The Commissioner for Information of Public Importance and Personal Data Protection, in the process of preparing the Bill on Electronic Communications, which the Government of Serbia recently established, gave his opinion on two occasions, pointing to the need to review or change a number of solutions from the Bill for the purpose of personal data protection. The Ministry of Trade, Tourism and Telecommunications which prepared the Draft Law, largely accepted the Commissioner's suggestions and incorporated them into the text of the Bill.
The Commissioner, however, considers it necessary and important to draw the attention, once again, of the MPs and the public to the provisions of the Bill which prescribe the obligation to register prepaid SIM card users (Article 143).
Not using this opportunity to justify and expedient the introduction of such a solution (the review of which he suggested), assuming that the majority of the Assembly will share the government's commitment to mandatory registration of all SIM card users (name and surname, ID number, UMCN), the Commissioner indicates that even in this case, a number of questions will arise regarding the manner in which prepaid subscribers will be registered, especially those already existing.
In the first place, the law does not provide the answer to the question - when will this obligation come into force? The transitional provisions of the law state that the operator is obliged to do re-registration within 9 months, and to cancel the number of subscribers who failed to re-register within that period. However, it is stipulated that the time period of 9 months shall begin from the entry into force of the “Rulebook by which the Ministry will regulate, in more detail, technical conditions for registration”, and no deadline or date is specified in which the Ministry should pass this regulation. Therefore, the entry of the legal obligation into force is a future (un) certain circumstance, which, to put it bluntly, is a very “original” legislative solution.
The issue of objectivity of 9 months has also been opened. It should be kept in mind that the number of prepaid card users, that is, subscribers who have to do re-registration is approximately 4.5 million or 500 thousand monthly. In the light of this fact, it should be assessed whether such a timely period may result in unpleasant situations which the citizens already faced, for example, in the process of replacing health insurance cards.
From the aspect of personal data protection, the most important thing is that prepaid cards, at the current state of affairs, are not only purchased in the authorized organizational units of operators, but are also available on a large number of points of sale that are not in any way connected with the operators. The distribution of pre-paid cards is mostly dealt with by retailers, dealers, etc. The Commissioner states that it is obvious, unquestionable, that these persons cannot have the right to establish the identity of prepaid card customers and to keep and process their data. Such a solution would be inadmissible, because it would mean that a huge number of people, who are not even elementary trained on personal data protection standards, are entrusted tasks involving the processing of a large amount of data. Harmful consequences would be unimaginable in this respect. In that sense, if it remains that all subscribers, including pre-paid users, need to be registered, it is necessary to provide that only the persons trained in personal data protection rules can do registration tasks of pre-paid users.
