The Commissioner for Information of Public Importance and Personal Data Protection received a notice from the Institute for Student Health of Novi Sad stating that the Institute complied with the decision of the Commissioner ordering the end the processing and deletion of personal data collected without legal foundation through questionnaires filled out by students during 2015 health examination.

The Commissioner previously carried out the process of supervision over the implementation of the Law on Protection of Personal Data regarding a remonstrance by Gay Lesbian Info Centre in which it is stated that the Agency unlawfully collected data on sexual orientation.

During the inspection, persons authorized by the Commissioner found that the Institute kept copies of the 1780 questionnaires which ,in addition to identification information, contained answers to questions about sexual orientation, as well as answers to many other questions related to the psycho-physical and health condition.

This is information that under the Law on Protection of Personal data falls into the category of so-called particularly sensitive data and which consequently can be processed only on the basis of a free, written consent of the person, provided that the person is previously informed about the purpose and all other relevant questions in connection with the processing. Only in exceptional circumstances when the law expressly provides for it may these data be processed without consent.

Since these conditions are not met, it's about illicit data processing, and the Commissioner ordered that it be stopped and other appropriate measures be taken.

It is good that the Department immediately acted on the orders of the Commissioner and that the data from the questionnaires was not made available to other entities. It is good that the Institute gave an explanation for their actions, stating that the purpose of collecting these data was the screening of depression of the student population, which speaks in favor of the absence of bad faith, but it cannot eliminate the legal flaw, namely the fact that it is inadmissible.

The Commissioner said that this case is just one of many that warn against the disturbingly low level of understanding of the standards of protection of personal data on a day-to-day basis, which is due to complete absence of strategic, thought-out approach to the protection of personal data. The generally poor situation in this area is an inevitable consequence of the fact that such an approach at the global, national level has been missing for years.

The Regulation on Filing and Special measures to protect such data can serve as an almost grotesque illustration in connection with the so-called particularly sensitive data,. The Regulation, pursuant to Article 16 of the Law on Protection of Personal Data, should have been adopted by the Government in May 2009 the latest, but has not yet been adopted.