Many citizens have brought to the attention of the Commissioner for Information of Public Importance and Personal Data Protection the fact that their personal data are processed on the websites of certain companies, which they consider unlawful because it is done without their consent or without explicit legal basis.
The issue is that those companies provide searches of individual’s data based on name and surname or unique personal identification number and process numerous data on individuals, including lawsuits in which they are a party, their title to real estate, financial lease, pledge and various other data.
In this context, the Commissioner would like to quote Article 5 of the Law on Personal Data Protection, which states inter alia that the provisions of that Law do not apply to the processing of data “available to everyone and published in mass media” and “data published about oneself by a person capable of taking care of his/her interests.”
Accordingly, in cases where data processing services involve enabling access to database(s) created by retrieving or cross-referencing data contained in multiple publicly available sources (the Business Registers Agency, the Account Register of the National Bank of Serbia, the Cadastre, the Court Portal etc.), there is in principle no grounds for declaring such processing illegal or for exercise of the Commissioner’s powers in relation to those persons.
In this context, the Commissioner once again underscores the importance and calls for action at the national level to ensure proper coordination and critical review of the justifiability and purpose of making large amounts of personal data available online by various state authorities under different laws, which, when cross-referenced, enable data processing that is infinitely more complex than the original purpose of each individual data file.
The Commissioner advises citizens it is in their best interest to treat their personal data much more responsibly, as they seem to be far too willing to provide their personal data online or to give written consent for the processing of their personal data to various companies, customer clubs etc.
