Page number 4
exchange between creditor entities only subject to consent from these natural person clients. Inclusion of personal data in the NBCIR by one of the creditor entities does not automatically mean that such data is freely available to other creditor entities – any other creditor entity wishing to enquire about such data contained in the NBCIR must obtain written consent from the relevant client individually; in the case of personal data on natural person clients a principle of the so-called double consent is applied in the NBCIR. CIBR and Its Content CIBR is a database containing data on contractual (loan) relations between banks and their clients. CIBR is created on the basis of information that banks provide to CBCB and which, separately or as a whole, indicate the payment prospects and credibility of bank clients (in case of CIBR the clients´ personal data are processed mutatis mutandis in the scope as in NBCIR). Processing (in particular initial and ongoing entry or updating) of information (data) in the CIBR is not, under the applicable provisions of the Personal Data Protection Act and the Banking Act, conditional upon provision of consent from banks’ clients who are natural persons to processing of data on them in the CIBR. Dealing with information (data) in the CIBR (without making it available to the NBCIR users) shall be subject to special rules of which banks inform their clients as a part of the contractual relation between each bank and its client. These rules do not apply to the mutual information (data) exchange between the banks and creditor entities. NBCIR and CIBR – Shared Features Due to the difference outlined above, as far as concerns client’ consents to data processing in the NBCIR and CIBR, special rules shall apply to the mutual information exchange between creditor entities and banks. These rules are set forth in the Information Processing and Exchange chapter. However, there are certain features that both the NBCIR and CIBR share. These features can be characterized as follows and make the mutual exchange easier while all security as well as legal rules are complied with: - Information (data) is entered into and subsequently processed in the NBCIR and CIBR in the scope in which they can serve for assessment of payment prospects, credibility or payment discipline of clients and in which the client provided such information (data) in connection with negotiations on entering into contractual relationship or which may arise from the contractual relationship throughout its duration or in connection with administration of the respective assigned receivables. - Therefore, in particular basic identification data on clients, data on clients’ liabilities, on timeliness of the performance thereof and on security over such liabilities, etc. constitute the contents of both the NBCIR and CIBR. Personal Data Protection Act (e.g. data regarding health status, etc.). - Information (data) contained in the NBCIR and CIBR shall be regularly once in a month updated and maintained for the needs of mutual information exchange throughout the duration of the contractual relation between a bank or a creditor entity and its client and for a period of further four (4) years following the expiration thereof (including situation when bank or creditor entity exercises administration of the respective assigned receivable). If the requested agreement was not concluded with the client, information (data) shall be kept in the CIBR for a period of one (1) year and in the NBCIR for a period of six (6) months from the date of filing a client’s request for conclusion of the relevant agreement. Upon expiration of the relevant period of time, such information shall be blocked (which means that it is in an inaccessible form and it is not possible to process it) and shall not be provided for the purposes of mutual information exchange at all; following the five-year blocking period the information (data) shall be automatically liquidated. Special notification of processing of information (data) on agreements by which a consumer credit is agreed in the NBCIR and CIBR databases In compliance with the relevant provisions of Act No. 145/2010, Coll., on Consumer Credit, as amended, we wish to hereby inform you that information (data) on agreements in which a consumer credit is agreed are also processed on a standard basis within the framework of information (data) processed in the NBCIR and CIBR databases. The same rules and conditions apply to such processing as to the processing of information (data) on other types of contractual (credit-related) relationships in NBCIR and CIBR, in particular as concerns: - the purpose of information (data) processing that enables banks and creditors, prior to execution of an agreement in which a consumer credit is agreed, to mutually exchange information and assess the payment prospects and the credibility (and payment discipline) of the client (consumer), namely the client’s (consumer’s) ability to repay the consumer credit; - the extent of information (data) processing; for details see the part of CIBR – Its Content, NBCIR – Its Content and NBCIR and CIBR – Shared Features; - the information (data) processing period; for details see the part of CIBR – Its Content, NBCIR – Its Content and NBCIR and CIBR – Shared Features; it applies that information (data) on all contractual relationships (including agreements in which a consumer credit is agreed) shall be maintained for the needs of mutual information exchange throughout the duration of the relevant contractual relationship and for a period of another four (4) years following termination thereof, regardless of the method of termination of the contractual relationship (i.e. also in the event of rescission of or withdrawal from the agreement); - No sensitive personal data on natural person clients are - making information (data) available to CIBR users and processed in the NBCIR and CIBR in the sense given by the NBCIR users; for details see the part of CIBR – Its Content, 4
