Passports that reveal your blood type. Business forms that require your national ID number, making it visible for anyone to borrow. Train passes that allegedly record your movements.

The Czech Republic does such a poor job of protecting the privacy of its citizens that it's been rated among nine European Union countries with the worst record for personal data security. This assessment, released earlier this month by Privacy International (PI), a data protection watchdog, comes as no surprise to Filip Pospíšil of Iuridicum Remedium, a civic rights group.

"People are often shocked to find out just how much information these companies know about them," he says. "And it's getting worse."

The Czech Republic passed the Personal Data Protection Law in 1992, but the statute is adhered to less and less, observers say. According to the law, citizens have the right to keep their personal data private and to know exactly what information companies and government bodies have on file about them.

But Hana Štěpánková, spokeswoman for the Office for the Protection of Personal Data (ÚOOÚ), an independent institution founded in 2000, says the number of complaints over infringement of privacy rights grows every year.

Part of the reason, Štěpánková acknowledges, is that people are better informed about their personal data rights and risks.

"The younger generation tends to be much more demanding," she says. "They know about the latest technologies and how they can be abused."

Although the PI rankings show that the country is doing a subpar job at protecting personal data, it could clearly be much worse — the United Kingdom ranks the lowest among EU countries. And, out of the 36 countries surveyed worldwide, the Czech Republic and Slovakia tie for 18th when it comes to protecting privacy. At the bottom are Russia, Singapore, Malaysia and China.

The rankings were announced just days after this country's second annual Big Brother Awards, organized here by Iuridicum Remedium.

That international competition, founded in 1984 in homage to George Orwell, identifies and awards the worst privacy offenders.

This year's winners included Komerční banka, a Czech bank chosen for its extensive database containing the personal data of not just current clients, but also of potential and former clients.

The Czech Credit Bureau was also cited for its database of clients, which is readily available to 19 banks, insurance companies and leasing agencies.

The Finance Ministry won an award for its proposal to create a new tax identification number that would be partly composed of the numbers on people's national ID cards. An unsecured national ID number opens the door to identity theft.

Czech Railways, meanwhile, won the "most dangerous new technology award," for the In-Karta travel pass, which, according to Iuridicum Remedium, is able to track the movement of its holder.

Czech Railways has called the Big Brother competition "unprofessional," charging that the group's jury used unverified information when evaluating the In-Karta.

But the ÚOOÚ is not assuaged. "We will need to inspect the card system," Štěpánková says. "Czech Railways haven't given us the proposal for their project. And we do have certain concerns."

Similarly, the Finance Ministry denies any wrongdoing. According to ministry spokeswoman Petra Krainová, using people's personal ID numbers is currently the best possible way to identify them for tax purposes.

Troubling trends

Another big cause for concern, according to Pospíšil, is the growing trend to store personal biometric data. This year the country has started phasing in new electronic passports with cryptographic chips that store people's biological statistics. Hailed as an important anti-terrorism tool, all EU countries are required to fully convert to such passports by 2009.

Another troubling trend for Pospíšil is the blossoming of inconspicuous surveillance cameras on more and more buildings. According to Iuridicum Remedium, there could be as many as 10,000 commercial security cameras in this country. Police cameras, meanwhile, also continue to multiply.

The voting public doesn't seem as worried: In Prague's municipal election, increasing the number of police cameras was one of the key priorities of both top mayoral candidates. Prague Mayor Pavel Bém promised to increase the number of cameras to 1,100.

According to Štěpánková, civic enterprises like the Big Brother Awards play a useful role in helping to raise awareness about personal data protection.

Pospíšil says that in some respects Czechs still tend to be less cautious than their Western neighbors about personal data security. It may be a hangover from the communist past, he says. "Under the old regime, people were used not questioning authority," he says. "If an official asked for your ID card, you gave it to him, no questions asked."

This is starting to change, but new threats to people's privacy are emerging just as quickly.

According to Petra Zachari of the Czech Association for Consumer Protection, the fastest-developing methods to mine personal data come from advertising.

As one of the most recent examples, she cites gift certificates offered to new mothers in hospitals just after they have given birth. The women are offered items for their newborns on the condition that they fill out and sign a questionnaire. What they often don't realize is that they're signing an agreement that lets the company in question retain and pass on their personal data and bombard them with unsolicited mail.

If the women were to file a complaint with the ÚOOÚ, the law would be on the company's side. Even groggy new mothers must read the fine print.