The Commissioner for Information of Public Importance and Personal Data Protection passed a ruling temporarily banning the Marketing and Services Company “Аpex Solution Technology” from processing personal data, in particular serial and alias numbers of personalized SMART cards within the ticket charging and public transportation management system in Belgrade, the so-called Bus Plus system.

In that regard, Commissioner Rodoljub Sabic also said the following:

“As early as in the preliminary verification procedure, the Bus Plus project contractors were warned about all duties arising from the Law on Personal Data Protection and that in case they do not comply with the law, the Commissioner will ban data processing.

Inter alia, the warning primarily pertained to the necessity to exclude the possibility of “matching” data from two centres, one centre which keeps data on subscribers and the other which keeps data on traffic. Thus, privacy must be guaranteed to persons who use public transport passes and possibility of tracking of their movements, i.e. determining of the time of citizens’ travel routes on the basis of parameters which would be the same in both databases, must be excluded.

Just before the Bus Plus system started functioning, persons authorized by the Commissioner concluded in the repeated supervision procedure that the warning was not fully complied with, which caused passing of the ruling temporarily banning processing of certain data.

The reasons for the ban should not be dramatized, but they should not be underestimated either. It is commendable that the Bus Plus system functions in the manner which excludes the possibility of tracking anyone in real time. The possibility of subsequent reconstruction of Bus Plus service users’ travel route is also excluded. However, there is a potential threat to privacy through processing of personal data, by locating time and the vehicle used, while the purpose of such processing, reasons for which it can be performed, the procedure and the circle of persons who can access such data, the period during which such data can be kept etc. are not regulated by any legal enactment, which makes such processing inadmissible from the aspect of the Law on Personal Data Protection while those shortcomings exist.

I informed Mayor Dragan Djilas in our conversation yesterday that I would pass a ruling temporarily banning data processing. I think the Mayor completely understood the reasons for the ban and that he will take steps to rectify shortcomings as soon as possible.”