Yesterday and today The Commissioner for Information of Public Importance and Personal Data Protection addressed a number of media, journalists and citizens on the occasion of the presentation of information on the health status of citizen A.K. on TV PINK.
On that occasion, the Commissioner warned that even the Constitution of the Republic of Serbia (Article 42) itself prohibited and punished the use of personal data beyond the purpose for which they were collected, except for the purposes of criminal proceedings or the protection of national security. Therefore, only the competent authorities had the right and duty to deal with the processing of personal data collected by other parties for other purposes, but only for the purpose of combating crime and the protection of national security, and not out of it, especially not to the "purpose" of placing these data to the general public.
In that context, it was extremely worrying that enormous and increasing amounts of personal data classified, among other things, by the law as "particularly sensitive data" from the medical records, or the results of the polygraph test, the contents of the testimony of witnesses and the like appeared in the media.
Since the powers invested in the Commissioner refer not to the processing of data by members of the media, on this occasion the Commissioner recalls that his code of ethics clearly states that "Even if competent national authorities publish information in the domain of privacy of the perpetrator or the victim, the media possessing that information is not allowed to transmit it. An error state on the part of state authorities does not imply "permission" for violation of ethical principles of the profession. "
But, a lot more is rightly expected from state authorities. It is expected and they are obliged to demonstrate an incomparably more responsible attitude towards citizens' personal data, which among other things includes the responsibility of individuals who are in breach of those obligations.
In the present case, for example, this morning The Commissioner already ordered the supervision of implementation of The Law on the Protection of Personal Data in the Clinic for Mental Disorders "Dr Laza Lazarević", and after the procedure, as usual, the public will be informed of the results. However, the Commissioner reminds the public that the protection of the health data includes not only the overall protection covered by the Data Protection Act but also express special protection from the Law on Patients' Rights and that The Ministry of Health is responsible for monitoring the implementation of that law. And in general, in relation to the specific and any other similar cases, the Commissioner warns that in the case of the emergence of personal data in the public the relevant Criminal Code and Art. 146 CC provides that an official who communicates or uses the lawfully collected, processed and used personal data for the purpose other than intended, will be punished with imprisonment of up to three years.
The Commissioner, of course, need not and cannot supersede all relevant authorities in carrying out their responsibilities and obligations. He particularly cannot conduct criminal proceedings, as it is a job for legal authorities prescribed by law. That is why it is indicative and alarming that even after many repeated warnings by the Commissioner and more criminal charges filed, no one has been prosecuted for the crime under Article 146, and no examples of a misdemeanor and disciplinary proceedings closed up in a satisfactory manner.
It is high time that the issue of liability in relation to the protection of personal data starts to be treated in a fundamentally different way. It is necessary to stop with past practice, the one that is compromising from the standpoint of standard normal functioning of the state and a constant source of numerous serious violations from a standpoint of human rights guaranteed in our Constitution.
