Press Releases

Important Jubilees of Commissioner for Information of Public Importance and Personal Data Protection Marked

The Commissioner for Information of Public Importance and Personal Data Protection marked two jubilees today in Belgrade, at the Metropol Palace Hotel – twenty years since the first adoption of the Law on Free Access to Information of Public Importance in the Republic of Serbia, and fifteen years since the adoption of the law establishing the Commissioner’s competence in the field of personal data protection.

The ceremony was attended by the Minister of Public Administration and Local Self-Government – Jelena Žarić Kovačević, the Deputy Ambassador of EU to Serbia – Plamena Halačeva, the Commissioner – Milan Marinović, the Deputy Commissioner – Sanja Unković, as well as Dominique Thierry – on behalf of the OSCE Mission to Serbia.

Minister Žarić Kovačević congratulated the institution of the Commissioner on its jubilee and recalled the importance of one of the first independent bodies of public administration.

“Today we mark twenty years of dedicated and sincere work on building a stable and independent institution of high trust and integrity, an institution that has rightfully earned the highest degree of trust of the citizens of Serbia, continuously working in their interest and wholeheartedly supporting the fundamental human right – the public's right to know, while constantly steering local public authorities to be open and transparent,” said the Minister.

The Deputy Ambassador of EU to Serbia, Plamena Halačeva, also addressed the gathering.

“This jubilee is not only an opportunity to celebrate the institutional successes of the Commissioner, but also a moment to reflect on the challenges we have faced and the work that lies ahead. We must acknowledge the many successes achieved — such as the Commissioner’s active role in enforcing the data protection law, efforts to combat unlawful personal data processing, and the resolution of thousands of complaints regarding citizens’ right to access information. However, we must also recognize areas where further progress is necessary. While the law has made significant progress in aligning the data protection framework in Serbia with the EU’s General Data Protection Regulation (GDPR), gaps remain in implementing penalties for violations. These gaps highlight the importance of advocating for stronger sanctions and more robust enforcement mechanisms to secure complete protection of individual’s rights,” Halačeva stressed.

Commissioner Milan Marinović stressed that he is confident that in the time ahead, citizens’ awareness will be raised of who the Commissioner is, what his role is, and his importance for the human rights he protects.

“When you build a house, you need to maintain it and constantly invest in it so that it doesn’t dilapidate in its 20 years of existence. The same goes for institutions. If you don’t maintain and repair them, and actively work on their preservation and improvement, institutions, like houses, can dilapidate and completely collapse. Some have suffered that infamous fate. Fortunately, the Commissioner for Information of Public Importance and Personal Data Protection did not suffer a bad fate. At the time of my election to the position of Commissioner, at the end of July 2019, there were 84 employees in the Commissioner’s office, while today there are 122, with a tendency for the number of employees to reach over 150 by the end of next year,” he said.

Deputy Commissioner Sanja Unković pointed out the importance of educating students, which the Commissioner's Office conducts through study programs at several faculties in the Republic of Serbia, but also the goal of raising awareness in the field of personal data protection through formal education of the youngest. She noted the importance of the Commissioner's regional offices in Novi Sad, Niš, and Kragujevac for bringing this institution closer to citizens outside Belgrade.

"In the personal data protection field, the institution has grown from a few cases per year to several thousand cases, from just a few to over 20 inspectors. Also, at the beginning of the institution's work, there were only a few in this field, but now the number of employees has increased to more than 40. In the past, a law degree was requisite for work in this Office but today knowledge of information technologies is also requisite due to the risks posed by artificial intelligence," concluded Unković.

Dominique Thierry emphasized that the Commissioner's activities are reflected not only in his contribution to personal data protection but also in the growth of trust in the institutions that protect such data. The institution of the Commissioner covers the rights on which the basic principles of work of the OSCE Mission to Serbia are based: the protection of human rights, the rule of law and trust in the work of public administration bodies.

The Commissioner expressed his gratitude for the assistance provided to now by international and domestic institutions, without which this institution couldn't function effectively.

20 godina Poverenika 2

COMMISSIONER OPENS OFFICE IN KRAGUJEVАC

Today, the Commissioner for Information of Public Importance and Personal Data Protection opened a third office in Kragujevac outside the headquarters in Belgrade. The office is located on the premises of the Faculty of Law of the University of Kragujevac, at the address Liceja Kneževine Srbije 1.

