The Commissioner for Information of Public Importance and Personal Data Processing has issued a warning to the Republic Geodetic Authority, in which he alerted that body to the fact that video recording of the admission offices of its cadastral services in Belgrade, Zemun, Niš and Novi Sad and live streaming of personal data, which makes personal data available to an unlimited number of Internet users, constituted unlawful processing of personal data.

There is no applicable law that would provide the grounds for this kind of personal data processing by the Republic Geodetic Authority. Likewise, just as this personal data processing is not authorised by any law, it is also not based on the consent of the data subjects whose presence in those rooms is recorded.

Granted, there are notices posted on the entrances to the admission offices which warn citizens/visitors of this form of data processing. However, the confirmatory action they take in this instance (by entering the premises of the admission office) cannot be considered their consent to such data processing within the meaning of the Law. In this specific case, persons who enter the area covered by web cameras do not have a genuine freedom of choice, because they have no other option of obtaining the service for which they came without entering the data controller's premises, so their consent given in this way cannot be considered to be an expression of their free will.

Furthermore, the purpose of such processing is vague and is not defined by any relevant law, while the fact that the images and information about the presence of citizens on the premises are distributed to an unlimited number of users in the Internet community makes this processing disproportionate to any alleged purpose.

According to the Law on Personal Data Protection, personal data processing is unlawful when it is done without a proper legal basis (Article 8 item 1)), if the purpose of processing is unspecified (Article 8 item 3)) and if processing is disproportionate to its stated purpose (Article 8 item 7)), which means that the data processing conducted by the Republic Geodetic Authority constitutes multiple violations of the law.