GDPR in the NL CR

General Information

The controller of personal data is the National Library of the Czech Republic, a state contributory organisation established by the Ministry of Culture, with its registered office at Mariánské náměstí 190/5, 110 00 Prague 1 (hereinafter referred to as “NLCR”).

The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; hereinafter referred to as the “GDPR”) and in accordance with the relevant Czech data protection legislation.

The NLCR processes personal data of various persons in the course of its activities, in particular the personal data of:

• visitors to the Klementinum and the Central Depository in Hostivař, which are secured by a camera system;
• library users at the time of registration or provision of services;
• visitors to cultural and educational events;
• authors, translators, publishers, etc. in the performance of their tasks;
• contracting parties at the time of conclusion and performance of contracts;
• employees and trainees.

Reasons for personal data processing:

• provision of services to library users and visitors;
• own library activities;
• organisation of cultural and educational events;
• fulfilment of contractual and legal obligations;
• protection of library collections, persons and property.

Legal grounds for personal data processing:

• consent from the data subject;
• fulfilment of the contractual obligations and legal obligations of the controller;
• performance of tasks carried out in the public interest;
• legitimate interest of the controller or a third party (protection of persons and property).

Categories of processed personal data:

• identification data (e.g. name, surname, academic degree, date and place of birth, ID number, VAT number, personal number);
• contact details (e.g. address of permanent residence, delivery address, e-mail address, telephone number, data mailbox identifier);
• payment details (e.g. bank account number);
• other data necessary for performance of a contract;
• likeness and possible other data obtained through the CCTV system.

Personal data processing is carried out by the controller. Processing is carried out using computer technology or manually, in compliance with all security principles for the management and processing of personal data.

The controller obtains personal data mainly from the data subject or from freely available public sources.

The period of time for which personal data is processed is based in particular on the time limits specified in relevant contracts, in the controller's Filing and Shredding Rules, in relevant legal regulations, or on the capacity of technical systems. It is the time required to secure the rights and obligations arising from both the contractual relationship and relevant legal regulations.

Based on the foregoing, the data subject’s personal data may be transferred or disclosed only to persons, authorities or institutions who derive such right from the GDPR or from the law, or to other entities in the performance of tasks in the public interest. The processing of personal data by the National Library of the Czech Republic does not involve automated decision-making.

Data subjects have the following rights:

• Right of access to personal data (Article 15 of the GDPR)

The data subject has the right to obtain confirmation from the controller as to whether - and if so, what - personal data are being processed and more detailed information about their processing.

• Right to rectification, completion or erasure (Articles 16 and 17 of the GDPR)

The data subject has the right to rectification or completion of incomplete or inaccurate personal data, right to erasure of personal data if the conditions set out in the GDPR are met.

• Right to restriction of processing (Article 18 of the GDPR)

The data subject has the right to restrict the processing of their personal data if the conditions set out in the GDPR are met.

• Right to data portability (Article 20 of the GDPR)

When processing personal data on the grounds of consent or contract, the data subject has the right to have their personal data transferred to another controller, if technically feasible.

• Right to object (Article 21 of the GDPR)

If personal data are processed for the performance of a task in the public interest, for the purposes of the controller’s legitimate interests or in the context of direct marketing, the data subject has the right to object to the processing of personal data in accordance with the GDPR.

• Right to withdraw consent to personal data processing (Article 7 of the GDPR)

If the personal data of a data subject are processed on the basis of consent, the data subject has the right to withdraw consent to the processing of such personal data.

The department responsible for exercising the data subject's rights with the controller is: Office of the General Director. Rights can be exercised by the following means:

e-mail: gdpr@nkp.cz
data mailbox: 5qt8sy8
in writing:
Národní knihovna České republiky (National Library of the Czech Republic)
Kancelář generálního ředitele (Office of the General Director)
Mariánské nám. 190/5
110 00 Prague 1

To expedite the processing of your request, please indicate “GDPR - exercise of rights” in the subject line. The request for the exercise of rights can be downloaded here. If necessary, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

The data subject has the right to refer the matter to the supervisory authority, which is:

Úřad pro ochranu osobních údajů (Personal Data Protection Office)
Seat: pplk. Sochora 727/27, 170 00 Prague 7 – Holešovice
phone: +420 234 665 111
e-mail: posta@uoou.cz

More information about some types of processing can be found below. In some cases, the processor cannot be identified in advance, specific information will be available at the respective event.