Commissioner Milan Marinović emphasized that this is the third regional office of the Commissioner, in addition to the offices in Novi Sad and Niš, and that it will also facilitate communication in this part of Serbia between citizens and the Commissioner and establish a faster and more efficient system for resolving the right to free access to information of public importance and personal data protection.

In addition to Commissioner Milan Marinović, guests and media representatives were also addressed by a City Council for Economy member Radomir Erić, who emphasized the importance of opening the Commissioner's office in Kragujevac.

Kragujevac otvaranje novo

Commissioner’s Public Release: “Zdravitas”

Zdravitas

The Commissioner for Information of Public Importance and Personal Data Protection conducted an extraordinary field supervision inspection on the implementation of the Law on Personal Data Protection (“Official Gazette of RS”, No. 87/2018) regarding the data processing of minors within the portal “Zdravitas” by the Ministry of Education as Data Controller.

In the procedure of extraordinary inspection supervision, it was established that the Ministry of Education and the Institute for the Evaluation of the Quality of Education and Upbringing, within the Strategy for the Development of Education and Upbringing in the Republic of Serbia until 2030 (“Official Gazette of the RS”, No. 63/21) and the accompanying Action Plan, developed the project Development and application of the software for monitoring the physical development and development of motor skills of primary and secondary school students. The project was launched on the Cooperation Agreement regarding the establishment of a platform for monitoring the students’ physical and motor status, within the framework of physical and health education classes, with the Office for IT and eGovernment which provides continuous technical support for the design, harmonization, development, and system functioning, while ensuring data protection, safety and security measures.

The aforementioned agreement more closely regulates the rights and obligations regarding the establishment and management of a software solution – an information system for recording and monitoring the physical and motor status of students within the framework of physical and health education classes, by which the Office was obligated by the Ministry, for the purpose of establishment of the portal ” Zdravitas”, to procure and implement software (administrative and user software); provide the necessary infrastructure and resources for the system operation, ensure the necessary integrations of the “Zdravitas” system with a single sign-on (single sign-on system available at eid.gov.rs); provide continuous technical support for the functioning of the “Zdravitas” portal with complying data protection provisions, safety and security measures, in accordance with the regulations governing Electronic Administration and Information Security, as well as to sign a contract on personal data processing, where the Ministry of Education was to draw up and submit to the Office’s signature the Agreement on Personal Data Processing in accordance with Article 45 of the LPDP and the Decision on Establishing Standard Contractual Clauses (“Official Gazette of the RS”, No. 5/20), by which the Office is to take over the management and maintenance of the said information portal after the implementation of the software solution “Zdravitas”. A Personal Data Processing Agreement was concluded between the Ministry of Education and the Office for IT and eGovernment, regulating the relationship between the contracting parties in connection with the personal data processing activities entrusted to the Office by the Cooperation Agreement regarding the establishment of a platform for monitoring students’ physical and motor status.

During the inspection supervision proceeding, it was determined that the legal basis for the establishment of the “Zdravitas” portal is contained in Article 177, paragraph 1, point 3a) of the Law on the Fundamentals of the Education and Upbringing System (“Official Gazette of the RS”, No. 88/17, 27/18, 27/18, 10/19, 6/20, 129/21 and 92/23), which stipulates that the data for determining the students’ physical and motor status within the educational system, and gathered through the students’ physical and motor status monitoring system under the framework of physical and health education classes are to be entered in the register of children, students, adults, and students.

Monitoring the development of physical and motor skills of students is determined through the teaching programs within the scope of Physical and Health Education subject, namely:

