legitimate interest in performing a contract concluded with a contractual partner; the legal basis for processing personal data on the list of potential contractual partners and their employees or representatives is the CNB’s legitimate interest in conducting tenders in an efficient manner.
  • For this purpose, the CNB processes your identification data, identification numerical data, contact information, financial information and, where appropriate, professional information and in some cases (e.g. contracts relating to financial markets operations) also audio recordings (recordings of phone conversations). The CNB obtained these data directly from you or from your contractual partner (your employee or the entity you represent) or from public registers in connection with a contract.
  • The CNB processes personal data for the duration of the contractual relationship and also for as long as either of the parties to the contract may raise claims relating to the contract, which means for a period of 15 years after the contractual relationship has been terminated. The CNB processes audio recordings usually for 90 days after they were made.
  • The provision of your personal data is necessary for the contract to be entered into and duly performed. If you do not provide your personal data, the contract cannot be entered into or duly performed, nor can steps be taken prior to entering into such a contract.

  • The CNB processes personal data in connection with a selection procedure for persons interested in signing an employment contract or an agreement to work outside the scope of employment. The legal basis for this purpose of processing personal data is the taking of steps prior to entering into a contract or the protection of the CNB’s legitimate interests.
  • For this purpose, the CNB processes your identification data, contact information, qualification information, professional information and, where appropriate, identification numerical data, as well as information about integrity in cases where the integrity of a person interested in working for the CNB is being ascertained due to the nature of the work to be performed. The CNB obtains these personal data directly from you.
  • Personal data obtained from persons interested in working for the CNB with whom no employment contract was signed will be processed for as long as either of the parties may raise claims relating to negotiations about the contract, usually for a period of four years after the data have been obtained.
  • The provision of your personal data is necessary for steps to be taken prior to entering into the contract. If you do not provide your personal data, the contract cannot be entered into, nor can steps be taken prior to entering into such a contract.

  • In these cases, the CNB processes personal data for the purpose of providing users with library, information and other services. As regards the services of the CNB’s special library, the legal basis of personal data processing is the performance of a contract or the taking of steps prior to entering into a contract. As regards the CNB Archive’s research room, the legal basis of personal data processing is compliance with legal obligations or the performance of a task carried out in the public interest or in the exercise of official authority.
  • For this purpose, the CNB processes your identification data, contact information and also service data which it obtained directly from you.
  • As regards the CNB’s special library, personal data are processed for the duration of the contractual relationship and also for as long as may be necessary for exercising the CNB’s rights or claims, which means for the duration of a relevant limitation or lapse periods. As regards the services of the CNB’s Archive research room, personal data are maintained for the period necessary to comply with the CNB’s duties in the provision of services of the CNB’s Archive research room, i.e. for a period of 5 years.
  • The provision of your personal data is necessary for the contract to use the services of the CNB’s special library to be entered into and duly performed. If you do not provide your personal data, the contract cannot be entered into or duly performed, nor can steps be taken prior to entering into such a contract. As regards the CNB’s Archive research room, the processing of your personal data is necessary for compliance with legal obligations. If you do not provide your personal data, you cannot use the services of the CNB’s Archive research room.

  • In such cases, the CNB processes personal data for the purpose of sending out press releases and other information relating to the CNB and its activities through the CNB Newsletter, the CNB Research News or CNB website update notices. The legal basis for this purpose of processing personal data is the CNB’s legitimate interest in ensuring the sound functioning of the CNB, the transparency and credibility of the CNB  and the CNB’s legitimate interest in providing outreach. In order to balance the CNB’s above legitimate interest, you may use the option of opting out of processing at any time; you may opt-out of processing within every delivered e-mail with an attached press release or other information relating to the CNB and its activities.
  • For this purpose, the CNB processes your identification data, contact information and, where appropriate, qualification information or professional information which it obtained directly from you.
  • The CNB keeps personal data only for as long as you are interested in receiving press releases and other information relating to the CNB and its activities.
  • The provision of your personal data is necessary for sending out information contained in press releases and other information relating to the CNB and its activities. If you do not provide your personal data, these press releases or this information cannot be sent to you.

