Violation of privacy

In its petition VIII Su No. 47/12-12 of 21 March 2014, a court requested from the Commissioner for Information of Public Importance and Personal Data Protection to provide his opinion on the scope of personal data protection in documents submitted according to the Law on Free Access to Information of Public Importance, particularly in judgements, with the aim of ensuring uniform treatment and preventing double standards, since, this matter was, in their opinion, not provided for in the law.

In that regard, the Commissioner informed the court as follows:

A decision about which information contained in a particular document may be made available to the public as information of public importance and to which extent is made on a case-by-case basis, taking into account specific circumstances. The same applies also to information contained in court judgements, including personal data.

Since information concerning the names of parties in court proceedings who are natural persons is also deemed to be personal data, making such information available to the public constitutes personal data processing which must be lawful according to the Law on Personal Data Protection ("Official Gazette of RS", No. 97/08 and 104/09-other law, 68/12- Decision of the Constitutional Court and 107/12). For processing to be lawful, the basis for personal data processing must be provided for by the law or the data subject must have given his/her consent for processing.

The Law on Free Access to Information of Public Importance ("Official Gazette of RS", No. 120/04, 54/07, 104/09 and 36/10) (hereinafter referred to as "LFAIPI") is one of the legal bases for personal data processing which in its Article 14, paragraph 1, items 1-3 stipulates exceptions from the right to privacy, and thus also the right to personal data protection as a part of the right to privacy.

In view of the foregoing, a decision whether the names of parties in court proceedings should be made available to the public as information of public importance should be based on the public interest test referred to in Article 8 of LFAIPI, i.e. on a weighing of interests between the right of the public to know and protection of the right to privacy or other legitimate rights and interest referred to in Article 9 of LFAIPI.

Firstly, as regards names of officials who participate in proceedings that are contained in judgements, the Commissioner's opinion in principle is that such persons by virtue of their office cannot reasonably expect to be afforded the same level of privacy protection than the so-called common citizens and that their names should be available to the public, since it is information concerning their conduct in public office, i.e. the discharge of public duties, rather than information concerning a person's private life. The basis for disclosure of such information is contained in Article 14, paragraph 1, item 2 of LFAIPI. This includes names of officials, i.e. holders of public offices, such as judges, prosecutors, lawyers, court appointed experts and sworn-in-court translators.

As regards names of suspects, if the public interest test is performed, considerations in favour of disclosure of such information may be the fact that a suspect's behaviour gives sufficient justification for disclosure of such information or that such information has already become public, or the suspect is a person of public interest or he/she committed criminal offence(s) prosecuted ex officio or criminal offences which cause serious threat to the society or prejudice a public interest, as well as any other facts that may be fall under the exceptions provided for in Article 14, items 2 and 3 of LFAIPI. In this context, a valid and enforceable criminal conviction provides a further reason to make the names of suspects available to the public.

As regards names of other participants in the proceedings, especially witnesses, a court's decision whether such information should be made available must also be based on a specific assessment, such as whether persons can be identified by publishing only names and surnames, what type of court proceedings is conducted, whether the persons in question are underage or belong to other vulnerable populations, whether the proceedings have been ended with a valid and enforceable judgement, whether this may affect the statements of other persons who have not yet been heard etc.

The court must certainly already be aware that there are other legal bases for disclosing the names of suspects, for example if an injunction involving public availability of a judgement is imposed.

When making information contained in judgements available to the public, the main personal data processing principles set out in Article 8 of the Law on Personal Data Protection must also be taken into account, including the principle of proportionality. This means that no other personal data should be publicised in addition to a person's name and surname insofar as there is no legal basis for the publication of such information or it would constitute excessive processing (address information, unique personal identification number etc.).

If there is no public interest in disclosing the names of parties in the proceedings, such as the names of litigants, the court has a duty to protect their names, i.e. to depersonalise the judgement before making it available as information of public importance, in which case it is also necessary to protect personal data from which the data subject may be identified.

