The Commissioner for Information of Public Importance and Personal Data Protection welcomes that the Administration for the Enforcement of Penal Sanctions ordered all institutions for the enforcement of penal sanctions to urgently act upon the recommendations and comments of the Commissioner regarding unlawful processing of personal data. The Commissioner, however, at the same time reminds to the limited range of specific measures since some problems are systematic and cannot be rectified by individual actions, but they must be addressed at the global, national plan.

The Commissioner sent the recommendations and comments to the Administration for the Enforcement of Penal Sanctions after performed inspection supervision, in the second half of 2014, over the implementation of the Law on Personal Data Protection in the Administration and institutions for the enforcement of penal sanctions. The supervision showed numerous shortcomings and omissions in connection with the processing of personal data of persons deprived of their liberty, but also visitors and employees.

In addition to the shortcomings in connection with the unlawful and excessive processing of personal data of visitors or excessively "transparent" processing of personal data of employees, uncontrolled video surveillance, the attitude towards data on the health status and mental health of inmates deserved special attention. Although it is required, necessary and justified that only health services of the institution deal with the processing of such data, security services have intensively done it too. Cumulative records of inmates are kept not adequately secured and accessible to unauthorized persons, in certain cases, even to inmates. It is necessary to ensure that the sensitive data, subject to possible abuse, is kept in an appropriate manner and be available solely to the competent services.

Since the health information and data on convictions for offenses under the law fall into the category of so-called particularly sensitive data, this is an opportunity to once again remind you of the great, incomprehensible omission in normative activities of the Government in relation to the protection of personal data.

In fact, although Article 16 of the Law on Personal Data Protection provides that particularly sensitive data must be protected by special safeguards, and that the filing method and the scope of safeguards shall be defined by the Government, upon obtaining the Commissioner's opinion, the Government, after six years of delay, has not yet passed appropriate regulation.