SERBIA Law and Practice Contributed by: Vladimir Djeric, Lena Petrovic and Katarina Radovic, Mikijelj, Janković & Bogdanović
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws The protection of personal data in Serbia is ground - ed in constitutional, statutory, and sector-specific sources. The Constitution of the Republic of Serbia guarantees the protection of personal data and the confidentiality of communications, allowing limita - tions only under strict legal and judicial conditions. The Constitution of the Republic of Serbia contains several provisions relating to the protection of privacy, including the confidentiality of letters and other means of communication (Article 41 of the Constitution) and the protection of personal data (Article 42 of the Con - stitution). Under the Constitution, the confidentiality of letters and other means of communication may only be dero - gated from for a specified period of time and based on a court decision for the purpose of conducting criminal proceedings or protecting the safety of Ser - bia, in a manner stipulated by the law (Article 41 of the Constitution). The Constitutional guarantee of protection of personal data (Article 42 of the Constitution) provides that use of personal data for any purpose other than that for which it was collected is prohibited and punishable in accordance with the law, unless it is necessary to conduct criminal proceedings or protect the safety of Serbia, in a manner stipulated by the law. The Constitution also guarantees that everyone has the right to be informed of the collection of personal data relating to them, in accordance with the law, as well as the right to court protection in the event of abuse of their personal data. The primary statute is the Personal Data Protection Act (PDPA), applicable since 2019, which is largely aligned with the GDPR and the EU Law Enforcement Directive. The PDPA applies across sectors and governs the processing, storage, and international transfer of per - sonal data. The solutions provided by the PDPA are in line with the GDPR. The PDPA defines personal data, the different types of personal data and the manner of their collection, processing and transfer outside of
the territory of Serbia. The PDPA has limited extrater - ritorial reach and applies to foreign controllers offering goods or services to individuals in Serbia or monitor - ing their behaviour. While Serbia does not regulate non-personal data or AI through binding legislation, data protection rules apply where AI systems rely on personal data, and policy alignment with EU develop - ments is ongoing. In August 2023, Serbia adopted the Personal Data Protection Strategy for the period from 2023 to 2030. The main goal of this Strategy is “[r]especting the right to protection of personal data in all areas of life”. Provisions that are of relevance to the protection of personal data may also be found in the Electronic Communications Act (ECA), as well as in sector-spe - cific legislation, such as the Act on Health Documents and Records, the Act on Records and Data Process - ing in Interior Affairs, the National DNA Registry Act and the Law on Social Cards. Also, the provisions of the Information Security Act (ISA) regarding data breach reporting and notifica - tion are relevant for protection of personal data and privacy. The ISA regulates (i) measures for protection against the security risks in ICT systems, (ii) the liabil - ity of legal entities in relation to the management of ICT systems, and (iii) the use of ICT systems and the competent authorities in charge of implementation of protective measures (Article 1 of the ISA). The operators of the ICT systems of essential services are obliged to notify RATEL, as the national CERT, of incidents and attacks related to the ICT system that may have a significant impact on informational security. An incident must be reported in writing to the national CERT within one day of its occurrence. If it relates to the secret data, the operator of the ICT system of special importance is also obliged to follow the rules on data secrecy (Article 11 of the ISA). If the reported incident is of a public interest, RATEL may order its public disclosure. If the incident is relat - ed to crimes prosecuted ex officio, RATEL shall inform the competent Public Prosecutor’s Office and/or the Ministry of the Interior. If the incident involves a viola - tion of personal data, RATEL will report the incident
396 CHAMBERS.COM
Powered by FlippingBook