Taking into account the foregoing, from the aspect of LFAIPI there is no general answer to the question which data should be protected in court judgements while handling a request to access information of public importance; instead, the court should consider such situations on a case-by-case basis.

In this context, it should be noted that even if a court has its own rules about data anonymization, this must not prejudice or affect a decision of the court hen it handles a particular request to access information. As regards anonymization of documents, the Commissioner's Bylaw on data anonymization is available at: http://www.poverenik.rs/sr/o-nama/akti-o-radu-sluzbe/aktuelni-akti/1706-pravilnik-o-anonimizaciji-podataka-o-licnosti.html

The Commissioner did not have and could not have had a different opinion about publishing of judgements, not least because he has also been in charge of protecting rights regarding personal data processing since the enactment of the Law on Personal Data Protection. The Commissioner's public announcements concerning excessive data processing included cases which involved publication of photos of arrests and other personal data of certain persons, the need to protect underage victims of criminal offences about whom the media published more information than necessary and admissible and other situations different from the case in question, such as the availability of a judgement for war crimes.

Number: 011-00-00320/2014-02 of 31 March 2014

The Historical Museum of Serbia requested from the Commissioner for Information of Public Importance and Personal Data Protection to provide his opinion about whether in case of the job announcement for the Director of the Museum, the Managing Board (MB) of the Museum may decide that candidates' evidence of eligibility may be scanned and posted on the official website of the Museum, placed on the notice board and forwarded to the members of the MB and the Steering Committee.

The request further stated that the job announcement files in question included complete sets of documents submitted by the candidates, including the documents containing personal data stated in personal identification documents, certificates of nationality, evidence of no prior convictions etc. and they would be published only if and when the Commissioner gives a positive opinion.

The Commissioner replied as follows:

From the aspect of the powers conferred on him by the Law on Free Access to Information of Public Importance and Personal Data Protection, the Commissioner for Information of Public Importance and Personal Data Protection does not have the power to allow public authorities to publish documents containing personal data, which means he also cannot influence any decision to that effect made by the Museum's Managing Board.

Nevertheless, appreciating the efforts of the Museum and of the line ministry to make the procedure of selecting the director of the cultural institution transparent within the confines of the law, the Commissioner believes it is necessary to point out certain attitudes in principle which stem from the abovementioned laws, which the Museum must respect to ensure that publication of the information and documents in question does not violate any of the two rights established by these laws.

From the aspect of the Law on Free Access to Information of Public Importance ("Official Gazette of RS", No. 120/04, 54/07, 104/09 and 36/10), the information the Museum as a public authority holds in connection with the job announcement and hiring is indisputably information of public importance within the meaning of Article 2 of the Law.

Taking into account that the job announcement files also contain personal data within the meaning of Article 3 of the Law on Personal Data Protection ("Official Gazette of RS", No. 97/08, 104/09 –other law, 68/12-decision of the Constitutional Court, 107/2012) and that publication of such data constitutes processing of data subject to this Law, when deciding whether to make information contained in the job announcement files available to the public and, if so, which pieces of information may be published, the Museum should take into account the following considerations:

Since this is a public announcement for the office of a manager of a public authority, there is no doubt that the public has a keener interest in knowing information relevant for deciding on the selection of candidates or information relevant for the conduct of the office as such. In this context, from the aspect of Article 14 of the Law on Free Access to Information of Public Importance, it would be justified for example to publish names of the candidates, the draft program of work and the candidates' CV's or professional references, i.e. information that increases the public's involvement in the decision-making processes of public authorities and their evaluation. Since these are candidates for a public office, their expectations regarding protection of privacy most certainly cannot as high as those of e.g. candidates applying for the post of an "ordinary" civil servant or a job outside of public authorities.

In general, disclosure of other documents of all candidates, i.e. documents containing personal data, such as copies of personal identity documents, birth certificates, health certificates, evidence of no investigations pending and no prior convictions etc. without prior explicit consent of candidates and without serious reason for disclosure would be problematic from the aspect of justifiability of processing and the principle of excessiveness, which means it would also be contrary to Article 8 of the Law on Personal Data Protection.

