The Commissioner for Information of Public Importance and Personal Data Protection issued a Letter of Warning to the Crime Police Academy (CPA) in Belgrade, noting that, pursuant to Article 8 paragraph 1 of the Law on Personal Data Protection (LPDP), security checks carried out in a school admission process constitute inadmissible processing of personal data.

When finding security-related facts in the admission process, the CPA, without legal basis in any law, processes personal data of applicants and their parents and spouses, including certain data identified as sensitive under LPDP.

Furthermore, the consent obtained by the Academy from applicants also do not constitute proper legal basis for data processing, both because they are not given in the form and manner and subject to the conditions set out in Articles 10 and 15 of LPDP and – even more so – because consent can be given only for the processing of the applicants' own data and not for the processing of data relating to third parties, which is the case here.

In view of the foregoing, the Commissioner has warned the Academy of the fact that it carries out inadmissible processing of personal data and the Academy has a period of 15 days of receipt of the Letter of Warning to inform the Commissioner of the measures it put in place and the activities it intends to take to rectify the identified irregularities in personal data processing.