The Commissioner for Information of Public Importance and Personal Data Protection commended response of the Serbian Tax Administration to a warning he submitted to it in connection with the manner of submission of tax rulings and enactments. The Commissioner warned the Tax Administration that sending of letters on which a unique personal identification number is also visible in addition to the name, surname and address of a taxpayer is contrary to the provisions of the Law on Personal Data Protection.

In this regard, the Commissioner requested from the Tax Administration to inform him within 15 days about the actions it took to eliminate these irregularities so that he could take further actions within his sphere of competence if necessary and the Tax Administration informed him that it would ensure full compliance with legislative provisions on data protection by changing the size of envelopes and by other appropriate measures.

Reminding that the practice of serving of enactments in the manner which unnecessarily jeopardizes citizens’ privacy is not typical only of the Tax Administration, Commissioner Rodoljub Sabic also urged all other entities to discontinue such practice. In that regard, he also said the following:

“All this is contrary to one of the main principles of personal data processing set out in the provision of Article 8, items 6 and 7 of the Law on Personal Data Protection. The Law only allows processing of data which are necessary and suitable for the purpose of processing. Service of enactments obviously requires only name, surname, street and number and number of apartment, where necessary. Information on a unique personal identification number is obviously unnecessary and its visible placement is not only an abstract violation of provisions of the law; it also implies unnecessary and serious risks of violation of privacy and possible abuse.

It is commendable that the Tax Administration responded in the right way and it would be even better if other entities which follow such practice would discontinue it even without the Commissioner’s warning. Failing that, in the case of the Tax Administration and in all other cases the Commissioner will take measures available to him – he will ban data processing in the manner which violates the right to personal data protection and he will file petitions for institution of infringement proceedings and, where necessary, also of criminal proceedings.”