The Serbian State Audit Institution (DRI) warned that the state-owned Telekom Serbia has complete access to personal data for school children through digital school records, Nova Ekonomija magazine said on Friday.

The DRI issued a report dated May 30 on the software which allows parents access to their children’s grades and teacher comments. The software was made by Telekom Serbia and the Zagreb-based Tesla company.

The DRI said that the way the two companies are processing the personal data entered into the software is not fully in line with the law. Serbia has a law governing personal data which states who can access that data but does not include sanctions for possible violations. Nova Ekonomija said that the Education, Science and Technological Development Ministry failed to introduce rules and procedures to ensure the safety of personal data in terms of contracts with Telekom and Tesla. Contracts with those two companies include a confidentiality clause but without a control mechanism, the DRI report said.

The Share Foundation’s Jelena Adamovic warned that someone wants to collect the personal data of the entire population into a single IT system without a risk assessment. She recalled that the Education Ministry decided to introduce a single digital system instead of allowing each individual school to set up its own system, creating huge risks. “Data processing always has a purpose but that purpose is not clear in this case…. This is intrusive and the data is accessible to a wide circle of people and could potentially be misused,” she said.

The DRI warned that the Education Ministry did not introduce rules on security procedures and signed contracts with several companies to process the data, violating the law on personal data which says that the data processing can only be done by someone who can guarantee the implementation of all required measures.
The DRI said that a company owned by Tesla Software (not one of the contractors) gained unauthorized access to personal data of school children in May 2020, sending parents a number of offers. The Commissioner for Public Information and Personal Data launched an investigation.

The Education Ministry published a 1.6 milllion Euro tender for the school records software in mid-2018 with conditions set that could be met only Tesla Zagreb, the Krik investigative portal reported, adding that then Education Minister Mladen Sarcevic worked with the company through his private school.

The software is currently in use in more than 500 elementary and high schools across the country with more than 1.3 million children, teachers and parents registered.