Commissioner for Information of Public Importance and Personal Data Protection has launched and is carrying out inquiry proceedings about the implementation of the Law on Personal Data Protection in enterprises of Serbian Railways.

The proceedings were launched due to public addresses of a number of employees and the Association of Free and Independent Trade Unions indicating that the employees had been asked to submit a series of personal data on their spouses and children, as well as documents to support the data, without indicating a legal basis or the purpose of collection of the requested data. The applications indicate the issue of the legal basis of data processing and express concern that the lack of a clearly defined purpose and scope of data processing could lead to abuses, as well as that collection of the required data and documents means unjustified costs for employees.

In the proceedings carried out in the company JSC "Serbian Railways Infrastructure" it was established on the basis of responsible persons' statements that the ''Draft Redundancy Program'' is the ''basis'' for personal data collection or processing.

It is a "draft"; it's not an adopted act. Therefore, regardless of how certain it is that it will be adopted, the legal power that it could have had, had it been adopted, and the fact that consulted trade unions gave a negative opinion, it cannot constitute a valid legal basis for personal data processing. Warned by the Commissioner's authorized persons about that circumstance, the Acting Director General of "Serbian Railways Infrastructure" ordered all organizational units to immediately stop further collection and processing of personal data of household members of employees and further processing of collected data, and to implement all safeguards in accordance with the Law on Personal Data Protection.

The Commissioner estimates this case as yet another confirmation of the incomprehensible, disturbing ease with which personal data processing is very often undertaken in our country without a valid legal basis and a clearly defined purpose and scope which always, particularly when processing data of a large number of people, implies the risk of abuse.

The Commissioner will carry out the inquiry proceedings until the end in all enterprises of Serbian Railways, and, as usual, inform the public about the results of the inquiry and measures which are to be taken.