Art. 87

Member States may further determine the specific conditions for the processing of a national identification number or any other identifier of general application. In that case the national identification number or any other identifier of general application shall be used only under appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation.

Art. 8

(…).

7. Member States shall determine the conditions under which a national identification number or any other identifier of general application may be processed.

Act No. 133/2000 Coll., on the Population Register and Personal Identification Numbers and on Amendments to Certain Acts (the Population Register Act), as amended

TITLE III

BIRTH NUMBERS

Art. 13

(…)

(9) Only the natural person to whom a birth number has been assigned (hereinafter referred to as the “birth number holder”) or their legal representative is authorized to use the birth number or decide on its use within the limits set by law (hereinafter referred to as “handling the birth number”); otherwise, the birth number may be used only in the cases specified in Article 13c of this Act.

Art. 13c

(1) Birth numbers may be used only

(a) in connection with the activities of ministries, other administrative authorities, bodies entrusted with the exercise of state administration, or courts, arising from their statutory powers, or by notaries for the purposes of maintaining the Central Register of Wills,

(b) if so provided by a special Act,

(c) if necessary for the enforcement of private law claims or for the prevention of unpaid debts, provided that specific measures are taken to protect the rights and freedoms of the data subject, which are appropriate to the state of the technology, the costs of implementation, the nature, scope, context, and purposes of the processing, as well as the varying likelihood and severity of the risks to the rights and freedoms of natural persons, or

(d) with the consent of the birth number holder or his or her legal representative.

(2) For the purposes of using birth numbers, a birth number shall also mean any combination of numbers expressing the day, month, and year of birth and a three-digit or four-digit suffix of the birth number from which it is possible to identify a natural person.

(3) Specific measures to protect the rights and freedoms of the data subject may include, in particular:

(a) technical and organizational measures aimed at the consistent application of the obligation under Article 5(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council,

(b) maintaining records of at least all operations involving the collection, entry, modification, and erasure of personal data, which allow for the identification and verification of the person performing the operation, and retaining such records for at least 2 years following the performance of the operation,

(c) informing persons processing personal data of their obligations regarding the protection of personal data,

(d) appointing a data protection officer,

(e) specific restrictions on access to personal data within the controller or processor,

(f) pseudonymization of personal data,

(g) encryption of personal data,

(h) measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services,

(i) measures enabling the restoration of the availability of personal data and timely access to such data in the event of incidents,

(j) a process for regularly testing, assessing, and evaluating the effectiveness of the technical and organizational measures implemented to ensure the security of processing, or

(k) specific restrictions on the transfer of personal data to a third country.