Rulebook on the teaching and learning plan for the first cycle of primary education and upbringing and the teaching and learning program for the first grade of primary education and upbringing (“Official Gazette of the RS – Educational Gazette”, no. 10/17, 12/18, 15/18, 18 /18, 1/19, 2/20, 16/22, 1/23 (correction), 13/23, 14/23 and 11/24);
Rulebook on the teaching and learning program for the second grade of primary education and upbringing (“Official Gazette of RS – Education Gazette”, no. 16/18, 3/19, 5/21, and 13/23);
Rulebook on the teaching and learning program for the third grade of primary education (“Official Gazette of the RS – Education Gazette”, no. 5/19, 1/20, 6/20, 7/22, and 13/23);
Rulebook on the teaching and learning program for the fourth grade of primary education (“Official Gazette of the RS – Education Gazette”, no. 11/19, 6/20, 7/21, 1/23, and 13/23);
Rulebook on the teaching and learning plan for the fifth and sixth grade of primary education and upbringing and the teaching and learning program for the fifth and sixth grade of primary education and upbringing (“Official Gazette of RS – Education Gazette”, no. 15/18, 18/18, 3 /19, 3/20, 6/20, 17/21, 16/22, 13/23, and 14/23);
Rulebook on the teaching and learning program for the seventh grade of primary education (“Official Gazette of the RS – Education Gazette”, no. 5/19, 1/20, 6/20, 8/20, 5/21, 17/21, 16 /22, 13/23, and 14/23);
Rulebook on the teaching and learning plan for the seventh and eighth grade of primary education (“Official Gazette of the RS – Education Gazette”, no. 18/18, 13/23);
Rulebook on the plan and program of teaching and learning for high school (“Official Gazette of the RS – Educational Gazette”, no. 4/20, 12/20, 15/20, 1/21, 3/21, 7/21, 14/23);
Rulebook on the teaching and learning program of general education subjects in vocational schools (“Official Gazette of the RS – Educational Gazette”, no. 7/13 and 14/23);
Rulebook on the plan and program of gymnasium teaching and learning for students with special sports skills (“Official Gazette of the RS – Education Gazette”, number 11/13);

Monitoring, evaluation, and recording of students’ physical abilities is carried out and based on the Manual for monitoring the students’ motor skills and physical development within the framework of physical and health education classes, which are available on the official websites of the Institute for the Evaluation of the Quality of Education and Upbringing and the Institute for the Improvement of Education and Upbringing;

In the inspection supervision proceeding, it was determined that the purpose of data processing is determined in Article 181, paragraphs 1 and 2 of the Law on the Fundamentals of the Education and Upbringing System. On the “Zdravitas” portal, the following student data are being processed: first name, last name, name of one parent (legal representative), JMBG (Unique Master Citizen Number), JOB (Unique Educational Number), date, place, and the municipality of birth, gender, body height, mass, body mass index (body fat within the body composition), running for 20m with a progressive increase in speed, sit and reach flexibility test, 30 seconds sit to stand test, long jump, pull-up hold, and speed cones 4x10m running, following the said regulations on the teaching and learning program within the subject of Physical and Health Education and manuals for monitoring the students motor skills and physical development, and that the Portal does not process data on the students’ health status. The “Zdravitas” portal will contain data from the records that schools already maintain as part of Physical and Health Education.

Students’ personal data on the user part of the portal will be in the form of reports on motor skills and physical development and will be accessible only to parents or legal representatives of students who are authorized. If parents/legal representatives are not authorized users of the portal, the said data could also be downloaded from the competent teacher at the school.

In addition to the administrator, the data in the administrative part of the portal can only be accessed by the authorized user, i.e. the school director, school employees – an authorized person designated by the school director, form teacher, primary teacher, and physical and health education teacher for the students for whom they are responsible.

Before establishing the portal, the Data Controller assessed the impact of the planned processing actions on personal data protection and undertook technical, organizational, and personnel measures, to achieve the appropriate level of data security regarding the risk. Also, the Data Controller created an application form to obtain parameters (username and password) for accessing the user part of the “Zdravitas” portal. Upon supervision inspection of the said form, it was determined that to obtain access parameters, the entry of the following personal data is required:

for the student: first and last name, class, and name of the school;
for the parent/legal representative: name, surname, unique master citizen number (JMBG), e-mail address, and signature of legal representative.

Based on the factual situation, it was determined that the Ministry of Education processes data under Article 12 of the LPDP, and the data subject’s consent is not required for the processing in question.

In Nick of Time to Prevent Abuse of Public's Right to Know

"In the year when we mark two decades since the implementation of the Law on Free Access to Information of Public Importance, an effective tool for government control, we are talking about unscrupulous lawyers and individual citizens who twist the meaning of the law to the detriment of the weakest and most under-equipped authorities. I mean over 1,000 schools, 4,000 local communities, hospitals, cultural institutions, kindergartens, and those who have to use their already limited resources to respond to their senseless demands. In this way, these individuals damage not only the poor budgets of these authorities but also the budget of the Republic of Serbia. So far, over 62,500,000 dinars have been ordered to be paid to the lawyers. In reality, the damage is incomparably greater because it also requires the engagement of additional human and material resources, toners, papers, costs of postal services, and overtime work of employees. By 2019, the total percentage of complaints filed via lawyers was an average of 4%, while in 2023, the share of lawyer-filed complaints was 82%. Thus, the Commissioner previously received an average of 3,627 complaints per year; in 2023 16,711 were reported. On the other hand, all those who use the law for its intended purpose cannot exercise that right because the authorities are burdened with an enormous amount of these requests," said Commissioner Milan Marinović on the occasion of the International Right to Know Day, which took place today at the Serbian Chamber of Commerce and Industry.