Protection of Personal Data of Users in Providing Library and Information Services

See the Library Rules of the NL CR, Annex No. 9

CCTV System

(general information and rights as above)

• Description of activity: operation of the CCTV camera system in the controller´s buildings for the purpose of monitoring publicly accessible areas (courtyards and surroundings of the building, corridors) and shared areas in the buildings (corridors, depositories);
• Position: Controller;
• Purpose of processing: protection of controller´s property and protection of property and health of third parties;
• Legal grounds for processing: Art. 6, para 1, letter f) of the GDPR – legitimate interests of the controller or a third party – protection of the property of the Czech Republic;
• Description of categories of data subjects: third parties moving on the premises or its immediate vicinity, emplyees;
• Processing of personal data: image recording – the image of a person;
• Storage period: up to 6 months;
• Processor: ---
• Transfer of personal data: only by law;

Protection of Personal Data when Subscribing to the Newsletter of the NL CR

(general information and rights as above)

• Description of activity: distribution of the Newsletter of the NL CR in order to inform about news, invitations to events, to enable priority registration for lectures and discussions, to share selected interesting facts from the library world and exclusive content from the NL collections;
• Position: controller;
• Purpose of processing: distribution of information and marketing communications and promotion of eevents on the NL CR premises;
• Legal grounds for processing: Art. 6, para 1, letter a) of the GDPR – consent of the data subject;
• Description of categories of data subjects: third parties
• Processed personal data: name, surname, e-mail address, web tracking, click rate, open rate, type of viewer, type of mailbox, automatically generated: gender, name day;
• Storage period: until the consent is revoked
• Processor: ECOMAIL.CZ, s.r.o., IČO: 027 62 943, with its registered office at Na Zderaze 1275/15, 120 00 Praha 2;
• Transfer of personal data: ---

Protection of Personal Data when Providing ISBN/ISMN and PEP

(general information and rights as above)

• Description of activity: fulfilling the function of the National ISBN and ISMN Agency for systems of international standard numbering of books and music in the CR. Cooperation with the International ISBN and ISMN Agency and other national and group agencies. Creation and administration of the Directory of Publishers in the CR. Agenda for submitting legal deposits and voluntarily providing a copy in physical or electronic form;
• Position: controller;
• Purpose of processing: assigning ISBN or ISMN at the request of a publisher, maintaining a directory of publishers, cooperation with International ISBN and ISMN Agencies on the basis of Section 9, para 2, letter c), Act No. 257/2001 Coll., the Library Act. Care of archival collections and their building on the basis of Section 9, para 1 Act No. 257/2001 Coll., Library Act, in accordance with Section 3, para 1, letter a), Act of Non-Periodical Publications, and Section 9, para 1, letter a), Press Act;

• Legal grounds for processing: Art. 6, para 1, letter c) of the GDPR – compliance with a legal obligation to which the controller is subject; Art. 6, para 1, letter e) of the GDPR – performance of a task carried out in the public interest;

• Description of categories of data subjects: third parties – publishers and their employees
• Processed personal data: name and surname, address, identification number of self-employed natural persons, date of birth of publishers – natural persons in liberal professions, e-mail, phone number, abbreviation, web pages, signature;
• Storage period: 5 years, records in the database for unlimited time;
• Processor: ---
• Transfer of personal data (always only a part): International ISBN Agency (London, UK), International ISMN Agency (Berlin, DE), web pages and open data (wide public), libraries with the right to acquire legal deposits;

Suppliers/contractors/participants in public procurements:

(general information and rights as above)

• Description of activity: conclusion of contracts directy or through public procurements, communication with contractual partners;
• Position: controller
• Purpose of processing: to ensure operation and needs of the NL CR, the use of property etc.;
• Legal grounds for processing: Art. 6, para 1, letter b) of the GDPR – the performance of the contract; Art 6, para 1, letter c) of the GDPR – compliance with a legal obligation to which the controller is subject;
• Description of categories of data subjects: third parties, entrepreneurs, employees of third parties;
• Processsed personal data: different, depending on different types of contracts - name, surname, academic degree, Identification number/ VAT ID number of self-employed natural persons, e-mail, phone number, address, account number, date of birth, data in references/ CVs, signature;
• Storage period: usually up to a maximum of 10 years, unless otherwise provided by law;
• Processor: depends on each single contract;
• Transfer of personal data: only by law

Retraining and education

(general information and rights as above)

• Description of activity: organizing retraining courses, including professional competence exams;
• Position: controller and processor (Ministry of Education, Youth, and Sports is the controller);
• Purpose of processsing: organizing retraining courses, including exams;
• Legal grounds for processing: Art. 6, para 1, letter a) of the GDPR – consent of the data subject; Art. 6, para 1, letter b) of the GDPR - the performance of the contract; Art. 6, para 1, letter c) of the GDPR - – compliance with a legal obligation to which the controller is subject;
• Description of categories of data subjects: participants in library courses, participants in exams, examiners/ lecturers (NL staff);
• Processed personal data: name, surname, academic degree, date and place of birth, permanent residence addresss, post address, experience and education details, phone, e-mail, signature, birth registration number;
• Storage period: 3-10 years, exam records and certificates of professioal qualification are transferred to the Archive of the NL CR;
• Processor: ---
• Transfer of personal data: Ministry of Education, Youth, and Sports of the CR, Ministry of Culture of the CR

Cultural events

(general information and rights as above)

