SERBIA Law and Practice Contributed by: Vladimir Djeric, Lena Petrovic and Katarina Radovic, Mikijelj, Janković & Bogdanović
3.4 Regulators and Enforcement No dedicated authority oversees non-personal data regulation.
Under the Employment Act of the Republic of Ser - bia, employers are allowed to collect data regarding their employees where this is prescribed by that Law and other laws related to employment matters. The Employment Act also authorises employers to moni - tor the work of their employees, a provision that is frequently used in practice as a ground for accessing employees’ computers and email communications. In this respect, the Commissioner has taken the position that such access is allowed if the computer and email account were provided by the employer for the pur - pose of work performance and if it does not invade the employees’ privacy. If an employee is using a private email account or private computer, the employer may access the data contained therein only in the presence of that employee, who will then be able to prevent the employer’s access to private communication and files. In a recent ruling, the Commissioner took the position that an employer must not continue to use its former employee’s email account upon termination of employment, as it contains the employee’s name: a piece of personal data whose processing is no longer During the due diligence procedure, the seller should minimise data exposure and use anonymised or pseu - donymised data where possible. NDAs must also be signed. The transfer of personal data in M&A and asset deals is regulated by the PDPA. When they involve personal data (eg, customer or employee databases), the trans - fer must have a valid legal basis under the LPDP: (i) legitimate interest (Article 12 of the PDPA), (ii) consent if the transaction involves sensitive data or when no other legal basis is available (Article 15), and (iii) legal obligation (Article 17) (eg, employment records). justifiable, legal and necessary. 4.4 Data Protection in M&A Once the transaction is closed, the buyer becomes the new data controller and must inform data subjects (customers, employees) of the change. If the transfer changes the purpose of data processing, additional consent may be required. If the buyer is outside Ser - bia, data transfers must comply with the PDPA’s rules on international transfers (transfers to countries with - out an adequate level of protection require standard contractual clauses (SCCs) or other safeguards.) The
4. Sectoral Topics 4.1 Use of Cookies
Serbian legislation does not have special rules gov - erning the application of cookies, beacons, the use of tracking technologies or behavioural advertising; therefore, the general rules of the PDPA apply to these areas as well. In practice, opt-in consent is required for non-essential cookies, particularly where personal data is involved. 4.2 Personalised Advertising and Other Online Marketing Practices The PDPA does not contain special provisions regard - ing online marketing. However, it does regulate pro - cessing for direct marketing purposes and entitles the data subject to object at any time to the processing of personal data concerning them for such marketing, which also includes profiling (Article 37 of the PDPA). With respect to other aspects of online marketing, the general rules on data processing apply. The Advertising Act (AA) also contains a provision that allows direct advertising only with the prior consent of the person to whom the advertising is sent (Arti - cles 62 and 63 of the AA). Behavioural advertising and targeted advertising are not regulated explicitly by Serbian law. 4.3 Employment Privacy Law Under the PDPA, the processing of employees’ per - sonal data must be carried out in accordance with the provisions of employment law and collective agreements, based on the principles set out by the PDPA. The PDPA also recognises that employment regulations and collective agreements may contain provisions related to the protection of personal data of employees, in which case they also need to specify suitable and specific measures to safeguard the data subject’s human dignity, legitimate interests and fun - damental rights (Article 91 of the PDPA).
401 CHAMBERS.COM
Powered by FlippingBook