SERBIA Law and Practice Contributed by: Vladimir Djeric, Lena Petrovic and Katarina Radovic, Mikijelj, Janković & Bogdanović
to the Commissioner for Protection of Personal Data (Article 11 of the ISA). According to the Constitution of Serbia, ratified inter - national treaties and generally accepted rules of inter - national law are part of the legal system of Serbia, and laws and other general acts enacted in Serbia have to comply with ratified international treaties and gener - ally accepted rules of international law (Article 194 of the Constitution). In the context of personal data protection, Serbia has ratified the Council of Europe’s Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and its Additional Proto - col regarding Supervisory Authorities and Transbor - der Data Flows (ETS No 108, Strasbourg, 28 January 1981) (the “Convention”). The Convention serves as a legal ground for transfer of data from Serbia to the UK after Brexit, since the UK is party to it and signatories of the Convention are considered to be countries that ensure an adequate level of data protection. Serbia is also a signatory to various international agreements that contain provisions that could be rel - evant for accessing or obtaining data processed in the territory of Serbia, mostly in the context of interna - tional co-operation in civil and criminal matters. Because Serbia is in the process of accession to the EU, much Serbian legislation focuses on the imple - mentation of the standards and provisions provided by EU legislation. Moreover, the PDPA contains solutions provided by the GDPR and the Directive (EU) 2016/680 on the pro - tection of natural persons with regard to the process - ing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data (the Police Directive). 1.2 Rights and Obligations Personal data processing in Serbia is governed by the principles of lawfulness, fairness, transparency, pur - pose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.
Processing must rely on a valid legal basis, such as consent, contractual necessity, legal obligation, legiti - mate interest, or public interest. Data subjects have rights to access, rectification, eras - ure, restriction, portability, objection, and protection against automated decision-making. Organisations must implement appropriate technical and organisa - tional measures and maintain internal accountability. Key compliance obligations include: • maintaining records of processing activities; • implementing data protection by design and by default; • appointing a data protection officer (DPO) where required; • concluding data processing agreements; • adopting breach response procedures; and • conducting data protection impact assessments where high-risk processing is involved. 1.3 Special Categories of Personal Data Special categories of personal data include personal data on racial or ethnic origin, political opinion, reli - gious or philosophical belief, or trade union member - ship; genetic data; biometric data for the purpose of uniquely identifying a natural person; data concern - ing health; or data concerning a natural person’s sex life or sexual orientation. Their processing is gener - ally prohibited unless a specific statutory exemption applies, such as explicit consent, employment law obligations, public health interests, or legal claims. Processing of data relating to criminal convictions and offences is permitted only under the control of compe - tent authorities or where expressly authorised by law. Consent for data processing is valid if it is given by a person of 18 years of age or older. Data concerning minors requires heightened protection, and consent must be obtained from a parent or legal guardian when information society services are offered directly to children. Exceptionally, persons aged 15 years or older are able to give consent in relation to online ser - vices.
397 CHAMBERS.COM
Powered by FlippingBook