Unprotected: In Serbia, Personal Data is Anything but Secure

[1van]

Privacy data protection mechanisms are not working in Serbia – and it is far from clear that announced changes will deal with the core problem.

...

According to the National CERT, Computer Emergency Response Team, in 2022 the operators of ICT systems of special importance reported more than 7.5 million incidents of unathorised collection of data. Not all included personal data breaches, but the numbers indicate the level of information security in the country. On the other hand, in 2022 the Commissioner received only 181 citizens’ complaints, 23 less than in 2021, and performed 354 inspection oversights in the PDP field.

In general, Serbia does not have a commendable history of information management, especially when the data is handled by public authorities. Data from investigations has been leaking to the tabloids for decades, as in the case of Igor Vukotic, whose photo was mistakenly disclosed to Blic daily from the Serbian Intelligence Agency, which publicly marked him a member of an organized criminal group. Health records of political opponents and photos from hospitals are published, as in the case of the late actor Dragan Nikolic, while the political parties illegally process the personal data of voters almost on a regular basis.

The most massive data breach in Serbia was recorded back in 2014, when the data of over 5 million citizens in the database of the Privatization Agency became available on the agency’s website, and then on social networks. No one was found responsible for this omission because the agency ceased to exist.

Last June, Serbia’s cadastre information system was infected by a malware, endangering personal data of the register’s user and its employees. However, the authorized bodies concluded that there was no personal data breach in this case, so no further investigation was conducted in this regard.

In April 2020, the username and password for accessing the Covid-19 information system, with particularly sensitive health data of those tested, cured, deceased, as well as persons who were imposed a self-isolation measure, were publicly available on the website of a health institution.

...

Ceo tekst: https://balkaninsight.com/2023/07/21/unp...ut-secure/.