In connection with the statement given by Dr. Slavica Djukic Dejanovic, Director of the Clinic for Psychiatric Diseases "Dr. Laza Lazarevic", who said "this Clinic has not violated the law" when processing personal data, more specifically the medical and psychiatric documentation of citizen A.K., which were subsequently disclosed in a TV programme, the Commissioner for Information of Public Importance and Personal Data Protection would like to draw the public's attention to the following, without any intention to engage in a debate with the Director:

"According to the Law on Personal Data Protection, medical information is categorised as particularly sensitive data. Processing of such data is admissible only with the data subject's request or if it is explicitly authorized by the law.

In this specific case, consent was obviously not given. As regards the legal basis, I would like to remind that, in addition to the Law on Personal Data Protection, Serbia also has a special law, namely the Law on Patients' Rights, which additionally regulates this issue by setting out that medical institutions can make patients' personal data available to other entities only with patients' consent or on the basis of a court decision.

Of course, there was obviously no court decision. Even if it were possible to accept the opinion of the Director that the Clinic forwarded the data to the Ministry "because the Ministry is authorised to supervise the Clinic", this would, as a minimum, imply the initiation and conduct of supervision in the manner and according to the procedure set under the law, none of which happened in this specific case.

The Clinic sent the documentation, indeed a set of "particularly sensitive data", pursuant to a request which was de facto absolutely informal, without any statement of reasons and was not even signed. The document was sent unlocked and unprotected by e-mail in .pdf format, although appropriate safeguards should have been used in accordance with the law.

The situation being as it is, I believe the claim that "the Clinic did nothing to violate the law" deserves no comment."