The Commissioner for Information of Public Importance and Personal Data Protection sent a warning to the Pension and Disability Insurance Fund because of irregularities in the processing of insured persons' personal data by this Fund.

When insured persons request issuing of certificates they need to enroll they children in preschool institutions, the Pension and Disability Insurance Fund issues them a copy of the complete M4 form instead of issuing certificates, without any legal grounds. In addition, the complete M4 form contains much more personal data than necessary and required for the intended purpose (on years of service of insured persons, salaries, compensations...).

This not only contravenes the fundamental principle of the Law on Personal Data Protection, which provides the legal basis for data processing, as well as the principles of purposefulness and proportionality; it also unnecessarily exposes personal data of insured persons to the risk of abuse, which cannot and must not be justified by "simpler" and "more expedient" acting of the competent authorities. More generally, the ubiquitous and long-standing practice of employees ignoring and underestimating their duties regarding personal data because it is "easier" or "more convenient" for them to do so must be eliminated as soon as possible.

The Commissioner ordered to the Pension and Disability Insurance Fund to inform him within 8 days about the measures it would take to rectify the irregularities identified by the Commissioner.