Such documents or information contained in them could be made available to the public upon filing of a request for free access to information only if in a particular case it could be demonstrated that there is a strong public interest in their disclosure, when the interest of the right to know prevails over the protection of the right to privacy or the right to personal data protection as a part of the right to privacy. This includes one of the cases stipulated by Article 14 of the Law on Free Access to Information of Public Importance, e.g. if a candidate contributed to disclosure of such information by his/her behaviour or if there is reasonable doubt as to the correctness of an authority's decision regarding the compliance of a candidate with a certain requirement of the job announcement etc.

As regards publishing of decisions of the Museum or other public authority passed during the hiring procedure, it would probably be impossible to demonstrate there is no justified interest of the public to know or there is another prevailing interest as a possible reason to limit this right, since this is information which shows whether an authority complied with the procedure and requirements of the hiring procedure when selecting the director, but even when such documents are published it should be ensured that personal data which affect privacy and are not relevant for the conduct of office are first protected and made unavailable to the public, such as address information, unique personal identification numbers etc.

Handling of candidates' documents in the process of making a selection decision pursuant to a job announcement necessarily requires certain safeguards, in accordance with Article 47 of the Law on Personal Data Protection.

Number: 011-00-691/2013-02 of 5 November 2013

For the purpose of complying with the Commissioner's ruling, a public enterprise of the Republic of Serbia (PE) requested additional explanations for compliance with the order to make available information on the amount of employees' salaries and travel allowances for business travels, explaining there was a collision between the Law on Personal Data Protection and the Law on Free Access to Information of Public Importance. The PE also invoked the Commissioner's Letter of Warning number 164-00-00059/2013-07 of 3 July 2013 it received in connection with personal data processing.

The Commissioner sent the following reply to the PE:

It is true that the freedom of information and the right to privacy, i.e. the right to personal data protection as a part of the right to privacy, may often be in collision. If this is the case, in the deliberation of a request for free access to information of public importance the so-called public interest test is applied, as provided for in Article 8 of the Law on Free Access to Information of Public Importance ("Official Gazette of RS", No. 120/04, 54/07, 104/09 and 36/10).

In weighing the right of free access to information of public importance and the right to privacy, where the information concerned also constitutes personal data, Article 14 of the Law on Free Access to Information of Public Importance applies for the purpose of determining whether the requirements for application of the exemptions from the right to privacy provided for in items 1 to 3 of that Article are met for disclosure of such data.

As regards information on salaries, bonuses and allowances of employees in a public authority, the Commissioner's opinion in principle is that this is information which should be available to the public, since they are earned from public funds and/or paid from the budget and that there is always a strong interest of the public to know how public funds are managed. In addition, in this specific case, these are also data concerning holders of managerial posts, which means that the threshold of privacy is lower and the balance tips in favour of the right to know.

However, this is not true of all pieces of information contained in the payroll sheets, e.g. data or information concerning: bank account number, years of service, withholdings made for child support, loans, membership fees etc., information on an employee's address, unique personal identification number etc., the disclosure of which may violate the privacy of data subjects. Disclosure of these data as information of public importance would constitute excessive personal data processing, in violation of one of the main principles of proportionality of personal data processing provided for in Article 8 of the Law on Personal Data Processing ("Official Gazette of RS", No. 97/08 and 104/09-other law, 68/12- Decision of the Constitutional Court and 107/12). This is also implied in the Commissioner's Letter of Warning you invoked in your enactment.

Because of this, the order in the commissioner's ruling in question contains a clause ordering protection of the abovementioned data before disclosing the requested data concerning salaries, bonuses and allowances and other data, in accordance with Article 12 of the Law on Free Access to Information relation to extraction of information.

We would like to remind you that according to Article 28 of the Law on Free Access to Information of public Importance, the Commissioner's rulings are binding and enforceable and that complying with the order in that ruling constitutes lawful personal data processing, while failure to comply with the ruling is punishable as an infringement under Article 46, paragraph 1, item 14 of the said Law and could also contain elements of the criminal offence provided for in Article 361 of the Criminal Code".

