Upon complaints received from a number of citizens regarding problems in implementation of the so-called Busplus Program, the Commissioner for Information of Public Importance and Personal Data Protection inspected implementation and execution of the Law on Personal Data Protection by the Marketing and Services Company "Аpex Solution Technology" d.o.o.
Upon inspection, the Commissioner banned processing of certain primary school pupils' personal data by this company and ordered certain measures to be taken.
In that regard, Commissioner Rodoljub Sabic also said the following:
"Inspection was performed in connection with petitions stating that primary school pupils received two forms which should be filled by their parents, one titled "Application for Issuing of Personalized Non-contact Smart Card" and the other titled "Plus Benefit Program Access Form", while it was not indicated that the latter form is not compulsory and is used exclusively for marketing purposes.
Upon inspection, I passed a ruling banning further processing of the following data by the Marketing and Services Company "Аpex Solution Technology" d.o.o.: address, mobile phone number, phone number and e-mail address contained in the document titled "Application for Issuing of Personalized Non-contact Smart Card" and ordering deletion of these data in all received forms in hard copy (we will make a separate record of this), since there is no legal ground for processing of these data. The time limit to comply with these orders is three days of the receipt of this ruling.
As regards the Notification on Processing contained in the form titled "Plus Benefit Program Access Form", adequate orders were given in the ruling to the Marketing and Services Company "Аpex Solution Technology" d.o.o. In order to rectify other violations of the Law on Personal Data Protection, it was ordered to indicate clearly and unambiguously in the Notification to pupils and their parents that they do not have to provide the data requested in this form, i.e. that they do not have to fill this form. It was also ordered to the company to inform all primary schools in the territory of Belgrade which collect pupils' data about adequate data safeguards. The time limit to comply with these orders is seven days of the receipt of this ruling.
The data controller "Аpex Solution Technology" d.o.o. must inform the Commissioner about compliance with the ruling and measures taken within seven days of the receipt of the ruling, and must also send a copy of records on the implementation of the ordered measure."
