The Commissioner for Information of Public Importance and Personal Data Protection passed a ruling banning further personal data processing under the so-called “Centralized School Database and the System for Notification of Parents about Pupils’ Grades”.

The Provincials Secretariat for Education of the Autonomous Province of Vojvodina and the company WDW Soft d.o.o. were ordered to disable any access to the database from local and external networks immediately upon receipt of the ruling and to delete personal data pertaining to a total of 200.271 persons (pupils, parents, teaching and non-teaching staff) within 10 days of receipt of the ruling. In that regard, Commissioner Rodoljub Sabic also said the following:

“Upon ex officio examination, it was found that the said database was established and that it functions in the manner completely opposite to the provisions of the Law on Personal Data Protection.

Article 42 of the Serbian Constitution stipulates that collecting, keeping, processing and use of personal data must be regulated by the law. And no provision of any law stipulates the basis for establishment and functioning of such database.

Thus, this large database was established by the Provincial Secretariat in cooperation with the company WDW Soft d.o.o. contrary to the requirements set out in the Constitution, invoking some of the conclusions of the Assembly and the Government of the Autonomous Province of Vojvodina. It is quite clear that such conclusions can in no way override enactments such as the Constitution and the law. However, regardless of that, it should be emphasized that even the said conclusions were interpreted in an inadmissibly broad manner and implemented incorrectly and inconsistently.

Since even the relevant requirements set out in some of those conclusions were not complied with, without the legal ground the database functions in a manner which cannot be brought in compliance with the requirements of propriety and safety.

The data file “Centralized School Database and the System Notification of Parents about Pupils’ Grades ”, which is very large and delicate at first impression and, to my opinion, of national importance, is placed under full administrative control of the private company which is majority owned by a foreign company and minority owned by four foreign nationals and its predominant purpose is to enable achievement of their commercial interests, and the complete database is also placed on servers of the private company instead on servers of the Office for General and Joint Affairs of Provincial Authorities, although this Service has better resources at its disposal.

There is obviously no legal ground and since there are many potential risks for violation of the right to personal data protection, the measures I ordered had to be taken“.