The Commissioner for Information of Public Importance and Personal Data Protection has been addressed by a large number of health care institutions seeking his opinion on the situations in which they are faced with the requests of public prosecutor's offices, directly or via the police, for forwarding the documentation on the health status of their patients.

The Commissioner estimates that this is yet another situation in a series of situations which confirms a disturbing inconsistency of our normative system, particularly in the field of personal data protection. In this regard he has forwarded letters to the Minister of Health and the Republican Public Prosecutor highlighting the necessity of introducing appropriate legislative solutions and of the harmonization of their handling by the public prosecutor's offices.

In this regard the Commissioner, Rodoljub Sabic, has stated the following:

"Such requests of the public prosecutor's offices are grounded on Article 282 of the Criminal Procedure Code, pursuant to which the Public Prosecutor may submit a request to public and other authorities and legal entities to provide the necessary information.

Simultaneously, pursuant to the Law on Patients' Rights the data about the health status shall be considered as particularly sensitive data which all health care professionals and associates shall keep, and pursuant to Article 22 they can be released of this obligation only upon written consent of the patient or by court decision.

Therefore, in the current situation, to honor the request of a public prosecutor's office, pursuant to Article 282 of the CPC, health care institutions should submit medical documentation to the public prosecutor's office. However, should they do so, they would violate their duty of keeping personal data, referred to in Article 22 of the Law on Patients' Rights, and commit an offense punishable under this Law.

While taking into consideration that the new CPC has introduced the so-called ''prosecutorial investigation'', as opposed to the long-standing practice of the court being in charge of the investigation, one cannot ignore the fact that the Law on Patients' Rights still expressly provides for the court's jurisdiction over the processing of the personal data contained in the medical documentation.

The foregoing is extremely important, given that the health status data, pursuant to Article 16 of the Law on Personal Data Protection, fall within the category of particularly sensitive personal data, whose processing falls under the special regime and which cannot be disposed of like any other type of personal data. These data may be processed only on the basis of informed consent of data subjects, and exceptionally, without their consent, insofar as this is allowed under the law.

The importance of human rights protection, especially personal data protection and the need for efficient yet legal criminal proceedings, require the relationship between public prosecutors' offices and health care institutions, to be clearly and unambiguously regulated by law and complied with in practice, which is why I have addressed letters with proper content to the Minister of Health and the Republican Public Prosecutor."