Pseudonymisation means storing data using the technique of separating agency and identification data and linking them using AIFO according to the above scheme:
Pseudonymization is not anonymization of data, and even pseudonymized data is still personal data.
Thus, the purpose of pseudonymization is:
In contrast to the practice commonly used today, where all data about individuals is stored in one table (i.e. including personal data), this is a systematic division of the stored data so that the data is separated from each other at a minimum:
Act 111/2009 Coll. on the Basic Registers introduced the basic principle of pseudonymisation in public administration in the form of Agenda Identifier of a Natural Person (AIFO) (§9 to §11 of Act 111/209 Coll. on the Basic Registers), which ensures pseudonymisation in the performance of public administration. The consistent use of AIFO within the ISVS ensures the reduction of the risk of profiling in the sense of unauthorised linking of data on a specific person from different agencies.
Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as GDPR) defines pseudonymisation in Article 4 as follows:
"pseudonymisation" means the processing of personal data so that they can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to technical and organisational measures to ensure that it is not attributed to an identified or identifiable natural person
With reference to the above, it should be noted that the currently still used birth number is in direct conflict with the requirement for pseudonymisation, since the RIN, in addition to being a meaningful identifier (containing information on the date of birth and sex of the person), in particular allows for the association of any data held in connection with it.
Department of the Chief eGovernment Architect of the Ministry of the Interior
The Ministry of the Interior is, according to Section 12 of Act No. 2/1969 Coll., the Act of Competence, the central authority of the state administration, inter alia, for the ISVS area and also performs a coordinating role for information and communication technologies, as well as for the organisation and performance of public administration in general. These competences are further elaborated in the ZoISVS, according to which the Ministry of the Interior expresses its opinion on proposals, projects and investment plans of the OVS in the field of information and communication technologies.
On the basis of the relevant regulations, the Department of the Chief eGovernment Architect of the Ministry of the Interior (OHA) performs the described coordination role in the field of information and communication technologies. The OHA has supra-ministerial competence, i.e. it is mandated and responsible for coordinating and leading the development of eGovernment throughout the public administration. eGovernment itself includes not only information technology itself, but also the optimization and simplification of public administration services linked to the legislative environment. In addition to the aforementioned legislation, the OHA is also explicitly called upon to play this coordinating role by Government Resolution No 86 of 27 January 2020.
The requirements for the pseudonymisation of personal data are architectural, implementation and procedural. Their implementation must be carried out in such a way as to in no way restrict the exercise of public administration. Ideally, ISVS users should not notice that pseudonymisation processes are used to store and handle personal data.
The specific implementation of this requirement depends on the complexity of the information system and the agendas it supports
Pseudonymisation is not an explicit requirement for the processing of personal data, but it is a recommended practice for reducing the risk of unauthorised handling of personal data, along with other techniques such as encryption.
At the national level, the introduction of the Basic Registers establishes a secure way of exchanging and managing personal data. Each agenda is assigned an AIFO of a person and only the AIFO converter (ORG) is able to transfer the AIFO of a given person between the different agendas. Each such transfer is consistently logged and the exchange of data is recorded in the population register log.
When exchanging data between agencies, it is always necessary to consider the scope of the data being transferred. In many cases, the current legal framework provides for the authorisation to obtain a large amount of data between agencies in order to ensure the unambiguous identification of the person about whom the data are transferred. It is important to note here, however, that although there may be broad legislative authority to obtain data from the source agency, it is advisable to use only strictly necessary data with regard to data protection.
The use of a valid identification document is ideal for the identification of a natural person when he/she contacts the public administration, since any public authority that uses some reference data recorded in the population register in its activities is entitled to use the number and type of electronically readable identification documents (§18(5) of Act 111/2009 Coll. on the basic registers). Therefore, if a natural person presents or indicates in the form the type and number of his/her electronically readable document, then he/she can be uniquely identified in the Population Register. In the case of remote identification and authentication through the National Point (Act 250/2017 Coll. on electronic identification), the natural person is uniquely identified by a meaningless directional identifier (BSI), which can be transferred through the information system of the basic registers to the AIFO (service E226).
Within the information systems of an individual public authority, it is recommended to use the same principles that are used at national level, respecting the fact that this is an agency-specific office where agency-specific data are very likely to be present, and exceptionally data from other agencies.
The above architectural requirements must be implemented at the database and application level so that the users of the information system are not restricted in the performance of the supported agendas. At the same time, the necessary data analysis must determine what data must be kept within the information system. Again, it must be taken into account that although the statutory provision allows for the maintenance of data, this data does not have to be maintained in its value but may be maintained in the form of a reference or other link. The specific decision of the substantive administrator of the agenda must be based on the procedural requirements of the agenda and it is not possible to lay down a blanket unambiguous rule.
An example of this would be the maintenance of addresses within the Czech Republic, where the recommended practice is to maintain this data in the form of a reference link to the Register of Territorial Identification (RUIAN) or a local copy of address locations that is kept up-to-date in accordance with RUIAN. This consequently eliminates the erroneous administrative procedure where an invalid address is used.
Another example is the situation where, for example, the date of birth of a person is not used in the agenda for searching or sorting, then this date of birth can be kept in the form of a reference link to the population register and the specific data can be retrieved only when necessary.