Page number 5
NBCIR – Its Content and NBCIR and CIBR – Shared Features; as concerns the obligation of CNCB and CBCB to allow banks and creditors from other EU member states to access information (data) contained in the NBCIR and CIBR under the same conditions as banks and creditors from the Czech Republic, CNCB and CBCB shall fulfil such obligation by allowing access to the NBCIR and CIBR databases on a non-discriminatory basis to all authorized CIBR users and/or authorized NBCIR users; - the provision of information (data) contained in the NBCIR and CIBR databases to clients; for details see the part of NBCIR – Client Centre. exclusively for the predetermined purpose, i.e. mutual information exchange between the relevant users (i.e. banks or creditor entities) on the payment prospects, credibility or payment discipline of their clients. In the mutual information (data) exchange, information (data) from the other database (i.e. data from NBCIR for creditor entities and data from CIBR for banks) shall be made available in the form of credit reports (including a possible score) upon request by the relevant users (i.e. banks or creditor entities) under the relevant agreements concluded between CBCB (as the CIBR operator) and CNCB (as the NBCIR operator) and further between CBCB and banks and CNCB and creditor entities. Birth Registration Numbers The structure of the NBCIR and CIBR databases requires that both registers will also process information on birth registration numbers of natural persons who are clients of users of the NBCIR and CIBR. The applicable legal regulation stipulates that your birth registration number can be used in the CIBR also without your consent, while in the NBCIR only subject to your prior written consent; we would like to inform you in this connection that you have no duty under the Personal Data Protection Act to grant such consent for the NBCIR. Together with additional information, your birth registration number constitutes a unique set of data which reliably identifies you in both NBCIR and CIBR databases and which will effectively prevent any confusion for another individual listed in either NBCIR or CIBR database. Therefore, you are required to provide your birth registration number in order your data is entered into either database (NBCIR or CIBR), which is why your consent to use of your birth registration number constitutes a part of the consent to personal data processing. An essential particular for the mutual information (data) exchange between the creditor entities and the banks outlined above is the existence of consent from clients who are natural persons. We would like to emphasize the following in this connection: - Inclusion of personal data in the CIBR by one of the banks or in the NBCIR by one of the creditor entities (in accordance with applicable rules of the NBCIR or CIBR) does not automatically mean that such data is freely available to other banks or creditor entities. - In order for any creditor receives any data from the NBCIR or CIBR databases, it will need your written consent again to be able to ask for such data contained in the NBCIR or CIBR. - There is certain difference for banks since banks are not required to have consent for an enquiry only to the CIBR database; however, for enquiries to the NBCIR, the banks as well as creditor entities will need your written consent. CIBR Client Centre Dealing with your birth registration number in the NBCIR or CIBR, including the purpose, time, manner of the processing and security thereof, is fully subject to the other parts of this document and to the consent to personal data processing. We also wish to inform you that the activities and services of the NBCIR Client Centre are provided to clients of creditor entities without any changes and to clients of creditor entities can continue in contacting the NBCIR Client Centre (see below). Information Processing and Exchange between Banks and The NBCIR Client Centre provides in particular the Creditor Entities following services: Information (data) on contractual relations with clients are provided by banks to CBCB in the case of the CIBR and by creditor entities to CNCB in the case of the NBCIR; CBCB further processes such data in the CIBR and CNCB in the NBCIR using the system for final automated technical data processing of the Italian company CRIF. In Italy, the information is finally technically processed in an automated manner, which is in compliance with Personal Data Protection Act, since in Italy the same rules apply to dealing with data (with personal data on clients – natural persons) as in the Czech Republic. CBCB makes the information (data) processed in this manner in the CIBR database available to the banks and, similarly, CNCB makes the information (data) processed in this manner in the NBCIR database available to creditor entities. The information shall be made available - it informs clients on data that is processed in the NBCIR (in accordance with the requirements of the Personal Data Protection Act); - it serves as a point for filing clients’ requests for information on what data is processed on clients in the NBCIR; information shall be provided for compensation for material costs necessary for provision of information; - it serves as a point for filing potential complaints or comments from clients in connection with inaccurate data processed in the CIBR. Technical and Organizational Warranties to Safeguard Information (Data) in the CIBR 5
