SERBIA Law and Practice Contributed by: Vladimir Djeric, Lena Petrovic and Katarina Radovic, Mikijelj, Janković & Bogdanović
• order the data controller or data processor to pro - vide information it requires for the performance of its tasks; • monitor the application of the provisions of the PDPA by exercising its inspection powers; • carry out a review on certifications issued in accordance with the PDPA; • obtain access to any premises of a controller or processor, including to any data-processing equip - ment and means; • issue reprimands to a controller or processor where processing operations have infringed provisions of the PDPA; • order the controller or the processor to comply with the data subject’s requests to exercise their rights pursuant to the PDPA; • order the controller or processor to bring process - ing operations into compliance with the provisions of the PDPA, where appropriate, in a specified manner and within a specified period; • order the controller to communicate a personal data breach to the data subject; • impose a temporary or definitive limitation, includ - ing a ban on processing; • order the rectification or erasure of personal data or restriction of processing; • withdraw a certification or order the certification body to withdraw an already-issued certification; • impose an administrative fine – in addition to, or instead of, other corrective measures – depending on the circumstances of each individual case; and • order the suspension of data flows to a recipient in a third country or to an international organisation (Article 79 of the PDPA). Other authorities with overlapping competences include RATEL (telecommunications and cybersecu - rity incidents), sectoral regulators, and courts. Pro - ceedings are typically triggered by data subject com - plaints, breach notifications, or ex officio inspections. Guidance issued by the Commissioner is formally non-binding but is treated as authoritative in practice and frequently relied upon by courts and public bod - ies. 1.8 Enforcement Proceedings and Fines Under the PDPA, the Commissioner is authorised to exercise its powers in accordance with the Adminis -
trative Procedure Act and Inspection Act (Article 77 of the PDPA) as well as to initiate proceedings before the courts and other competent bodies in accordance with the law (Article 79 of the PDPA). The Commissioner is obliged to act upon the com - plaints of a data subject and initiate the inspection procedure, as well as to inform the data subject about the outcome of the inspection and their right to initiate administrative court proceedings against the decision of the Commissioner. If the data subject is not satis - fied with the decision of the Commissioner, or if the Commissioner fails to act upon the complaint within 60 days from its receipt, the data subject is author - ised to initiate court proceedings against the Com - missioner in accordance with the Administrative Court Proceedings Act (Articles 82 and 83 of the PDPA). The enforcement of personal data protection is the remit of the Commissioner, who is authorised to inves- tigate whether data processing is lawful, including the right to request access to the premises of the data controller and means of data processing, as well as to order rectification of identified irregularities in data processing within a specified period of time, or to ren - der a temporary ban on any processing carried out contrary to the provisions of the PDPA (Article 79 of the PDPA). Data processing contrary to the provisions of the PDPA represents a misdemeanour punishable with a fine between RSD50,000 and RSD2 million for a legal entity, RSD20,000 and RSD500,000 for an entrepre - neur, and RSD5,000 and RSD150,000 for both a natu - ral person and the responsible person in a legal entity (Article 95 of the PDPA). 1.9 Enforcement Trends Enforcement activity in Serbia remains moderate and largely corrective rather than punitive. Recent trends show a focus on failure to maintain records, lack of DPO appointments, insufficient transparency, and inadequate security measures. Large-scale fines remain uncommon, and enforcement is often com - plaint-driven.
399 CHAMBERS.COM
Powered by FlippingBook