He further pointed out that the symbol of this year's meeting is a clock that strikes 5 to 12 (Serbian idiom for the in the nick of time), which means that the last hour has struck to act on preventing a disaster from occurring.

At the end of the presentation, Commissioner Marinović said that he hopes that next year, at Right to Know Day, we could discuss the real exercise of rights without further abuses. With the announced amendments to the law, we aspire to restore the true meaning of this right.

Representatives of foreign delegations also spoke in the opening remarks H.E. Jan Braathu, Head of the OSCE Mission to Serbia, Mr. Janoš Babić, Head of the Council of Europe Office in Belgrade, Mrs. Plamena Halačeva, Deputy Head of the EU Delegation to Serbia, and Mrs. Naida Zečević Bin, Director of the Office for Democratic and Economic Growth in USAID Serbia, supporting the Commissioner's institution in its efforts to preserve and improve this right.

This year, the Commissioner awarded the following bodies recognition for their contribution to the promotion of the public's right to know: in the category of republic authorities, it was awarded to the Republic of Serbia Public Policy Secretariat; in the category of provincial authorities, it was assigned to the Property Administration of AP Vojvodina; in the category of local public authorities, to the municipality of Kanjiža; in the category of judicial authorities, to the Higher Court in Pirot; in the category of other authorities, the certificate was awarded to Elementary School "Kralj Petar I" from Niš. The main award, for a special contribution to the promotion of the right to access information (statue), was not awarded this year.

Acting Assistant Secretary-General Slavoljupka Pavlović presented the latest publication number XIII with the Commissioner's opinions from this field (Serbian language only).

At the end of the meeting, acting Assistant Secretary-General Zlatko Petrović presented new improvements to the Unified Information System of Information Booklets, streamlining the system for authorities and users to use.

Dan prava javnosti da zna 2024

Here you can see the event's PHOTO GALLERY (photographer Marina Jančević)

You can also watch the event video on the Commissioner's YouTube channel.

PUBLIC RELEASE

Representatives of independent supervisory authorities engaged in personal data protection in the Western Balkans region, that is the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia, Mr. Milan Marinović, and Deputy Commissioner Ms. Sanja Unković, Director of the Agency for Personal Data Protection and Free Access to Information of Montenegro Mr. Čedomir Mitrović with members of the Council of the Agency, Mr. Muhammad Đokaj and Mr. Zoran Vujičić, and Director of the Agency for Personal Data Protection in Bosnia and Herzegovina dr. Dragoljub Reljić with his deputy Mr. Anto Boras and Assistant Director Mrs. Samira Čampara, regarding the change in the privacy policies of the company Meta and the platform "X" concerning personal data processing for the purpose of developing artificial intelligence, at a meeting held in Sarajevo on September 4, 2024, agreed on the following:

It is established that the mentioned companies have started processing personal data to develop artificial intelligence without prior notification to the users of their services in the Western Balkans countries that are not members of the European Union.
It is established that these companies have not designated their representative for personal data processing in the Republic of Serbia, Montenegro, and Bosnia and Herzegovina.

Exercising the right to protect the personal data of citizens, the representatives of the independent supervisory authorities of all three countries agreed to jointly act towards the said companies coordinating all the activities they undertake in these cases. This initiative will be open to all other independent supervisory authorities of the Western Balkans and Eastern Partnership countries.

Representatives of all three independent supervisory authorities will jointly address the European Data Protection Board (EDPB) and the Data Protection Commission of the Republic of Ireland as competent authorities for dealing with these companies in the European Union.

To streamline the coordination of the achievement of this initiative's goals, the representatives of all three independent supervisory authorities agreed that the Director of the Agency for Personal Data Protection of Bosnia and Herzegovina Dr. Dragoljub Reljić should be entrusted with this coordination.

Zapadni Balkan

Press Releases - Archive