The Commissioner issued a Warning on irregularities in personal data processing and ordered the City Administration to inform him within 15 days of all actions to be taken to remedy the irregularities.
The Commissioner also filed a motion for instituting misdemeanor proceedings against the Head of the Belgrade City Administration. Circumstances indicate that the majority of observed omissions result from decisions made outside the administration, in an inadequate procedure and without the necessary formal instruments, however the motion for instituting misdemeanor proceedings was filed against the Head, since the Head had been designated as a responsible person under the law.
The investigation found and it was noted in the Record that the Administration processed data on the Unique Citizen ID Number even though the data was unnecessary, unsuitable and disproportionate for the purpose of processing, and the "explanation" that the processing happened due to an "omission" is quite unacceptable.
It was found that personal data that were not based on a credible source had also been processed, or that the pensioner status was often not checked appropriately. Thus, inter alia, it was not possible to exclude the possibility that the cards had been issued to a number of persons who were not pensioners.
It was also established that the data were processed for purposes other than those specified in a person's consent, since the explanation was that the date of birth and Unique Citizen ID Number were collected "for the purpose of congratulating the birthday", which is in no way connected to the purpose defined as "notification of a benefit ".
It was determined that the Administration had failed to inform the Commissioner of the processing before it started, although it has a statutory obligation to do so 15 days prior to the start of processing at the latest.
Since other towns have announced similar actions, the Commissioner reminds all local authorities that, if they sincerely want and have the opportunity to secure discounts for pensioners, this may be achieved under the decisions issued by local self-government assemblies or bodies of public enterprises and published by the media and by these authorities on their official webpages. The authorities may also invite all other economic operators to follow their example and announce those who have opted to do so in the above-mentioned way. Pensioners, if and when necessary, may prove their status with various similar means (decision, check, etc.), which are commonly used in practice. Essentially, assistance to pensioners is not dependent on the production and issuing of any cards. Such actions unnecessarily raise questions regarding the rational use of budget funds, and most importantly, unnecessary creation of new, large personal data files, additional opportunities for data misuse, or violation of the right to personal data protection.