No. 07-00-01210/2-2013-03 of 30 July 2013

According to the provision of Article 2 of the Law on Free Access to Information of Public Importance ("Official Gazette of RS", No. 120/04, 54/07, 104/09 and 36/10), information of public importance means any information which may be available to anyone and not just to the requester.

According to Article 14 of the Law, protection of privacy is one of possible limitations of the right of free access to information of public importance, but the Law in the same Article also provides for certain exemptions in favour of the right to know (Article 14, items 1-3). These exemptions include the situation where the data subject gave his/her consent to make information available, the situation where such information relates to a person, event or occurrence of public interest, especially in cases of holders of public office or political figures, insofar as the information bears relevance on the duties performed by that person and finally the situation where a person's behaviour, in particular concerning his/her private life, has provided sufficient justification for a request for such information.

A decision whether an official's home address should be made available to the public pursuant to a request filed by a requester thus depends on whether the requirements for application of exemptions from the right to privacy provided for in Article 14, items 1-3 of the Law are met for disclosing of such information.

In view of the foregoing, when an official whose information is to be published has not given his/her consent, whether such information can be made available or not will depend on whether the details of such official's private address are relevant taking into account the tasks he/she performs and whether his/her behaviour provides sufficient justification for a request for such information. This should be evaluated on a case-by-case basis whenever a request of this kind is filed.

The fact that a requester needs such information for litigation-related purposes before a court, more specifically for the purposes of filing a submission, is not in and of itself sufficient reason to make an official's private address generally available as information of public importance. However, a question remains as to the justifiability of applicable legislative provisions and jurisprudence of certain courts or other authorities which demand private addresses of officials rather than their official ones where a lawsuit concerns their conduct of office, or which require a party in the proceedings to provide such information, rather than mandating the court to obtain it ex officio.

Rejection of a request to make an official's address available to the public must not prejudice a requester's right to access information on a person's home address kept in the records of the competent authority on another basis in order to exercise a legitimate interest, provided that such information is not disclosed as information of public importance, i.e. generally available information. In this context, you should bear in mind the provisions of the Law on Permanent and Temporary Place of Residence of Citizens (Article 20) which stipulate that information on citizens' permanent and temporary place of residence is recorded in the records of personal identity documents issued, as well as the provisions of the Law on Personal Identity Document (Article 28) which specify the requirements for provision of information contained in the personal identity card records, which procedure is conducted according to the rules set out in the Law on General Administrative Procedure (Article 161).

No.07-02649/2013-02 15 August 2013

A municipality requested the Commissioner for Information of Public Importance and Personal Data Protection to issue an opinion on the handling of the request for access to information of public importance where the request relates to information on the agreements related to the disposal of municipal office space since the agreements contain information on renters and whether it is necessary to obtain their prior consent in order to submit the data to applicants, and whether the agreements must be copied considering that there are dozens of them, or how to proceed in order to comply with the Law on Free Access to Information of Public Importance and the Law on Personal Data Protection.

In this regard, the Commissioner has sent a reply in which he expressed a principled stand on this issue:

It is undisputed that the information in the agreement between a municipality and office space tenants constitutes public information, within the meaning of Article 2 of the Law on Free Access to Information of Public Importance ("Official Gazette of the Republic of Serbia" Nos.120/04, 54/07, 104/09 and 36/10), in respect of which there is a legal presumption of a justified interest of the public to know, pursuant to Article 4 of the Law. The Law actually gives an opportunity to the public authority to limit or deny access to the information when it determines and proves that there is a predominant legitimate interest referred to in Articles 9 and 14 which would be violated if access to information is granted.

Having in mind that this is very specific information regarding the disposal of municipal office space, i.e. disposal of public resources in case of which there is always a strong public interest to know, including the names of persons with whom the authorities conclude legal transactions, it would be difficult for an authority to prove the contrary under the guise of protection of the right to privacy, given that these situations or events are covered by the exemptions to the right to privacy under Article 14, paragraph 1, item 2 of the Law and that persons doing business with the state may not expect the same level of privacy protection as ordinary citizens.

