The Commissioner for Information of Public Importance and Personal Data Protection welcomes the response of the Ministry of Interior to the Letter of Warning sent to it by the Commissioner in connection with unauthorised processing of citizens’ personal data in the records titled “Daily Bulletin of Events” as the correct and beneficial course of action.
The Commissioner’s Letter of Warning to the Ministry of Interior was sent after it was found in an inspection of compliance with the Law on Personal Data Protection that data contained in the file titled “Daily Events”, which contained information on police responses to criminal offences and misdemeanours, as well as information on harm to lives and property caused by natural disasters and all other events within the mandate of the police, with personal data of the persons involved in such events, were used in the compiling of the “Daily Bulletin of Events”, which was disseminated to a wide range of external recipients.
At the national level, the personal data in question were made available to: the President of the Republic, the Prime Minister, the Speaker of the National Parliament, the Deputy Prime Ministers, the Supreme Court of Cassation of Serbia, the Committee on Defence and Security, the Republic Public Prosecutor’s Office, the Special Prosecutor’s Office and the Security Information Agency, while at the level of local police administrations the data were selectively made available to presidents of courts, public prosecutors, heads of Administrative Districts, mayors, municipal presidents, chairpersons of city and municipal assemblies, heads of SIA centres etc., although most of these authorities, much less the individual persons involved, are not authorised to demand or receive personal data, nor do they need personal data for performing the duties within their respective mandates. Indeed, even if some of those listed above were authorised to demand and receive such information, they would have to do so through official correspondence, rather than through the “Daily Bulletin.” On the other hand, if the purpose of this arrangement is to provide information on specific events to a certain circle of government authorities, this could be achieved even without providing specific personal data.
Distribution of personal data without proper legal grounds (which can be either a specific legal provision or data subject’s consent) constitutes illegal data processing within the meaning of the Law on Personal Data Protection. Furthermore, any subsequent dissemination of personal data relating to potentially sensitive events to a wide circle of authorities and, in particular, officials who are not authorised to receive such data objectively exacerbates the risk of potential abuse of such data.
It is commendable that the Letter of Warning has been heeded, without the need for the Commissioner to undertake any further measures within his mandate. The Ministry of Interior has notified the Commissioner it will completely abolish the practice of compiling and disseminating the “Daily Bulletins.” In connection with the Commissioner’s Letter of Warning, the Minister of Interior has issued a document to the heads of all organisational units of the police, which advised them of the following: “When disseminating the information contained in the Bulleting to recipients outside of the Ministry (the so-called external recipients), the reports of events must be provided without any personal data, in a way which ensures that citizens are not identified or identifiable on the basis of those reports (personal data must not be stated, regardless whether they relate to a perpetrator of a criminal offence or misdemeanour or a law enforcement officer; initials, i.e. the first letters of a person’s name and surname, must not be stated; a person’s permanent or temporary residence address must not be stated, in order to protect personal data).
