The Commissioner for Information of Public Importance and Personal Data Protection once again publicly warns legal entities and sole traders that provide private security services that, by retaining the identity documents of visitors who enter the buildings they secure, they perform inadmissible personal data processing and violate the Law on Personal Data Protection.
The fact that someone is authorised and required to verify a person's identity by examining his or her identity document never (except in cases explicitly specified by the law) translates to an authority to retain such documents. The Law on Private Security does not provide the basis for retention of personal documents, which means that their retention constitutes inadmissible processing of personal data for purposes other than those originally intended. Also, retention of documents (including photocopying) certainly increases the risk of potential abuse.
The Commissioner recalls that, after the Letter of Warning which he issued to the Ministry of Internal Affairs to the same effect several months ago, the Minister of Internal Affairs complied with the Letter of Warning by addressing to all police administrations in Serbia an instrument which ordered them "to immediately stop retaining the identity cards and other identity documents containing photos of persons who are issued with daily passes to enter buildings of the Ministry of Internal Affairs and other buildings in the territory of the Republic of Serbia where police officers are deployed to perform security operations."
In response to the Commissioner's Letter of Warning, the Ministry of Internal Affairs effectively put an end to the bad practice of many years, thus setting an example for other entities that perform similar operations to follow. However, many security service providers persist with this practice.
The Commissioner reminds that violations of the Law on Personal Data Protection are punishable by infringement fines (ranging from RSD 50,000 to RSD 1,000,000 for legal entities and from RSD 20,000 to RSD 500,000 for sole traders). The Commissioner will, of course, act on citizens' reports and file petitions for institution of infringement proceedings in accordance with his duties; however, he believes it would be much more cost-effective and responsible for the security service providers to bring their actions in compliance with the law themselves.
