The Commissioner for Information of Public Importance and Personal Data Protection filed a request for initiating misdemeanor proceedings with the Magistrate's Court in Belgrade against the public utility company Infostan and Generali osiguranje Srbija a.d.o., as well as against the persons responsible, the directors of both companies.

The Commissioner filed the request for initiating misdemeanor proceedings regarding the case in which the PUC Infostan used a collection of personal data of its customers with the aim of including the amount not due for home insurance in the delivered bill for utility services. Such an action constitutes the case of unauthorized processing of personal data, i.e. processing without legal grounds or without the consent of the person whose data is used, which is an offense under Article 57 of the Law on Personal Data Protection.

The Commissioner had previously, through authorized persons, carried out the procedure of control in both companies and upon the completion of the procedure he ordered elimination of irregularities in the processing of personal data. Both companies were ordered to immediately cease unlawful processing of personal data and Generali osiguranje Srbija was ordered to destroy all the data collected without legal grounds.

The Commissioner, in this regard, warns that this is not an isolated case and that the practice of using collections of personal data which, among others, are at the disposal of public utilities companies, for other purposes than those for which they have been established without the consent of the citizens in question is evidently widespread. It is not realistic and rational to expect lawful handling of personal data to be secured only by actions and interventions of the Commissioner. The employees of the bodies of public utility companies are people appointed by the government, whether national or local, and they have an indisputable obligation and responsibility to ensure that operations of these companies are in compliance with laws, including, of course, the Law on Personal Data Protection.

The Commissioner himself will continue, as before, to insist on all forms of liability for violation of rights guaranteed by the Law on Personal Data Protection.