The Commissioner for Information of Public Importance and Personal Data Protection sent a letter to the Minister of Education of the Republic of Serbia in connection with the activities aimed at establishing a single record of primary and secondary school pupils within the single information system of the Ministry of Education. In his letter, the Commissioner pointed to a number of outstanding issues in connection with the protection of pupils' privacy and personal data.
In this regard, Commissioner Sabic said:
"Whenever any processing of personal data is concerned, the fundamental, internationally affirmed principle is that data processing without consent of the data subject concerned can be performed only under the law, for the purposes defined in the law and only to the extent necessary for achieving such purposes.
"This principle has to be accepted as indisputable in Serbia as well. In this context, it is necessary to evaluate whether these requirements are met in each specific situation. It is necessary to determine whether legal grounds need to be introduced and whether there is any need for it in relation to such records.
"The public is not fully aware which data can be subject to processing, i.e. which data can be included in such records. Unofficially at least, we have learned from the media of many possible data categories in such records - from pupils' marks, school attendance and attendance of extracurricular activities, through other data on pupils, such as their social circumstances, even ethnicity for example, to data on parents (personal details, wealth, profession etc.) and even evaluations of and observations on pupils' health, psychological profiles etc.
"However, other than some highly generalized provisions of the Law on Basic Elements of the Education and Upbringing System, there are no legislative provisions that would provide for the maintenance of a single record at the ministry level, let alone provisions that would define what constitutes the single information system. Nor does the Law stipulate which personal data should be submitted to the Ministry, to what extent and who they shall be used by. There are likewise no stipulations providing for the protection of such data, which is particularly important given that some of the required data belong to a category treated as particularly sensitive under the Personal Data Protection Law.
"In view of the foregoing, without attempting to evaluate the functionality of this and other similar records, I believe it is necessary to make all efforts to regulate the legal issues of the establishment and functioning of such records in accordance with the generally accepted principles in this field and the provisions of the Personal Data Protection Law."
