Assessment of legitimate interests

Assessment of a legitimate interest – the CNB’s legitimate interest in performing contracts concluded with clients or contractual partners (banking services)

The CNB has an interest in entering into and duly performing contracts concluded with clients or contractual partners, especially contracts on the maintenance of a bank account or contracts relating to the sale of numismatic material. Where the contract concerns a client or a client’s representative or a contractual partner, the CNB processes personal data of that client or representative in order to pursue this interest. This interest is not contrary to the law and cannot be pursued in any other less invasive manner than by processing personal data of the data subject. In this case, the CNB processes identification data, identification numerical data, contact information, financial information, and, where appropriate, family information of the data subject – the client or the client’s representative or the contractual partner. The data subject can expect this processing, as it is concluding a contract with the CNB or performing a contract or receiving performance of a contract. Any damage or other loss incurred by the data subject due to the processing of the data subject’s personal data (including, for example, a personal data breach) is minimal; risk stems only from a possible technical breach of security. The scope of the personal information processed has no potential to cause serious damage or any other loss to the data subject. That being said, and having considered all circumstances, the processing of personal data of the data subject is necessary for the purpose of the above legitimate interest of the CNB. At the same time, the interests or fundamental rights of the data subject requiring personal data protection take no precedence, nor prevail, over this interest.

Assessment of a legitimate interest – the CNB’s legitimate interest in the sound functioning of the CNB and the transparency and credibility of the CNB (applications and suggestions)

In this case, personal data processing is aimed at dealing with applications or suggestions, especially complaints about employees and the CNB’s processes or procedures in cases where the procedure for dealing with them is not laid down by law (hereinafter “applications or suggestions, especially complaints”). As a public body, the CNB has an interest in ensuring its sound functioning, transparency and credibility. Dealing with applications or suggestions, especially complaints, helps the CNB pursue this interest in a true and proper manner. This interest is not contrary to the law and cannot be implemented in any other less invasive manner than by processing personal data of the data subject who submits an application or suggestion, especially a complaint. In order to pursue this legitimate interest, the CNB processes identification data and contact information of data subjects – persons submitting applications or suggestions, especially complaints – to the extent necessary to deal with the applications or suggestions, especially complaints. The data subject expects that its personal data will be processed, as it provides the CNB with its personal data at its own initiative as part of an application or suggestion, especially a complaint. Any damage or other loss incurred by the data subject due to the processing of the data subject’s personal data (including, for example, a personal data breach) is minimal or, more likely, entirely ruled out. In this respect, the work duties of a CNB employee would have to be breached wilfully, but there is no reason to believe that such a breach would occur. The scope of the personal information processed has minimal potential to cause serious damage or any other loss to the data subject. That being said, and having considered all circumstances, the processing of personal data of the data subject is necessary for the purpose of the above legitimate interest of the CNB. At the same time, the interests or fundamental rights of the data subject requiring personal data protection take no precedence, nor prevail, over this interest.

Assessment of a legitimate interest – the CNB’s legitimate interest in performing contracts concluded with contractual partners (contracts concluded with suppliers or other business partners)

The CNB has an interest in entering into and duly performing contracts concluded with contractual partners. Where the contract with a contractual partner concerns an employee or representative of a contractual partner, the CNB processes personal data of that employee or representative in order to pursue this interest. This interest is not contrary to the law and cannot be pursued in any other less invasive manner than by processing personal data of data subjects. In this case, the CNB processes identification data, identification numerical data, contact information, financial information, and, where appropriate, professional information and in some cases also audio recordings of the data subject – the employee or representative of the contractual partner. The data subject can expect this processing, as he, as an employee or representative of the contractual partner concludes a contract with the CNB for the contractual partner or performs the contract or receives performance of the contract. Any damage or other loss incurred by the data subject due to the processing of the data subject’s personal data (including, for example, a personal data breach) is minimal; risk stems only from a possible technical breach of security. The scope of the personal information processed has no potential to cause serious damage or any other loss to the data subject. That being said, and having considered all circumstances, the processing of personal data of the data subject is necessary for the purpose of the above legitimate interest of the CNB. At the same time, the interests or fundamental rights of the data subject requiring personal data protection take no precedence, nor prevail, over this interest.

