Employers in Serbia on daily basis have to publish certain labor document on the notice board. Delivery through the notice board, after the expiry of the period of 8 (eight) calendar days is considered orderly delivery in certain situations. For example, in one particular case, the employee refused to receive an offer to conclude the annex of the employment contract and the employer published the offer on the notice board. That documentation contained ID number of the employee, his residential address, work position etc.
Employee filed a notification to the Commissioner for Personal Data Protection and during the inspection it was established that the employer did not implement appropriate organizational, technical and personnel measures.
Article 5 paragraph 1 point 6) of the Law on Personal Data Protection stipulates that personal data must be processed in a way that ensures appropriate protection of personal data ("integrity and confidentiality").
Article 42 of the Law on Personal Data Protection stipulates that the data controller is obliged to:
- apply appropriate technical, organizational and personnel measures, such as the pseudonymization in order to reduce the number of data;
- ensure the application of the necessary protection mechanisms during data processing in order to fulfill the conditions for processing prescribed by this law and to protect the rights and freedoms of the people to whom the data refers.
The employer, as a data controller, is obliged to constantly apply appropriate technical, organizational and personnel measures in order to ensure that only those personal data that are necessary for the realization of each purpose are processed.
Article 83 paragraph 2 and 3 of the Labor Law stipulates that personal data related to the employee can not be shared with third parties, except in cases and under conditions established by law or if it is necessary in order to prove the rights and obligations arising from the employment relationship or are related to work, and that personal data of employees can be collected, processed, used and delivered to third parties only by the employee authorized by the director.
Article 185 paragraph 2 - 4 of the Labor Law stipulates that the decision should be delivered to the employee personally, at the employer's premises or at the employee's residential address. If the employer can not deliver the decision in person, it will be published on the notice board and considered delivered after the expiry of the period of 8 (eight) days from the date of publication. The same provisions about delivery shall be applied accordingly to the delivery of the offer for the conclusion of annex to the employment contract. However, the viewpoint of the Commissioner for Personal Data Protection is that the employer is unquestionably obliged to conceal certain data in case of publication, i.e. to apply appropriate measures aimed at ensuring the effective application of the principles of personal data protection. In case that the published documentation contained the employee’s ID number, employee's name and residential address, the principle of integrity and confidentiality of data from the Law on Personal Data Protection was violated.
It seems to us that few employers in Serbia actually apply the principles of the Law on Personal Data Protection when it comes to posting on the notice board.However, on the other hand, employers already have problems in labor disputes to prove that all required documentation was properly published on the notice board.
Every employer would justifiably raise a question how the court should act in labor disputes if it cannot be proven undoubtedly to which employee the document refers to.
This is certainly not an argument for disobeying the Law on Personal Data Protection, but it indicates the need that the actions of courts and other state authorities should be uniform, having in mind the obligation to protect personal data.
Article provided by INPLP member: Ana Popović (Živković Samardžić, Serbia)
Discover more about the INPLP and the INPLP-Members
Dr. Tobias Höllwarth (Managing Director INPLP)
