The Commissioner for Information of Public Importance and Personal Data Processing sent a letter to the Republic Public Prosecutor's Office to inform that body about the results of an inspection of compliance with the Law on Personal Data Protection he had conducted in connection with the processing of nursing mothers' personal data by the company Care Direct pursuant to cooperation agreements signed with multiple medical institutions across Serbia. The Commissioner enclosed the Inspection Report and all other relevant documents obtained during the inspection procedure, to enable the Prosecutor's Office to act within its mandate.

The results of this inspection seem to indicate that in quite a few cases the signatures of nursing mothers on the personal data processing forms might be unauthentic, i.e. forged.

In the inspection procedure, the company Care Direct confirmed it had cooperation agreements with 45 medical institutions in Serbia under which it is granted the use of premises and human resources at those institutions. Under service contracts, health care professionals distribute material to nursing mothers and obtain data from them on a supplied form, but "always subject to obtaining their signature."

As an example, in the case of personal data of women who gave birth in just one obstetrics and gynaecology clinic in the city of Novi Sad, one the sample of 398 signed forms it was found that as many as 116 of them were only initialled, ostensibly by the women themselves. This fact, together with the statements of certain nursing mothers whose "signed" forms were found in the inspection procedure and who categorically insisted they had never signed anything, seems to indicate that multiple criminal offences may have been committed in connection with the processing of personal data of nursing mothers.

As it would be reasonable to assume that similar instances have occurred in some of the other 45 obstetrics and gynaecology clinics across Serbia, which are under the jurisdiction of many public prosecutors' offices, the Commissioner reported the case to the referred the case to the Republic Public Prosecutor's Office, expecting it to determine whether and to what extent it should act on this information within its mandate.