The Commissioner for Information of Public Importance and Personal Data Protection is finalizing the process of supervision over the implementation of the Law on Personal Data Protection (LPDP) in commercial banks operating in Serbia.
The Commissioner sent back in in March, immediately after completion of supervision, to the addresses of all banks a Warning that they perform, in various ways, unlawful processing of personal data by, without any basis in law, requiring and retaining photocopies of certain documents containing personal data (ID cards and passports of authorized persons, persons from specimen signature card and authorized to submit payment orders and withdrawal orders, owners having at least 25 percent of the shares in the capital, presidents and members of residents' associations, health cards of some persons, etc.).
The Commissioner obliged all the banks to notify him, within 30 days of receipt of the warning, of the measures to be taken to remedy the established irregularities.
Accordingly, all 29 commercial banks submitted a statement. Seven banks notified the Commissioner that they, immediately after receiving the warning, discontinued collecting copies of the above mentioned documents. Other banks also expressed their willingness to comply with the Commissioner's warning, but all the banks asked for an extension of the time period set to take measures to modify their own procedures, and remove and destroy already collected documents from the client files. Banks argued that the implementation of the measures necessary to remedy irregularities requires time, but they also mentioned the information that allegedly in a short period of time the amendments to the Law on the Prevention of Money Laundering and Terrorism Financing will be implemented, which will "legalize" retention of photocopies of documents that is now being performed without legal basis.
The Commissioner is meeting early next week with the President and the Secretary General of the Association of Serbian Banks, and then immediately after it, he will issue an order prohibiting further collection of photocopies of documents without a basis, and determining an appropriate deadline for the removal and destruction of the already collected documents.
The Commissioner said that this supervision procedure confirmed the worrying fact that the state, as well as in many other fields, also in banking sector, failed to provide the realization of constitutional guarantee that "the processing of personal data is regulated by law". It is obvious that contrary to the Constitution and LPDP large part of processing of personal data in this field is conducted based on bylaws of the National Bank of Serbia or internal procedures of commercial banks.
