ÚOOÚ and GDPR in Czech Manufacturing
The Úřad pro ochranu osobních údajů (ÚOOÚ) issued 58 enforcement decisions in 2024. Manufacturing and automotive firms made up 34% of those. That is the highest share of any sector.
Škoda Auto, Toyota, Foxconn, and many tier suppliers all operate in Czechia. GDPR compliance there needs tools that handle local data. Most tools in use do not.
The Parent Company Tool Problem
ÚOOÚ data shows a clear failure pattern. Parent companies abroad push foreign-configured PII tools to their local units.
When a large group deploys its standard tool to a Prague office:
- The tool is set up for foreign identifiers. It does not cover local ones.
- Employee contracts and HR files are in Czech. The tool was not trained on Czech text.
- NER accuracy for Czech is 23% lower than for equivalent text in other languages. (ÚOOÚ technical guidance, 2024)
- The rodné číslo is missed in files not marked as Czech.
- Employee health and HR data moves without the protection regulators require.
67% of local firms rely on tools that miss country-specific identifiers. ÚOOÚ holds the local controller liable. It does not hold the parent vendor liable.
Rodné Číslo: Special Category Data
The rodné číslo is a birth number. It uses the format RRMMDD/XXXX.
- Digits 3–4 encode the birth month. For women, 50 is added. A woman born in January shows 51, not 01.
- A forward slash splits the date from the suffix.
- The suffix has 3–4 digits with a modulus-11 check digit.
The gender encoding makes this number special category data under GDPR Article 9. It reveals sex by design. Heightened protection applies.
Three things must be covered. First, the women's month offset — the 50 rule. Second, modulus-11 check digit validation. Third, both 9-digit (pre-1954) and 10-digit formats.
Pattern matching alone does not meet the ÚOOÚ standard.
Other Key Identifiers
Číslo občanského průkazu (OP): National ID card. Nine alphanumeric characters. Found on contracts, visitor logs, and health records.
IČO: Eight-digit business number. Appears in supplier contracts next to personal data of legal reps.
DIČ: Format CZ + birth number (individuals) or CZ + IČO (companies). Personal DIČ appears in freelance contracts.
IBAN: Format CZ + 22 digits. Common in payroll files and expense reports.
Where Manufacturing Is Exposed
HR records: Payroll for local staff includes birth numbers, national IDs, and bank details. Cross-border HR transfers need Transfer Impact Assessments.
Quality traceability: Auto production systems often link defect records to individual workers. This is personal data inside operational technology. It is subject to GDPR even outside HR systems.
Dealership data: Large manufacturer networks process test drive records, financing forms, and service histories. Many of these hold birth numbers.
See our GDPR compliance guide and multilingual PII detection overview for how identifier gaps apply across EU jurisdictions. For full entity coverage, see the entities reference.
The core need is simple. Birth number detection must include gender-offset handling and checksum validation. Native NER for text processing is also required. Mixed-language pipelines must be supported.
When This Approach Has Limits
Detecting the rodné číslo with its gender offset and modulus-11 check, plus native Czech NER, is the right answer to parent-company tools that miss local identifiers — but limits remain worth stating plainly.
Czech NER accuracy bounds the result, and the gap is measurable. ÚOOÚ's own guidance puts Czech NER accuracy 23% below comparable text in other languages, which means even a correctly configured pipeline carries a meaningful false-negative rate on names and free-text HR content. The rodné číslo itself adds traps: the 50 offset on women's birth-month digits, both 9-digit pre-1954 and 10-digit formats, and a modulus-11 suffix that pattern matching alone cannot confirm. Test detection against held-out Czech documents covering both formats and both genders before trusting output, rather than assuming a foreign-tuned tool generalizes.
The rodné číslo is special-category data, and removing it does not fully anonymize. Because the birth number encodes sex by design, it is Article 9 special-category data demanding heightened protection. But stripping it leaves quasi-identifiers behind: in quality-traceability systems a defect record tied to a shift, line, and date can re-identify a worker even with the birth number gone. That output is pseudonymized, not anonymized, and stays in GDPR scope. The DIČ and OP card number carry the same linkage risk in contracts and dealership files, so partial redaction is not a finish line.
Detection supports compliance but the local controller carries the rest. ÚOOÚ holds the Prague unit liable, not the foreign parent vendor, and it assesses the whole posture: Transfer Impact Assessments for cross-border HR flows, lawful basis for worker monitoring, and protection of personal data inside operational technology, not just HR systems. Strong birth-number detection helps but cannot supply a TIA, a legal basis, or a documented anonymization rationale. Human and legal review of contracts, transfers, and retention remain required alongside the tooling.