The Commissioner for Information of Public Importance and Personal Data Protection sent a Warning to the "Dr Dragisa Misovic" Health Care Center in Cacak in which he stated that fingerprinting employees in order to control their use of work hours constitutes an unlawful personal data processing according to Article 8 of the Law on Personal Data Protection. The Commissioner ordered the Center to inform him of the measures undertaken in order to remove the aforementioned determined irregularities in 15 days time, so that the Commissioner can apply further measures if need be.
In this regard, the Commissioner Rodoljub Sabic also stated the following:
"A large number of employees of the Health Care Center, who believed that the control of their work hours performed in this manner infringed on their privacy, contacted the Commissioner with the request for their rights to be protected.
After the inspection, it was determined that the Center organized fingerprinting of their employees, more precisely - taking images of the employees' fingers from three standpoints, later combining those images into an algorithm unique for each and every employee. This algorithm would be stored in the central server and would be used to identify the employees as they come to and leave from work. In the context in which the personal data processing was performed, by introducing biometric measures, the principle of proportionality was violated, which is one of the basic principles of the Law on Personal Data Protection. This type of processing is excessive and disproportional, and represents an unnecessary violation of an individual's privacy, since the control of the employees' work hours can be performed in other, less invasive, ways. Taken into consideration that for this type of data processing there is no legal basis or employee consent, the Commissioner issued a Warning. I expect from the administration at the Health Care Center to adhere to the Warning; however, in case it is necessary, other measures shall be applied as well.
This case is specific because, for the first time in Serbia, the issue of biometric personal data processing is being formally addressed. That is why this is a good opportunity to warn once again of the fact that Serbia does not have any legislation that would regulate the field of biometric data processing. If this remains as such, taken into consideration that the aforementioned issue is very delicate for many citizens from the legal, ethical, psychological, religious, or other standpoint, it is certain that we will have to face more frequent and larger problems in this regard.
In order to overcome these problems, even though there are no legal solutions, we have to insist on the application of accepted international standards stemming from the Directive 95/46/EC, standards according to which the biometric personal data processing is only permitted for reasons clearly stated in law, meaning when it is absolutely necessary. I would like to emphasize again that a responsible attitude towards biometric personal data processing requires regulating this field by law."
