ÚOOÚ and GDPR in Czech Manufacturing
The Úřad pro ochranu osobních údajů (ÚOOÚ) issued 58 enforcement decisions in 2024. Manufacturing and automotive firms made up 34% of those. That is the highest share of any sector.
Škoda Auto, Toyota, Foxconn, and many tier suppliers all operate in Czechia. GDPR compliance there needs tools that handle local data. Most tools in use do not.
The Parent Company Tool Problem
ÚOOÚ data shows a clear failure pattern. Parent companies abroad push foreign-configured PII tools to their local units.
When a large group deploys its standard tool to a Prague office:
- The tool is set up for foreign identifiers. It does not cover local ones.
- Employee contracts and HR files are in Czech. The tool was not trained on Czech text.
- NER accuracy for Czech is 23% lower than for equivalent text in other languages. (ÚOOÚ technical guidance, 2024)
- The rodné číslo is missed in files not marked as Czech.
- Employee health and HR data moves without the protection regulators require.
67% of local firms rely on tools that miss country-specific identifiers. ÚOOÚ holds the local controller liable. It does not hold the parent vendor liable.
Rodné Číslo: Special Category Data
The rodné číslo is a birth number. It uses the format RRMMDD/XXXX.
- Digits 3–4 encode the birth month. For women, 50 is added. A woman born in January shows 51, not 01.
- A forward slash splits the date from the suffix.
- The suffix has 3–4 digits with a modulus-11 check digit.
The gender encoding makes this number special category data under GDPR Article 9. It reveals sex by design. Heightened protection applies.
Three things must be covered. First, the women's month offset — the 50 rule. Second, modulus-11 check digit validation. Third, both 9-digit (pre-1954) and 10-digit formats.
Pattern matching alone does not meet the ÚOOÚ standard.
Other Key Identifiers
Číslo občanského průkazu (OP): National ID card. Nine alphanumeric characters. Found on contracts, visitor logs, and health records.
IČO: Eight-digit business number. Appears in supplier contracts next to personal data of legal reps.
DIČ: Format CZ + birth number (individuals) or CZ + IČO (companies). Personal DIČ appears in freelance contracts.
IBAN: Format CZ + 22 digits. Common in payroll files and expense reports.
Where Manufacturing Is Exposed
HR records: Payroll for local staff includes birth numbers, national IDs, and bank details. Cross-border HR transfers need Transfer Impact Assessments.
Quality traceability: Auto production systems often link defect records to individual workers. This is personal data inside operational technology. It is subject to GDPR even outside HR systems.
Dealership data: Large manufacturer networks process test drive records, financing forms, and service histories. Many of these hold birth numbers.
See our GDPR compliance guide and multilingual PII detection overview for how identifier gaps apply across EU jurisdictions. For full entity coverage, see the entities reference.
The core need is simple. Birth number detection must include gender-offset handling and checksum validation. Native NER for text processing is also required. Mixed-language pipelines must be supported.