Bearing in mind that lease agreements for office space contain other personal data which the public should not have an interest to know and which processing would be excessive, i.e. disproportionate to the purpose, in acting upon a request for access it is necessary to protect and make unavailable the personal data from the agreement which general availability could violate the right to privacy, for example information on residence address, Personal Identification Number [JMBG], no. of ID card and the like, pursuant to Article 12 of the Law on Free Access to Information of Public Importance regarding the extraction of information. Protection of the data is required under the principle of proportionality, which is one of the basic principles of personal data processing referred to in Article 8 of the Law on Personal Data Protection ("Official Gazette of the Republic of Serbia" Nos.97/08 and 104/09-other law, 68/12- decision of the Constitutional Court, 107/12), since the disclosure of and/or otherwise making available of information, i.e. personal data, constitutes personal data processing in terms of Article 3 of the Law on Personal Data Protection.

Given the above, i.e. the possibility for a public authority to protect in the above presented manner the personal data which processing would be excessive and infringe on privacy, the public authority is not obliged to obtain the consent of concerned persons for processing of their data before submitting the copies of a lease agreement to the applicant.

The manner of exercise of the right to access, pursuant to the Law shall be determined by the applicant, therefore the obligation of submitting a copy of the agreement depends on the content of the request , i.e. whether only a permission to examine the agreement is sought, a copy or both. In addition, the agreement number, i.e. the mere volume of information required shall not be cause to deny the exercise of applicant's rights, by recalling, for example, the abuse of the right referred to in Article 13 of the Law, which provisions must be interpreted extremely restrictively, i.e. to be used only in situations when the request manifestly contains an unreasonable task for a public authority, i.e. constitutes an abuse of the public authority.

Number: 011-00-00333/2013-03 dated 15 May 2013

A list of high school graduates containing contact information constitutes the information of public interest within the meaning of Article 2 of the Law on Free Access to Information of Public Importance ("Official Gazette of the Republic of Serbia" Nos.120/04, 54/07, 104/09 and 36/10), since the data stems from activities in connection with the work of schools, and schools have the status of a public authority, and the data are contained in a certain document(s), a justified public interest to know is assumed under this Law until proven otherwise by the public authority.

However, information on graduates at the same time constitutes personal data as well, within the meaning of Article 3 of the Law on Personal Data Protection ("Official Gazette of the Republic of Serbia" Nos.97/08, 104/09-other law, 68/12-decision of the Constitutional Court and 107/12) and its processing, which, in terms of the Law includes permission to examine a document or making it available in any other way, can be performed on legal grounds or on the basis of the consent of the person concerned.

Article 14 of the Law on Free Access to Information of Public Importance, specifies when the public's right to know may be denied or limited in favour of the right to privacy, which includes the right to protection of personal data. The same Article stipulates exceptions to the protection of privacy in favour of the public's right to know. One of the exceptions is the situation where there is consent of the concerned person, then in case of a person or an event of public interest or in the case of a person whose behaviour gave rise to requests for information. Weighing of interests between the public's right to know and the protection of privacy is done by the authority when acting on requests for access to information by applying Article 8 of the Law on Access to Information.

Based on the above, it follows that schools would not be able to make available to the applicant, as information of public interest, a list of graduates with the data on their addresses and telephone numbers without their explicit consent, regardless of the reasons why the information is required by the applicant (in order to invite people to the high school reunion). As for the names of graduates, access to this information is generally not controversial, unless if the persons concerned could be identified on the basis of the names in case of, for example, a small town where the school is located, which would constitute violation of their privacy .

If the names of high school graduates are published and publicly available, further use of such information or data would not be questionable in terms of free access to information and freedom of opinion and expression. However, if the use of obtained personal information exceeded personal needs of the individual, i.e. if the received data would be used to create new personal data files which would be available to others over the Internet or in any other way, then this would fall within the scope of the Law on Personal Data Protection.