Assessment of a legitimate interest – the CNB’s legitimate interest in conducting tenders in an efficient manner

The CNB has an interest in conducting tenders in an efficient manner. In order to pursue this interest, the CNB maintains a list of potential contractual partners, or their employees or representatives, which enables it, among other things, to take advantage of experience gained in previous tenders and to contact potential contractual partners more efficiently. This interest is not contrary to the law and cannot be pursued in any other less invasive manner than by processing personal data of data subjects. Within these lists, the CNB processes identification data and contact information of the data subject – the contractual partner or its employee or representative (especially the contact person). The data subject can expect this processing, as the contractual partner seeks to generate profit through the supply and delivery of its line of business. Any damage or other loss incurred by the data subject due to the processing of the data subject’s personal data (including, for example, a personal data breach) is minimal or, more likely, entirely ruled out (in this respect, for example, the work duties of a CNB employee would have to be breached wilfully, but there is no reason to believe that such a breach would occur). The scope of the personal information processed has no potential to cause serious damage or any other loss to the data subject. That being said, and having considered all circumstances, the processing of personal data of the data subject is necessary for the purpose of the above legitimate interest of the CNB. At the same time, the interests or fundamental rights of the data subject requiring personal data protection take no precedence, nor prevail, over this interest.

Assessment of a legitimate interest – the CNB’s legitimate interest in protecting itself in connection with determining, performing and defending claims

The CNB has an interest in protecting its rights and interests protected by law in any dispute with a person interested in working for the CNB, especially if this person raises a claim at a court or other proceedings. In order to pursue this interest, the CNB processes personal data of persons interested in working for the CNB relating to a relevant selection procedure. This interest is not contrary to the law and cannot be pursued in any other less invasive manner than by processing personal data of the data subject. In this case, the CNB processes identification data, contact information, qualification information, professional information, and, where appropriate, identification numerical data and information about the integrity of the data subject – the person interested in working for the CNB. The data subject can expect this processing, given the growing numbers of labour disputes, especially in the case of unsuccessful applicants interested in working for the CNB. Any damage or other loss incurred by the data subject due to the processing is low; risks stem only from a generally possible technical breach of security, the human factor (although only authorised CNB staff process personal data in this case) or wrongly inputted data. That being said, and having considered all circumstances, the processing of personal data of the data subjects is necessary for the purpose of the above legitimate interest of the CNB. At the same time, the interests or fundamental rights of the data subject requiring personal data protection take no precedence, nor prevail, over this interest.

Assessment of a legitimate interest – the CNB’s legitimate interest in protecting its property

The CNB has an interest in protecting its property. It has both tangible (e.g. equipment) and intangible property (e.g. information arising from the CNB’s activities). In order to pursue this interest, the CNB processes personal data of event participants and persons entering and moving within CNB buildings. This interest is not contrary to the law and cannot be pursued in any other less invasive manner than by processing personal data of the data subject. In such cases, the CNB processes identification data of the data subject – the event participant or the person entering or moving within CNB buildings. The data subject expects this processing, for example because he applies for an event or enters a CNB building. Any damage or other loss incurred by the data subject due to the processing of the data subject’s personal data (including, for example, a personal data breach) is minimal or, more likely, entirely ruled out. The scope of the personal information processed has no potential to cause serious damage or loss to the data subject. That being said, and having considered all circumstances, the processing of personal data of the data subjects is necessary for the purpose of the above legitimate interest of the CNB. At the same time, the interests or fundamental rights of the data subjects requiring personal data protection take no precedence, nor prevail, over this interest.

Assessment of a legitimate interest – the CNB’s legitimate interest in controlling the movement of persons within CNB buildings

The CNB has an interest in controlling the movement of persons within CNB buildings for the purpose of ensuring the safety and protection of persons entering or moving within CNB buildings; this interest also indirectly safeguards the CNB’s interest in protecting its property. In order to pursue this interest, the CNB processes personal data of persons entering and moving within CNB buildings. This interest is not contrary to the law and cannot be pursued in another less invasive manner than by processing identification data and video recordings of the data subject – the person entering or moving within a CNB building. The data subject expects this processing because he enters a CNB building. Any damage or other loss incurred by the data subject due to the processing of the data subject’s personal data (including, for example, a personal data breach) is minimal or, more likely, entirely ruled out. The scope of the personal information processed has no potential to cause serious damage or loss to the data subject. That being said, and having considered all circumstances, the processing of personal data of the data subjects is necessary for the purpose of the above legitimate interest of the CNB. At the same time, the interests or fundamental rights of the data subjects requiring personal data protection take no precedence, nor prevail, over this interest.

