SERBIA Law and Practice Contributed by: Vladimir Djeric, Lena Petrovic and Katarina Radovic, Mikijelj, Janković & Bogdanović
buyer must provide information on how their data will be used post-transfer.
The appropriate safeguards may be provided by a controller without requiring any specific authorisation from the Data Protection Commissioner by: • a legally binding instrument between public author - ities or bodies; • standard data protection clauses prepared by the Data Protection Commissioner that regulate the legal relationship between the controller and processor; • binding corporate rules that regulate processing of personal data by a controller and the group of companies to which the controller belongs; • an approved code of conduct, together with bind - ing and enforceable commitments of the control - ler or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights; or • an approved certificate issued in accordance with the PDPA, together with binding and enforceable commitments on the part of the controller or pro - cessor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights. The appropriate safeguards may also be provided through contractual clauses between the controller or processor and the controller, processor or the recipi - ent of the personal data in the third country or interna - tional organisation, or through provisions inserted into administrative arrangements between public authori - ties or bodies that include enforceable and effective data subject rights, but only with the specific authori - sation of the Commissioner, which is obliged to give such an authorisation within 60 days from the day of receipt of the request for authorisation (Article 65 of the PDPA). Further, under the PDPA, the data controller may intro - duce binding corporate rules that are adhered to by a controller or processor established in the territory of the Republic of Serbia for the purpose of a transfer, or a set of transfers, of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity. If the Data Protection Com - missioner approves the binding corporate rules, it is considered that a controller has provided adequate
5. International Considerations 5.1 Restrictions on International Data Transfers
Under the PDPA, international transfers of data to a country, a territory or one or more specified sectors within that country, or an international organisation that ensures an adequate level of protection does not require any prior authorisation (Articles 63 and 64 of the PDPA). It is assumed that an adequate level of protection exists in: • countries and international organisations that are parties to the Convention; • countries and international organisations that are considered by the EU to ensure adequate levels of protection of personal data; and • countries with which the Republic of Serbia has concluded international treaties regarding the transfer of personal data (Article 64 of the PDPA). The Serbian government has rendered a decision establishing the list of countries, parts of their ter - ritory or one or more specified sectors within those countries or international organisations which are considered to ensure the adequate level of personal data protection, specifying the countries to which the transfer of data may occur freely. Furthermore, under the PDPA, the transfer of personal data is also permitted to a country, a territory of, or one or more specified sectors within, that country, or an international organisation that does not have an ade - quate level of protection, if the controller or processor provides appropriate safeguards, and if enforceable data subject rights and effective legal remedies for data subjects are available in that country, a territory of, or one or more specified sectors within, that coun - try, or the relevant international organisation (Article 65 of the PDPA).
402 CHAMBERS.COM
Powered by FlippingBook