• Description of activity: organization of cultural and educational events, like exhibitions, lectures, presentations, conferencess, concerts etc. Maintaining a directory of collaborators and guests for the purpose of sending invitations, contacting potential speakers and lecturers, etc., and recording /streaming lectures;
• Position: controller
• Purpose of processing: providing services to the public, support of culture and education, project activities;
• Legal grounds for processing: Art. 6, para 1, letter f) of the GDPR – the legitimate interest; Art. 6, para 1, letter b) of the GDPR – the performance of the contract;
• Description of categories of data subjects: third parties – visitors, event participants, lecturers, employees;

• Processed personal data: different, depending on the relation to the controller: name, surname, account number, permanent address, e-mail, phone number, contact address, signature;

• Storage period: usually up to a maximum of 10 years;
• Processor: depending on each particular event;
• Transfer of personal data: streaming/publishing lectures, documentation of an event

Gifts

(general information and rights as above)

• Description of activity: support of the activity and collections managed by the NL CR;
• Position: controller
• Purpose of processing: acquisition of gifts, legacies;
• Legal grounds for processing: Art. 6, para 1, letter b) of the GDPR – the performance of the contract; Art. 6, para 1, letter f) of the GDPR – the legitimate interest;
• Description of categories of data subjects: donors, testators, and other participants in inheritance proceedings, if any;
• Processed perssonal data: name, surname, date of birth, permanent address, account number, signature;
• Storage period: 10 years, annual reports with the list of donors are stored in the Archive of the NL CR;
• Processor: ---
• Transfer of personal data: only by law

Database – National Name Authority Files

(general information and rights as above)

• Description of activity: creation and management of the database of name authorities, which is a supporting database for the Union Catalogue, Czech National Bibliography and other databases created by the NL CR. The database is created in collaboration with cooperating libraries in the CR, which are in the position of processors under the methodical guidance of the NL CR.
• Position: controller
• Purpose of processing: Art. 6, para 1, letter c) of the GDPR – compliance with a legal obligation stipulated in Section 9, para 2, letter b), Act No. 257/2001 Coll., Library Act as amended;  
• Description od categories of data subjects: third parties – authors, translators etc.
• Processed personal data: name, surname, birth surname, date of birth, place of birth, ID number of a record;
• Storage period: for unlimited time;
• Processor: the libraries involved
• Transfer of personal data: libraries, Ex Libris (ISR, EU) – system ALMA, OCLC (Ohio, USA) – system VIAF, open data, web pages – access of the wide public

Database – Dictionary of Czech Librarians

(general information and rights as above)

• • Description of activity: Dictionary of Czech Librarians, a database provides access to short biographies with information on personalities of Czech librarianship, and also to information on the development of librarianship and information science in the Czech lands from the 16th century to the present.
  • Position: controller
  • Purpose of processing: scientific research, popularization;
  • Legal grounds for processing: Art. 6, para 1, letter a) of the GDPR – consent of the data subject;
  • Description of categories of data subjects: librarians – third parties, staff;
  • Processed personal data: name and surname, birth surname, date and place of birth, academic degree, education, professional carrier, publishing activity, awards, membership in organizations, web pages, photographs;
  • Storage period: until the consent is revoked;
  • Processor: ---
  • Transfer of personal data: web pages, open data – access of the wide public

Database – Database of Czech Slavists

(general information and rights as above)

• • Description of activity: creation and management of the Database of Czech Slavists. The database is intended to feature personalities engaged professionally in Slavonic studies in the wide sense of meaning, and to present Czech specialized workplaces dedicated to Slavonic topics to any degree.
  • Position: controller
  • Purpose of processing: scientific research, popularization;
  • Legal grounds for processing: Art. 6, para 1, letter a) of the GDPR – consent of the data subject;
  • Description of categories of data subjects: personalities of Slavonic studies – third persons, staff;
  • Processed personal data: surname, name, academic degree, year of birth, address, phone number, e-mail, web pages, membership in organizations, publishing activity, workplace and its address;
  • Storage period: until the consent is revoked;
  • Processor: ---
  • Transfer of personal data: web pages, open data – access of the wide public

Database – Central Directory of Libraries and Information Institutions of the CR (CADR)

(general information and rights as above)

• Description of activity: management of the database Central Directory of Libraries and Information Institutions of the CR. The directory contains basic information on contacts, responsible persons, opening hours, and provided services etc. The CADR database is part of the Union Catalogue and serves for the performance of a task of the controller, which results from the Library Act (namely Section 9, para 2, letter a), d), f), and g) of the Library Act.
• Position: controller
• Purpose of processing: a working tool and information basis for the wide public;
• Legal grounds for processing: Art. 6, para 1, letter a) of the GDPR – consent of data subjects; Art. 6, para 1, letter e) of the GDPR – a task carried out in the public interest;
• Description of categories of data subjects: staff of libraries and information institutions;
• Processed personal data: name, surname, academic degree, e-mail, phone number, work address;
• Storage period: until the consent is revoked / for unlimited time (records are edited by the institutions that create and maintain them)
• Processor: ---
• Transfer of personal data: web pages, open data – access of the wide public, open data