The Commissioner for Information of Public Importance and Personal Data Protection has conducted a number of investigations of compliance of the Ministry of Internal Affairs with the Law on Personal Data Protection, after which he issued relevant Letters of Warning for the purpose of remedying the identified irregularities in personal data protection.
The underlying causes of these irregularities are more or less the same as those generally observed with other entities: ambiguity and inconsistency of relevant laws and regulations; insufficient level of training of persons involved in the processing of citizens' personal data; lack of systems that would allow concrete identification of officials who access official databases containing personal data; and, most importantly, the inherited mentality which sees invasions of privacy as "not a big deal", which as a rule creates situations where no one is held to account.
The Commissioner notes it is commendable that the Ministry of Internal Affairs has been fully cooperative during the supervision procedure and has given the Commissioner, i.e. his authorised officers, access to all relevant data. Furthermore, the Ministry responded to the Letters of Warning by confirming its willingness to comply with them, to improve the process of education of its officers and to build and further develop proper systems for accessing software within the Single Information System of the Ministry of Internal Affairs.
Although most of the cases of unjustified – and hence unauthorized – access of police officers to databases containing citizens' personal data were apparently not driven by malicious intent, bur "merely" by curiosity, this of course cannot and should not be tolerated: perpetrators should be held to account and the penalties provided for by the law should be imposed whenever there is any unlawful processing of personal data. In this context the Commissioner commends as beneficial and good the fact that the Minister of Internal Affairs has sent an official note to all organizational units at the Ministry's headquarters and all regional police administrations in which he ordered the commanding officers of the organizational units, in the light of a number of investigations initiated by the Commissioner, to instruct their employees that any processing of personal data contained in the Ministry's databases and systems – unless it is a specifically ordered official action – entails liability for the criminal offence provided for in Article 146 paragraph 3 of the Criminal Code.
