The Commissioner for Information of Public Importance and Personal Data Protection would like to once again remind all state authorities that hold citizens’ personal data and the officials and employees of those authorities that they have an undeniable duty under the law to treat those data fairly and responsibly.

This duty implies that personal data should be processed exclusively for the purposes specified by the law and that all necessary measures should be undertaken to protect the data from unauthorised access and abuse.

Making citizens’ personal information available to third parties, individuals, companies or political organisations without a legal basis is the direct and complete opposite of this duty.

Those authorities or individuals that make citizens’ personal data available to third parties create potential for those data to be abused for various purposes, including the use of such data in public showdowns between political adversaries on social networks and in social media.

The Commissioner would like to reiterate that officials who unauthorizedly and unlawfully make citizens’ personal data available to third parties commit not only an infringement under the Law on Personal Data Protection, but also a criminal offence under Article 146 of the Criminal Code, which is punishable by imprisonment for up to three years.

Presuming from the fact that unlawful actions of the authorities or officials is a particularly sensitive issue in case of the police and the Ministry of the Interior, the Commissioner recalls that the Minister of the Interior had responded to one of the Commissioner’s earlier warnings by sending a letter to all organisational units which explicitly stated that unauthorised processing of personal data cannot be tolerated and would be subject to criminal prosecution. In view of certain concerns that have recently been raised and also as a matter of general principle, the Commissioner expects such practice of liability for unlawful handling of citizens’ personal data to be implemented and consistently applied.

This, of course, applies to all authorities. The Commissioner would like to underscore once again that the frequent cases of lax treatment of personal data protection must be met with a different, far more involved response from the public prosecutor’s office.