SERBIA Trends and Developments Contributed by: Vladimir Djeric, Lena Petrovic and Katarina Radovic, Mikijelj, Janković & Bogdanović
The Commissioner reiterated that employee consent is rarely valid and that legitimate interest requires par - ticularly careful assessment in the workplace context. Where controllers failed to demonstrate that employee interests and rights had been adequately weighed, processing was found to be unlawful. Notably, in at least one case, the Commissioner con - cluded that the only possible legal basis for the pro - posed processing would be valid, freely given con - sent, while simultaneously highlighting the difficulty of obtaining such consent in practice. This tension illustrates the narrow space available for intrusive monitoring measures under Serbian law. Data Breaches Arising From Routine Communications Email disclosures as reportable breaches Another prominent enforcement trend in 2025 con - cerned personal data breaches resulting from rou - tine electronic communications. The Commissioner addressed multiple cases in which controllers dis - closed email addresses of large numbers of individu - als by sending group messages without using blind carbon copy (BCC) functionality. In these cases, the Commissioner treated the disclo - sure of email addresses as a breach of confidentiality and integrity, regardless of whether sensitive data was involved. Importantly, the Commissioner emphasised that the absence of complaints from affected individu - als does not negate the existence of a breach or the controller’s reporting obligations. Failure to notify and organisational shortcomings Controllers were criticised not only for the initial dis - closure, but also for failing to recognise the incident as a personal data breach requiring notification. The Commissioner highlighted deficiencies in internal inci - dent response procedures, staff training and aware - ness. These decisions demonstrate that basic operational practices, such as email communication, are now firmly within the scope of enforcement scrutiny. Public authorities, educational institutions and other organi - sations handling large mailing lists are expected to
have clear internal rules governing electronic com - munications. Protection of Children’s Personal Data Online publication of photographs The protection of minors’ data was another area of heightened enforcement activity. In several cases, the Commissioner examined the publication of pho - tographs of children on websites operated by private entities, including commercial service providers and event organisers. The Commissioner adopted a strict interpretation of applicable standards, holding that the online avail - ability of children’s images constitutes processing that requires a clear legal basis and, in most cases, informed parental consent. The use of watermarks or technical limitations on image quality was deemed insufficient to mitigate the risks associated with pub - lic accessibility. Data protection impact assessments and organisational duties In addition to consent-related issues, the Commis - sioner criticised controllers for failing to conduct data protection impact assessments and for not appointing data protection officers where required. The absence of contractual arrangements with event organisers or other partners was also highlighted as a compliance failure. These cases illustrate an increasingly holistic enforce - ment approach, in which the legality of processing is assessed in the context of the entire organisational and contractual framework, rather than in isolation. Data Minimisation and Public Transparency Publication of recruitment and appointment documents A further important trend in 2025 concerned the appli - cation of data minimisation principles in the context of public transparency. The Commissioner addressed multiple cases involving the publication of recruitment decisions and ranking lists containing personal identi - fication numbers and home addresses of candidates. Controllers frequently argued that such disclosures were justified by transparency obligations or by the
406 CHAMBERS.COM
Powered by FlippingBook