After he learned that a large number of citizens received in their personal name and on their home addresses advertising material on sale of apartments in the residential facility "BW Residences" ("Belgrade Waterfront") and after suspicion arose that a personal database was used for this purpose without a proper basis and outside the purpose for which it was intended, the Commissioner for Information of Public Importance and Personal Data Protection initiated and conducted inspection.
Since logos "Belgrade Waterfront", "XYZ" and "EagleHills" were displayed on the advertising materials, inspection was carried out in companies "Beograd na vodi" d.o.o. and "Sportina" d.o.o. which sells the "XYZ" brand.
During the inspection it was found that the Law on Personal Data Protection was not violated. Personal data of members of the "XYZ" Club were used for sending the advertising material, who became members of this Club by signing a relevant form and entering their data themselves in the form, when they also signed explicit consent for their data to be used for notifications on promotional offers and other activities of both the "Sportina" d.o.o. company and its business partners. The activities in connection with sending of the advertising material were organized and performed by the "Sportina" d.o.o. company on the basis of a business cooperation contract with the "Beograd na vodi" d.o.o. company, without making citizens' personal data available to this company.
Concluding that although some citizens saw this direct marketing as harassment, in this specific case the right to personal data protection was not violated, the Commissioner warns citizens that it is important and necessary for them to treat their personal data as responsibly as possible and to pay attention to whom, under what circumstances and for what purpose defined they give their consent for processing of their personal data. There are numerous possible situations where easily given consent for data processing may not only result in serious adverse consequences, but may also exclude a possibility for any legal protection.
The Commissioner also reminds citizens that once given, their consent can be withdrawn and after withdrawal of consent data processing is inadmissible.
The Commissioner also warns and urges economic operators which hold databases of citizens' personal data formed on the basis of citizens' consent to bring the form and the content of such consent in compliance with the requirements for freely given and fully informed consent and to define the purpose of processing as clearly and as precisely as possible so that there are no dilemmas regarding admissibility.
