The Commissioner for Information of Public Importance and Personal Data Protection initiated ex officio enforcement of the Law on Personal Data Protection in case of personal data processing when shareholders' personal data (names and surnames, home addresses, unique personal identification numbers, number of votes and number of shares) were published on websites of seven joint-stock companies.

Such publishing of data is yet another proof that entities handling citizens' personal data do not possess even basic knowledge of the Law on Personal Data Protection and other relevant laws and that their treatment of personal data protection does not satisfy the minimum standards.

This can be best seen from the fact that as early as two and a half years ago, in July 2013, after he found that several joint-stock companies published on their websites the single records of shareholders with full data on each individual shareholder, the Commissioner carried out a similar, very detailed supervision. The Commissioner then ordered such processing must stop and drew attention of all competent authorities to this. And the Central Securities Registry Depository and Clearing House warned all joint-stock companies of the following, in accordance with the Commissioner's recommendation:

"The single records of shareholders contain personal data the protection of which is regulated by the applicable Law on Personal Data Protection. The submitted document must not be published on the Internet or used for purposes other than those specified by the law".

This warning is still an integral part of every shareholders' register submitted by the Central Securities Registry Depository and Clearing House on request of joint-stock companies.

In spite of that, unlawful data processing continues. The unacceptably "lax", irresponsible and unlawful treatment of citizens' privacy is evident from the absurd fact that some of the joint-stock companies which are currently subject to supervision have published on their websites the warning of the Central Securities Depository and Clearing House on inadmissibility of publishing of data on the Internet and have "regularly" posted all personal data of shareholders right next to it!

After completion of the enforcement procedure, the Commissioner will file petition for institution of infringement proceedings against responsible persons to the competent courts and will inform the public of all relevant facts.