(No.011-00-261/2013-03 dated 10 April 2013)

Commissioner has been requested to give an opinion whether lists of the city administration employees, their jobs and salaries may be made available at the request of an applicant, having in mind the provisions of Article 14 of the Law on Free Access to Information of Public Interest relating to the protection of privacy.

In the response to the request, among other things, it is stated that it is the Commissioner's general attitude is that the data on who is employed or engaged in a public authority, in which jobs and for what wage should be publicly available data, as they are related to the exercise of public authority, i.e. their activity on behalf of authorities, and not to private life, and that they are paid for that with public money.  Such attitude is based on the exemptions to the right to privacy pursuant to Article 14, paragraph 1, item 2 of the said Law.

The school asked the Commissioner for an opinion whether it should fulfil the request of an attorney of student's parents, who attends this School, by which it is asked for minutes of the school's Team for children protection against violence and other notes and statements regarding problems in the school, as these documents also contain personal data of students.
The Reponses states that the Commissioner, as a Protector of right to free access to information of public importance and right to personal data protection, make decisions in second-instance procedure and in that procedure he takes a stand in a specific case upon appeal, based on relevant facts and circumstances, which he will do in this case as well, if it comes to an appeal, therefore he presented only his principled position about the requested:
First of all, regarding the School's obligation to act upon a request, the Law on Free Access to Information of Public Importance ("Official Gazette of RS" Nos.120/04, 54/07, 104/09 and 36/10), obliges the School, as a public authority, to act upon each request for access to information, regardless of whether it grants the request or refuses the request; while in the firth case it is not obliged to issue a decision, but only to make an official note as a proof of acting (Article 16 (9) ), and in the later case it is obliged to issue a decision with rationale for such decision and information on legal remedy ( Article 16 (10)). The obligation of acting upon request exists even where a public authority does not hold requested information, but it is obliged to inform an applicant about it and act in accordance with Article 19 of the Law.
There is no dispute that the information contained in minutes of the school's teams, and other records created in the work of the School, are considered information of public information within the meaning assigned by Article 5 of the Law on Free Access to Information of Public Importance and as such, they can be a legitimate subject of requests for free access to information of public importance, by any person, including parents, or their attorneys, in accordance with Article 5 of the Law. In view of such information, there is a statutory presumption of justified interest of the public to know (Article 4).
At the same time, the Law in Articles 9 and 14 prescribes conditions and reasons for limitations of the right to free access to information of public importance, in part or in its entirety, where burden of proof is on acting body, namely the school. The school is obliged, in this specific case, where it alone recognizes the obligation to protect personal data using the so-called public interest test referred to in Article 8 of the Law, to outweigh prevalence of interests, between the right of the public to know, on the one hand, and other possible legitimate right or interest (from Articles 9 and 14 of the Law), such as the right to privacy or safety or any other vital interest of a person, on the other side.
Starting from the fact that access to, for example, school records could infringe the privacy of students or their families, the school will assess in a specific case whether conditions for application of exemptions specified in Articles 14 1) to 3) of the Law (for example, it is a phenomenon or event of public interest) are fulfilled, and if the school assesses that they are, the information will be made available to the applicant, and vice versa. Even if the school makes an assessment to allow access to documents, it is obliged to take into account protection of personal data, and in this regard, application of one of the basic principles of data processing, the principle of proportionality referred to in Article 8 of the Personal Data Protection Law ("Official Gazette of RS" Nos. 97/08 and 104/09-other law), and not to allow access to that personal data in respect of which the public should not have an interest to know, or which prevails over the public's right to know, such as data on ethnicity, social status, health status, address data etc., by protecting such personal data in documents prior to access.
Also, from the point of implementation of the Law on free Access to Information of Public importance it should bear in mind that one can not question the public's right to know under the guise of privacy, bearing in mind that there is always a possibility to anonymise personal data contained in documents or its protection by covering or extraction of sensitive data, in accordance with Article 12 of the Law on Free Access to Information that regulates partial access to information.
In acting upon requests for access to information, it should also have in mind that the term of information of public importance implies obligation of the authority that requested information made available to the applicant must be available to any other applicant or generally available to the public, as opposed to requests for exercising right in accordance with the Personal Data Protection Law, in connection with the processing of own personal data, that it the applicant, in which case the access is allowed only to data subject or his legal representative, if the applicant is a minor.
(Abstract, Response to the applicant, No.011-00-270/2012-03 dated 02.04.2012)