Assessment of a legitimate interest – the CNB’s legitimate interest in properly organising and delivering events and related activities

The CNB has an interest in organising and delivering events and related activities in a proper manner. This legitimate interest also includes control of participation in events and records of capacity, including records of spare capacity at events. These events include training events, sporting events, social events, cultural events, competitions, exhibitions and displays. This interest is not contrary to the law and cannot be implemented in another less invasive manner than by processing personal data of the data subject. In the context of the above legitimate interest, the CNB processes identification data, contact information, qualification information, professional information, demographic data, psychographic data and, where appropriate, financial information of the data subject, including, where appropriate, a child as an event participant or exhibition visitor – the event participant, exhibition visitor or other data subject whose personal data are necessary to deliver an event (e.g. providers of exhibits for an exhibition). The data subject can expect his or her personal data to be processed because he or she is interested in participating in the event, or in visiting the exhibition, and, as a rule, he or she personally submits the application for an event or to visit the exhibition or is aware of the application. Any damage or other loss incurred by the data subject due to the processing of the data subject’s personal data (including, for example, a personal data breach) is minimal or, more likely, entirely ruled out (in this respect, for example, the work duties of a CNB employee would have to be breached wilfully, but there is no reason to believe that such a breach would occur). The scope of the personal information processed has no potential to cause serious damage or loss to the data subject. That being said, and having considered all circumstances, the processing of personal data of the data subjects is necessary for the purpose of the above legitimate interest of the CNB. At the same time, the interests or fundamental rights of the data subjects requiring personal data protection take no precedence, nor prevail, over this interest.

Assessment of a legitimate interest – the CNB’s legitimate interest in providing outreach (events)

The CNB has an interest in providing outreach in its areas of activity. This also concerns the provision of outreach as part of events. This interest is not contrary to the law and cannot be implemented in another less invasive manner than by processing personal data of the data subject. In the context of the above legitimate interest, the CNB processes identification data, contact information and, where appropriate, qualification information or professional information of the data subject – the event participant (especially lecturers at training events). The data subject can expect his or her personal data to be processed because he is participating in the event (especially as a lecturer at a training event) and personally submits his or her personal data in the application for the event or is aware that they have been submitted. Any damage or other loss incurred by the data subject due to the processing of the data subject’s personal data (including, for example, a personal data breach) is minimal (in this respect, for example, the work duties of a CNB employee or the duties of a third party would have to be breached wilfully, but there is no reason to believe that such a breach would occur). The scope of the personal information processed has minimal potential to cause serious damage or loss to the data subject. That being said, and having considered all circumstances, the processing of personal data of the data subjects is necessary for the purpose of the above legitimate interest of the CNB. At the same time, the interests or fundamental rights of the data subjects requiring personal data protection take no precedence, nor prevail, over this interest.

Assessment of a legitimate interest – the CNB’s interest in promoting itself

The CNB has an interest in promoting itself, among other things by organising and delivering events (competitions, for example). This interest is not contrary to the law and cannot be implemented in another less invasive manner than by processing personal data of the data subject. In the context of the above legitimate interest, the CNB processes identification data and contact information of the data subject, including, where appropriate, a child as an event participant or exhibition visitor, especially in connection with the organisation of competitions, including the provision of prizes. The data subject can expect his or her personal data to be processed because he or she is participating in the competition during an event or his or her visit to the exhibition (and, as a rule, he or she personally submits personal data or these are provided with his or her knowledge). Any damage or other loss incurred by the data subject due to the processing of the data subject’s personal data (including, for example, a personal data breach) is minimal (in this respect, for example, the work duties of a CNB employee or the duties of a third party would have to be breached wilfully, but there is no reason to believe that such a breach would occur). That being said, and having considered all circumstances, the processing of personal data of the data subjects is necessary for the purpose of the above legitimate interest of the CNB. At the same time, the interests or fundamental rights of the data subject requiring personal data protection take no precedence, nor prevail, over this interest.

Assessment of a legitimate interest – the CNB’s interest in limiting the transfer of biographical data and reports outside the CNB

In this case, personal data processing is aimed at preventing the transfer of event-related reports (personal data in reports) or biographical data outside the environment of the CNB website or the CNB’s internal information system (for example to private social media accounts). The CNB thus has an interest in limiting the transfer of event-related reports (personal data in reports) or biographical data, mainly because it provides this environment on the CNB website or in the CNB’s internal information system. This interest is not contrary to the law and cannot be implemented in another less invasive manner than by processing personal data of event participants. In the context of the above legitimate interest, the CNB processes identification data, and, where appropriate, qualification information, professional information and psychographic information of the data subject – the event participant. Given the social nature of the event, data subjects can reasonably expect that information about the event will be provided in a report and they can also expect their personal data to be processed because they provided the biographical data themselves in connection with the event (for example a lecturer at a training event) or the data were provided with their knowledge. Any damage or other loss incurred by the data subject due to the processing of the data subject’s personal data (including, for example, a personal data breach) is minimal (in this respect, for example, the work duties of a CNB employee or the duties of a third party would have to be breached wilfully, but there is no reason to believe that such a breach would occur). That being said, and having considered all circumstances, the processing of personal data of the data subjects is necessary for the purpose of the above legitimate interest of the CNB. At the same time, the interests or fundamental rights of the data subject requiring personal data protection take no precedence, nor prevail, over this interest.

