In Serbia, no one was ever punished for illegal personal data processing. This is a rarity, even within the international framework, and it was no coincidence that it prompted one ironic academic joke (Prof. Vlada Vodinelic) – “When it comes to personal data protection, “the statistics” shows that Serbia is, undisputedly, the best. Because, if there were reasons for it, someone had to have been punished.”
Of course there were reasons, many of them, but no punishments. A few days ago, an interesting consignment was delivered to the address of the Commissioner for Information of Public Importance and Personal Data Protection – the verdict of the Misdemeanor Court in Belgrade, which broke “the taboo”. In the proceedings initiated at the request of the Commissioner, the Court found the defendants (a private medical institution and its director) guilty of committing an offence from Article 57 of the Law on Personal Data Protection, and punished the institution with 100.000 Serbian dinars, and the director with 20.000 Serbian dinars.
I do not want to speak about those who have been found responsible. Besides the fact that it is irrelevant, there are two additional good reasons. The first one is because I believe they had committed this misdemeanor due to the lack of knowledge, negligence, and lack of care, and not because they had bad intentions, and, the second, because I believe it would have been much more just and better if the punishing, and the negative publicity stemming from the violation of the aforementioned right, commenced with a state authority, and not a private legal entity.
It is understood that, in modern circumstances, where hundreds and hundreds of verdicts are passed each day, one individual misdemeanor verdict cannot attract wider attention. But this particular verdict, as it is the first of its kind, deserves that attention.
One Chinese saying states – “The longest road begins with the first step”. And this verdict is such a step. Maybe it is a barely visible, small, and insecure step, but a step nonetheless on the path towards one valuable aim. The state of affairs where the lack of or a small number of punishments would speak volumes about the relationship between the state and the citizens’ right to privacy and personal data protection. This will not be a relationship of ignorance, but, rather, of full and complete understanding.