Data on debts of citizens for rendered public utility services might be deemed  information of public importance. However, the category of information concerned is information which penetrate into privacy and for that purpose they are subject to certain limitations pursuant to the provisions of the Article 14 of the Law on Free Access to Information of Public Importance.

In accordance with that, out of data which are being communicated to the public, should be excluded such data, on the basis of which might be identified citizen(s), save for upon his/their explicit consent (which is objectively less possible) or when he/they by his/their behaviour gave a reason for such information to be released (e.g. by asserting that his/their statutory obligations are settled regularly, denying the existence of debt towards the public enterprise concerned and the like).

The said limitations under the Art. 14 must not always be applied. For example, as far as persons of importance to the public are concerned, especially state or government officials, provided the information is important with respect to the function performed by such persons. Certainly, the existence of relevant circumstances and conditions should be assessed in each individual case.

(The answer is contained in the letter sent to an aplicant, no. 011-00-8/2006-03 of 08.04.2006.)

The Association of Disabled Persons filed a request for free access to information of public importance to the city administration requiring photocopies of lists of beneficiaries of personal disability allowance for war and peace veterans and of beneficiaries of family disability allowance for the purpose of reconciliation of records.

Acting on an appeal filed by the Association against the failure of public authorities to act, in accordance with Article 236 of the Law on General Administrative Proceedings, the Commissioner assessed whether the request is justified and found that it should be rejected on the following grounds:

What is undisputable is that the appellant’s request submitted to the public authority pertains to information created in operations or in connection with operations of the public authority and that the public authority does not deny it holds such information, as well as that such information as information of public importance within the meaning of Article 2 of the Law on Free Access to Information of Public Importance is a legitimate object of interest of an appellant or the public.

On the other hand, the type of information in this specific case is such that it undoubtedly contains personal data within the meaning of Article 3 of the Law on Personal Data Protection (“Official Gazette of the Republic of Serbia”, Nos. 97/08 and 104/09-other law), the access to which could violate the right to privacy and other personal rights, and which can be the reason to restrict the right to free access to information of public importance in accordance with Article 14 of the Law on Free Access to Information of Public Importance.

Article 14 of the Law on Free Access to Information of Public Importance stipulates that public authorities will not enable a requester to exercise the right to access information of public importance if it would thereby violate the right to privacy, the right to reputation or any other right of a person, except in the cases referred to in items 1), 2) and 3) of the said Article, i.e. if a person for whom information is requested gave his/her consent, if the information pertains to a person, an occurrence or an event of interest for the public or if a person’s behavior, particularly regarding his/her private life, gave rise to a request for information.

Taking into account that the appellant in this case requested photocopies of lists of beneficiaries of personal disability allowance for war and peace veterans and of beneficiaries of family disability allowance for the purpose of reconciliation of records, the Commissioner found that in this specific case the information requested is personal data within the meaning of the Law on Personal Data Protection, more specifically particularly sensitive data referred to in Article 16, paragraph 1 of this Law which can be processed only with express consent from a person to whom they pertain or in cases stipulated by he law, and since the quoted exception referred to in Article 14 of the Law on Free Access to Information of Public Importance cannot be applied, access to this information should not be allowed. This Commissioner’s opinion would not jeopardize the requester’s right to access information pertaining to funds from the budget paid as disability allowance and similar information, i.e. depersonalized lists containing the amounts of payments, which was obviously not an object of interest of the appellant in this specific case; the object of interest were personal data on beneficiaries for record-keeping purposes.

(from the Commissioner’s ruling, No.:07-00-00264/2010-03 of 10 February 2011)