Serbian Government Agency Publishes Personal Data of Over 5 Million Citizens · Global Voices
Screenshot of part of the documents containing personal information of citizens that were available on the official site of the Privatization Agency of the Republic of Serbia. Image by SHARE Foundation, used with permission.
A link from the official website of the Privatization Agency of the Republic of Serbia began circulating on social networks in early December 2014. The link led to 19 gigabytes of text files on the agency's site that revealed the personal information of over 5 million Serbian citizens who had registered for free stock of state-owned companies in 2008. The files included the full names of citizens who had registered, as well as their Unique Master Citizen Numbers (JMBG), a number given to each citizen from which a birth date, place of birth and other information can easily be deduced.
The link was caught on Twitter during the week of December 8, 2014, by the legal team of SHARE Defense, the think tank unit of local non-government organization SHARE Foundation that conducts research and offers legal aid in the realm of human and civic rights. 463
The foundation's team analysed the documents and reported the issue to the office of the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia. The links were removed from the agency's website in the afternoon hours of Friday, December 12, but it is impossible to know who downloaded the information in the meantime.
Citizens have started reacting on social networks, many calling this an “unforgivable” offense by a government agency. Twitter user <PERSON> tweeted a common sentiment:
Najveći bezbednosni propust u sferi zaštite informacionih sistema i privatnosti građana do sada u SR @ShareConference http://t.co/WO96P4IBTU
— <PERSON> (@TheCreaturesLab) December 15, 2014
The biggest security breach in the realm of information systems protection and citizens’ privacy to date in RS [Republic of Serbia] @ShareConference http://t.co/WO96P4IBTU
— <PERSON> (@TheCreaturesLab) December 15, 2014
It remains unclear why the documents were published on the site, if by mistake or otherwise. The office of the Commissioner for Information of Public Importance and Personal Data Protection took on the case immediately and it is expected that it will follow through with an investigation.
In the meantime, SHARE Foundation's legal think tank team has warned any and all who have downloaded the data that any use of part or all of the information in these files would represent a a criminal offense and has recommended that anyone who has retained a copy of any or all of the documents delete them permanently. 463