Assessment of a legitimate interest – the CNB’s legitimate interest in the sound functioning of the CNB and the transparency and credibility of the CNB (press releases and other information)

In this case, personal data processing is aimed at providing the public with information through press releases and other information relating to the CNB and its activities. The CNB as a public entity has an interest in its sound functioning, transparency and credibility. The provision of information to the public through press releases and other information relating to the CNB and its activities enables it to truly and properly pursue this interest. This interest is not contrary to the law and cannot be implemented in another less invasive manner than by processing personal data of the data subject. In the context of the above legitimate interest, the CNB processes identification data, contact information, and, where appropriate, qualification information or professional information of the data subject – the person signing up for press releases and other information through the CNB Newsletter or for CNB website update notices. The data subject expects his or her personal data to be processed because he or she personally provides his or her personal data for the given purpose when signing up for the CNB Newsletter or notices. Any damage or other loss incurred by the data subject due to the processing of the data subject’s personal data (including, for example, a personal data breach) is minimal (in this respect, for example, the work duties of a CNB employee or the duties of a third party would have to be breached wilfully, but there is no reason to believe that such a breach would occur). The scope of the personal information processed has minimal potential to cause serious damage or loss to the data subject. That being said, and having considered all the above facts, the processing of personal data of the data subjects is necessary for the purpose of the above legitimate interest of the CNB. At the same time, the interests or fundamental rights of the data subject requiring personal data protection take no precedence, nor prevail, over this interest.

Assessment of a legitimate interest – the CNB’s legitimate interest in providing outreach (press releases and other information)

The CNB has an interest in providing outreach in its areas of activity, i.e. mainly in the financial market area. This interest also indirectly safeguards the public interest in increasing the financial literacy of the public. This interest is not contrary to the law and cannot be implemented in another less invasive manner than by processing personal data of the data subject. In the context of the above legitimate interest, the CNB processes identification data, contact information, and, where appropriate, qualification information or professional information of the data subject – the person signing up for press releases and other information through the CNB Newsletter or for CNB website update notices. The data subject expects his or her personal data to be processed because he or she personally provides his or her personal data for the given purpose when signing up for the CNB Newsletter or notices. Any damage or other loss incurred by the data subject due to the processing of the data subject’s personal data (including, for example, a personal data breach) is minimal (in this respect, for example, the work duties of a CNB employee or the duties of a third party would have to be breached wilfully, but there is no reason to believe that such a breach would occur). The scope of the personal information processed has minimal potential to cause serious damage or loss to the data subject. That being said, and having considered all the above facts, the processing of personal data of the data subjects is necessary for the purpose of the above legitimate interest of the CNB. At the same time, the interests or fundamental rights of the data subject requiring personal data protection take no precedence, nor prevail, over this interest.

Assessment of a legitimate interest – the CNB’s legitimate interest in ensuring the security of its information systems

The CNB has an interest in ensuring the security of its information systems. This interest is pursued by recording the access rights and activities of users, external collaborators and guests (hereinafter “guests”) in the information system. This interest is not contrary to the law and cannot be implemented in another less invasive manner than by processing personal data of the data subject. In this case, the CNB processes identification data and identification numerical data of the data subject – the user. In parallel with the expansion of information systems, emphasis is being put on the protection of those systems, with the setting of rights (e.g. authorisation and authentication) and the recording of activities (e.g. logging in) being a common part of such protection; it can thus be reasonably assumed that the data subject expects his or her personal data to be processed. Any damage or other loss incurred by the data subject due to the processing of the data subject’s personal data (including, for example, a personal data breach) is minimal or, more likely, entirely ruled out (in this respect, for example, the work duties of a CNB employee or the duties of a third party would have to be breached wilfully, but there is no reason to believe that such a breach would occur). The scope of the personal information processed has minimal potential to cause serious damage or loss to the data subject. That being said, and having considered all the above facts, the processing of personal data of the data subjects is necessary for the purpose of the above legitimate interest of the CNB. At the same time, the interests or fundamental rights of the data subject requiring personal data protection take no precedence, nor prevail, over this interest.