SERBIA Law and Practice Contributed by: Vladimir Djeric, Lena Petrovic and Katarina Radovic, Mikijelj, Janković & Bogdanović
1.4 Processing of Personal Data for Research and Development Purposes Companies providing digital tools or technologies used in healthcare may process patient data for research and development purposes if a valid legal basis exists and appropriate safeguards are applied, in accordance with the PDPA. Scientific and statistical research may rely on legal obligations, public interest, or consent, provided data minimisation and confidentiality are ensured. Serbia does not yet have legislation comparable to the Euro - pean Health Data Space Regulation, but alignment is expected as part of EU accession. 1.5 Processing of Personal Data in the Context of Artificial Intelligence Serbia does not currently have binding AI legislation. However, the use of AI systems involving personal data remains subject to the PDPA. Controllers must ensure transparency, purpose limitation, data accu - racy, and proportionality when training or deploying AI models. Automated decision-making that produces legal or similarly significant effects is restricted unless based on explicit consent, contractual necessity, or legal authorisation, with safeguards including human inter - vention. Serbia’s 2025–2030 AI Strategy envisages the adoption of comprehensive AI legislation by 2027, likely reflecting a risk-based approach similar to the EU AI Act. In practice, organisations are expected to implement internal governance, bias mitigation, explainability measures, and human oversight when AI systems process personal data. 1.6 Data Breach Requirement In the event of a personal data breach, controllers must notify the Commissioner without undue delay and, where feasible, within 72 hours after becoming aware of the breach. Notification to affected data sub - jects is required if the breach is likely to result in a high risk to their rights and freedoms. The notification must describe the nature of the breach, likely consequences, and measures taken or
proposed to mitigate harm. Controllers must docu - ment all breaches internally, regardless of notification obligations. Data breaches may trigger inspections by the Com - missioner, co-ordination with the national CERT under the Information Security Act, and potential misde - meanour proceedings. 1.7 Regulators The primary supervisory authority is the Commission - er for Information of Public Importance and Protection of Personal Data. Under the PDPA, the Commissioner is a supervisory body that: • monitors and enforces the application of the PDPA; • advises the national parliament, the government and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to processing; • provides information to any data subject concern - ing the exercise of their rights under the PDPA; and • co-operates with the supervisory authorities of other states. The Commissioner also: • handles complaints lodged by a data subject; • prepares standard contractual clauses and author - ises contractual clauses that would serve as an adequate safeguard for the transfer of data to a country or international organisation that does not ensure adequate levels of protection of personal data; • establishes and maintains a list in relation to the requirements for a data protection impact assess - ment when required by law; and • accredits certification bodies, issues certifications and approves criteria of certification (Article 78 of the PDPA). Data Protection Commissioner Powers The Commissioner is vested with a set of investiga - tive powers, corrective powers and advisory powers that are identical to the powers of the supervisory body prescribed by the GDPR. The Commissioner is authorised, inter alia, to:
398 CHAMBERS.COM
Powered by FlippingBook