The Commissioner for Information of Public Importance and Personal Data Protection has issued the Ministry of Internal Affairs with a Warning about irregularities in the processing of personal data of participants in the driver education process (learner drivers, lecturers, examiners and instructors), which render such personal data processing contrary to the Law on Personal Data Protection and hence inadmissible.
The Commissioner ordered the Ministry of Interior to report to him within 15 days of receipt of the warning on the measures and activities it has undertaken to remedy the identified irregularities.
The Commissioner initiated the control procedure pursuant to a petition filed by the Trade Union of Serbian Driving School Employees, which was forwarded to him by the Protector of Citizens. During the control he found that three bylaws passed by the Minister of Internal Affairs provided for personal data processing which involved the creation of new large personal data files, which include also data created through audiovisual recording and through the use of software applications.
Bylaws, being instruments of secondary legislation, cannot serve as legal grounds for personal data processing, since the Constitution of the Republic of Serbia (Article 42) explicitly provides that personal data processing must be governed by a law.
Furthermore, the "consent" to personal data processing cannot provide valid legal grounds in this specific case. For consent to data processing to be valid, it must be a freely given declaration of will. If a learner driver's ability to attend a driver education course is made conditional upon his or her consent to data processing, this certainly does not constitute freely given consent. The same applies to any consent given by lecturers, examiners and instructors, as they would be barred from performing their jobs if they refused to consent.
The Commissioner recalls he had previously, in connection with the draft versions of the Law on Traffic Safety, issued a number of opinions to the Ministry of Internal Affairs in which he noted it was necessary to review the justifiability of providing for audiovisual recording of learner drivers, lecturers, examiners and third parties during theoretical training and theoretical examinations, as he believed that such personal data processing could be considered excessive and could constitute a disproportionate invasion of privacy without a properly defined purpose of such processing. On those occasions, the Commissioner warned that any specific actions of audiovisual surveillance, if indeed found to be necessary and proportionate, would have to be provided for by the law.
The Commissioner warned this specific case was not an isolated incident, but only one of a number of similar violations, and voiced his concern about the increasingly frequent actions of different authorities which further deteriorate the already poor inherited situation in the field of personal data protection.
