The Commissioner for Information of Public Importance and Personal Data Processing has finished the inspection of compliance with the Law on Personal Data Protection initiated pursuant to media reports about alleged sale of nursing mothers' personal data.
The inspection covered companies Medis Pharm and Care Direct. During the inspection, it was found that Medis Pharm had not used or managed a database of nursing mothers' personal data. While this company did distribute its materials, it did not do so directly, but through Care Direct, which distributed them under an agreement between the two companies to the addresses contained in a database it owned.
Care Direct had reported this database of personal data to the Commissioner's Central Registry of Data Files as "Records of Nursing Mothers". The report stated it was a database formed on the basis of consent of data subjects and the data obtained were not made available to third parties.
Care Direct did not make the personal data available to Medis Pharm or third parties and upon accessing Care Direct's databases it was found that the personal data of each nursing mother were accompanied by a special data processing consent form which among other things stated that the data could also be used for direct marketing purposes.
These facts point to the conclusion that companies Medis Pharm and Care Direct did not perform unlawful personal data processing in this specific case.
However, the Commissioner will report these and other facts found to other competent authorities and demand their response. This will include in particular the Ministry of Health, which will be advised to put in place and continually apply far more stringent supervision mechanisms for the protection of patients' personal data, because in this case there obviously never was any supervision to begin with. The first question that arises regarding this whole situation is: who did Care Direct even obtain nursing mothers' personal data and subsequently sent advertising material and gifts to them? In the inspection it was found it had done so under agreements with medical institutions which had provided it with logistical support and whose staff distributed the consent forms to nursing mothers on behalf of Care Direct and collected filled-in forms from the mother. In the inspection procedure, Care Direct provided the Commissioner's authorised officers with evidence of existence of as many as 45 of such agreements with obstetrics and gynaecology clinics across Serbia. It was also found in the inspection that, in addition to these agreements with medical institutions, Care Direct also had service contracts with certain staff members at those medical institutions.
The Commissioner will also report this case to the Republic Public Prosecutor's Office, expecting it to enlist the involvement of competent public prosecutors' offices. This is all the more relevant because the results of this inspection seem to indicate that in quite a few cases the signatures of nursing mothers on the personal data processing forms might be unauthentic, i.e. forged. Since the Commissioner lacks the legal and de facto capacity to conduct a criminal investigation, this case must be investigated by the competent authorities, namely public prosecutors' offices and, at their orders, the police. In view of all relevant circumstances, an investigation of these suspicions could confirm that multiple criminal offences were committed.