  • In such cases, the CNB processes personal data for the purpose of logging users’ activities and access to information systems and logging access to the CNB’s assets. The legal basis for this purpose of processing personal data is the protection of the CNB’s legitimate interests in the field of information system security and compliance with legal duties in the field of cyber security.
  • For this purpose, the CNB processes your identification data as well as identification numerical data which it obtained from another source (the relevant information system).
  • In the case of recording activities and access to information systems and recording access to the CNB’s assets, personal data are maintained for as long as personal data are maintained in the CNB’s relevant assets. The CNB also processes personal data for as long as needed to ascertain, analyse and assess security incidents and their possible consequences, but for no longer than 18 months after the record was made. In the case of recording access rights to the CNB’s information systems, the CNB processes personal data for no longer than 12 months after the user’s access rights expired or his/her activities ended.

4. Manner of processing and securing personal data

When processing personal data, the CNB proceeds at all times in such a way as to ensure maximum security of your personal data and prevent abuse thereof. The CNB processes personal data both by automated means and manually. The CNB does not make any automated decisions, i.e. decisions based solely on automated processing, which would have legal consequences for you or significantly affect you in any similar way.

5. Processors and recipients of personal data

In cases where processors participate in personal data processing for the CNB, the CNB only uses processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing in which they are to participate for the CNB will meet the requirements of the personal data protection legislation and ensure the protection of your rights. For this purpose, the CNB has entered into written personal data processing contracts with all processors, emphasising the protection of your personal data and safeguards upon its processing carried out by the processors.

If the CNB discloses your personal data to another subject as a recipient, it does so solely on the basis of existing legal acts, or where necessary for protecting or exercising the rights of the CNB. The recipients include public authorities authorised to obtain personal data in accordance with legal rules (where they obtain personal data otherwise than during a special investigation which they are authorised to perform), parties to proceedings and members of the Appeals Committee, financial institutions, persons applying for information from registers maintained by the CNB and contractual partners (suppliers and other business partners, including all processors). In cases laid down by law, the CNB submits personal data to supervisory authorities and central banks in EU Member States and also to EU institutions.

6. Transfer of personal data to third countries

We process your personal data in the Czech Republic. Nevertheless, your personal data may be transferred to a third country (a non-EU or non-EEA country) or to an international organisation in connection with the individual purposes of personal data processing at the CNB. The CNB transfers personal data on the basis of a relevant adequacy decision of the European Commission or an administrative arrangement that covers appropriate safeguards and enforceable and effective data subject rights, and in the absence of such decision or administrative arrangement, where necessary for important reasons of public interest. More detailed information about the transfer of personal data to third countries or international organisations are provided in the sections discussing the relevant purposes of personal data processing.

7. Rights relating to the processing of personal data

As regards your personal data, you have the right at any time to request from the CNB confirmation as to whether or not personal data are being processed, and, where that is the case, access to the personal data, rectification or erasure of the personal data and restriction of processing of the personal data, the right to receive the personal data in a structured, commonly used and machine-readable format and the right to transmit those personal data to another controller.

Where the legal basis for personal data processing is the performance of a task carried out in the public interest or in the exercise of official authority as well as the legitimate interests of the CNB or a third party, you have the right to object to the processing of your personal data.

In accordance with the personal data protection legislation, in order to protect your personal data, it is verified as part of each such request whether the applicant is the same person as the data subject whose personal data the request concerns. We verify this fact by comparing the applicant’s identity and information about the data subject whose personal data the request concerns. We deem delivery to a data box or the applicant’s qualified electronic or authenticated signature to be sufficient verification of the applicant’s identity.

It should also be noted that some requests to exercise the above-mentioned rights may not be met due to legal restrictions.

If you consider that the CNB is processing your personal data in non-compliance with the personal data protection legislation, you may file a complaint with the Office for Personal Data Protection at any time.