The Commissioner for Information of Public Importance and Personal Data Protection is pleased with the response and reaction of the National Health Insurance Fund ("the Fund") to the warning notice he sent to this institution due to irregularities in the processing of personal data of the insured.
The Fund confirmed in its response that it will entirely comply with the warning, and that all organizational units of the Fund have already been notified to immediately cease the unlawful data processing.
The Commissioner previously performed an inspection supervision procedure during which it was established that the Fund requires, for the payment of compensation for temporary inability to work, from employers to obtain from the insured full assessment of expert-medical body and to communicate it to the Fund. The Fund, as a "basis" for such data processing, cited provisions of the Rulebook on the manner and procedure for exercising the right under compulsory health insurance.
In this regard, the Commissioner Rodoljub Sabic said the following:
"The Serbian Constitution provides that the legal basis for personal data processing, other than voluntary and express consent of the data subject, may be only a law, not a legislation of less legal force. Accordingly, this Rulebook or any other bylaw may not constitute a valid legal basis for data processing.
The Health Insurance Law (Art. 170) stipulates that salary benefit is paid upon a report on temporary inability to work, so-called medical leave pay voucher. Collection of full assessment of expert-medical bodies has not been provided under any provision of this or any other law, and consequently data processing done by the Fund is, contrary to the Law on Personal Data Protection, unlawful.
Due to the extremely large volume of such processing of personal data by all employers in the Republic of Serbia and then by the Fund, the sensitivity of the data included in assessments and serious consequences of their possible abuse, especially the conditioning and the denial of the right to compensation to the employees in the event if they fail to deliver assessments to their employers, particularly pointed to the need for rapid, urgent remedy of irregularities.
It is good that the Fund quickly reacted upon the warning. But, I must take this opportunity to point out that this is yet another confirmation of a very disturbing situation in the field of personal data protection, the bad, quite inadequate attitude of the state towards this field. To illustrate, let me remind you that only in the last month several interventions of the Commissioner completed, in the similar way, for unlawful processing of data (in the cadastre, in correctional institutions, in the action of free textbooks) by state authorities. It is good that these interventions gave results, but it's not good that the number of problems is increasing, not decreasing.
So, I will also take this opportunity to reiterate that if you want positive changes in this completely neglected field, it is necessary to have a designed strategic approach, defined at the state level, which, for years, despite numerous warnings by the Commissioner, is still missing, for incomprehensible reasons."
