The Commissioner for Information of Public Importance and Personal Data Protection assesses that yesterday's announcement of the National Bank of Serbia (NBS), which insinuates the existence of some kind of alleged omissions in the process of supervision of the implementation of the Law on Personal Data Protection which the Commissioner conducted in all commercial banks in Serbia, can only, as an effect, mislead the public.
This NBS's statement, regardless of the motive, objectively supports unlawful processing of citizens' personal data by commercial banks.
It is inappropriate and quite unnecessary that the NBS calls the Commissioner to "take care of the unity of the legal system and other laws". The Commissioner has clearly announced that it will prohibit the processing of personal data that is not based on any law. The Commissioner already in March warned all 29 commercial banks for performing, in various manners, unlawful processing of personal data, by requiring and retaining, with no basis in law, photocopies of passports, ID cards and health cards, and on this occasion he gave them the opportunity to, if they can, quote the legal basis for such processing. The banks could not do that, since such a basis does not exist. It is also needless that the Commissioner calls the NBS to quote publicly provisions of any law which would make such data processing lawful because the NBS knows well that such provisions do not exist.
Whether the NBS will support the practice in which the processing of personal data is not based and not exclusively regulated by the law, as required by the Constitution, but it is introduced and implemented based of secondary legislation (the decision of the NBS itself or internal bylaws of commercial banks), it is the matter of commitment and, of course, responsibility of the NBS itself. But it is really not realistic of the NBS to expect the Commissioner's support, especially unrealistic is to attempt to impose some sort of an "obligation" on the Commissioner to consult the NBS before taking action to prevent obviously unlawful processing of personal data.
Finally, as regards the principal call for "cooperation between state institutions for the common good of the citizens", the Commissioner is always available to the NBS. But, in this regard, he must also note that for almost seven years of the implementation of the Law on Personal Data Protection, the NBS, although the creator of a number of acts relevant to the processing of personal data almost never has found necessary to seek the Commissioner's opinion.
