Bearing in mind the increased media interest in issuing personalized SMART cards and the use of Bus Plus benefit program in public transport, together with the fact that a considerable number of citizens have addressed the Commissioner concerning this issue, the Commissioner for Information of Public Importance and Personal Data Protection announces that he is already in the process of checking the earlier information on the intent to establish the personal data base called “The Registry of ID Cards Owners for Using the Public Transport in Belgrade”, he has warned those in charge of the project about the obligation set out in the Personal Date Protection Law.

At the beginning of this month the Commissioner issued another warning to the Society for Marketing and Services “Apex Solution Technology” Ltd. from Belgrade. In the direct contact with the managers of this firm the representatives of the Commissioner were assured that the firm would act according to warning.

Immediately after the project begins to function the persons authorized by the Commissioner will perform direct supervision and if the instructions from the warning are not followed the Commissioner will forbid the data processing.

Regarding this the Commissioner Rodoljub Sabic has also said:

“In short the warning comes down to two things.

First, bearing in mind that in this case we are dealing with data processing based on the consent given by the persons whose data we are dealing with, it is necessary for these persons to be aware of all the elements of processing, which means informing them previously about the data processing and obtaining their consent for processing. The persons whose data are being processed have to be informed not only about the advantages they might have, but also about the possible rights of those offering the benefits, like for example, the possibility of using the data in advertising and marketing purposes, the possibility of giving the data to the third party etc, and their consent must be obtained in a form stipulated by the law.

Second, it is necessary to rule out the possibility of “pairing” the data from two centres, one where they keep data on the subscriber and the other one where they keep data on the traffic. Therefore, they have to guarantee the privacy of the person using the ID card and rule out the possibility of following their movement, that is setting the time and place of citizens’ movement based on the parameters common to both data bases.”