Citizens complain more often about the actions of doctors, checking personal data without a valid reason

When examining complaints of this type, similar to previous reporting periods, it was found that informational signs about video surveillance are most often not placed or the informational sign does not contain all the necessary information specified in the Data Law. It can also be observed that managers often do not want to install an information sign, believing that their rights are being violated because the information becomes publicly available.

It has been observed in the inspections of the conducted video surveillance that the supervisors, when determining the purpose of personal data processing, often indicate that the video surveillance is carried out to ensure public order, in this way trying to stop the illegal activities performed by the neighbor in the supervisor’s opinion and assuming the functions of law enforcement authorities. In addition, during the reporting period, a trend was found that the number of complaints about the use of smart devices that are equipped with a video recording function is also increasing.

Compared to 2022, the number of complaints about the processing of personal data in the information systems of state institutions has decreased – a total of 67 complaints were received and examined in this area. At the same time, it has been established that citizens are increasingly complaining about the actions of various medical personnel, checking personal data in the unified health system without any legally justified reason, that is, personal data were not considered within the scope of the medical episode.

In 2023, the Inspectorate, while examining the complaints of data subjects, applied corrective measures in 192 cases – warning, order, reprimand, processing restriction, calling on the controllers to fulfill the duties of the controller specified in the Data Regulation.

Among them, the controllers were obliged to comply with the data subject’s request, to implement appropriate technical and organizational measures to ensure and be able to demonstrably demonstrate that the processing is in accordance with the requirements of the Data Regulation, to coordinate the personal data processing activities carried out with the provisions of the Data Regulation regarding the correction or deletion of personal data, or restriction of processing.

In the past year, the inspectorate made a total of nine decisions in cases of administrative violations, in all cases the violator was fined.

In cases of administrative violations, the range of fines applied in the reporting year ranged from EUR 300 to EUR 20,000. In total, in 2023, the Inspection applied fines in the amount of 26,500 euros.