The Commissioner for Information of Public Importance and Personal Data Protection has inspected compliance with the Law on Personal Data Protection at Eurobank a.d. Beograde of Belgrade, upon learning that banking and other documents containing customers' information were found in the immediate vicinity of a branch of that bank, next to a garbage disposal bin.

Upon completing the inspection, the Commissioner issued the Bank with a Warning in which he alerted it to its duty to undertake all HR, organisational and technical measures necessary to prevent the identified irregularities from repeating. He ordered the bank to notify him within 8 days of the remedial measures it has undertaken.

The facts found during the inspection seem to indicate that the infringement had not been made in bad faith, but rather due to gross negligence; however, this is certainly no excuse from liability and the Commissioner has filed a petition for institution of infringement proceedings with the Magistrates' Court of Belgrade against Eurobank a.d. Beograd and the Chairperson of its Executive Board as the responsible person.

This case also prompted the Commissioner to send a letter to the Governor of the National Bank of Serbia. In that letter he stated that the identified facts and circumstances seemed to indicate this was not an isolated incident. The Commissioner has already identified instances of inadmissible treatment of personal data during inspections, including disposal of whole documents at waste disposal sites, as a result of which he filed petitions for institution of infringement proceedings against Telenor banka a.d. Beograd (as the successor to KBC banka) and its responsible person.

With regard to unlawful handling of personal data by banks, the Commissioner has undertaken all measures at his disposal. However, the facts found during the inspections and other publicly available facts indicate that such actions by banks may also constitute other serious violations of rights, which are outside of the Commissioner's mandate and which should and must be met with appropriate action from other competent authorities.

Apart from the fact that they certainly tantamount to gross violations of even the barest minimum of standards of fair treatment of bank customers, such actions can also constitute serious violations of the law, especially in the field of banking operations. For example, it is impossible to rule out potential violations of banking secrecy due to compromised data or other criminal offences (e.g. in cases where entire credit files are disposed of).

The Commissioner believes it is important that the National Bank respond within the scope of its powers and competences to all similar cases and expects it to do so. Furthermore, depending on the specific circumstances of each individual case, this duty to respond should also extend to authorities such as prosecutors' offices and the Ministry of Internal Affairs.