Data Protection in Serbia

Why Is Personal Data Protection Important?

Personal data protection has become an essential part of everyday life if we are to live with at least some degree of safety in today’s digitally oriented world. Raising awareness, together with adopting new rules and adapting existing ones, is therefore the necessary basis for bringing order into data processing. Applying and interpreting these rules in the context of the processing that takes place every day, and bringing controllers and processors into compliance with them, is by no means an easy task. The context of processing, which is often inseparable from electronic communications and new technologies, requires not only legal knowledge but also a high level of understanding of the technical processes involved, so that the understanding of personal data protection is complete and adequate. Moreover, over the last two decades the positions of the world’s most valuable companies have been taken by those whose business model is built on the benefits of new technology. These are, in fact, companies that charge for their services, among other things, with the personal data of the individuals who use them. In these important processes, all parties involved in processing need adequate legal and security support.

In the text that follows, we give a brief overview of the origins and legal nature of data protection and of the basic principles on which today’s rules rest, with particular reference to the Serbian Law on Personal Data Protection (Official Gazette of the Republic of Serbia, No. 87/2018, hereinafter: LPDP), which is modelled on the GDPR:

1. Privacy: the Right to Be Let Alone and the Development of Data Protection

The right to privacy is a fundamental human right proclaimed by international agreements and conventions, by the constitutive acts of nation states and unions, and by laws. The legal norms that provide for its protection are among the most important achievements of legal theory and practice.

Originally conceived to guarantee that a person’s mail, later also messages sent through other telecommunications channels, and the home in which they live would be inviolable by third parties, the concept of privacy has been given an entirely new and deeper dimension by modern high technology, and above all by the internet.

The idea of privacy goes back to antiquity. Aristotle first referred to it in his Politics, distinguishing between the private and the public sphere in the sense of goods of individual or general importance.[1] The ancient Greeks also separated the private from the public in practice. This began with architecture: houses were built so that certain rooms were kept secluded, while windows and other openings were designed to let light in but not to allow views from public spaces. However, the fact that privacy was known in ancient Greece and Rome does not mean that it was respected to the extent we know today. In Rome in particular, wide unfenced gardens were fashionable, and in the public baths naked people were a common sight. Only with early Christianity, which promoted silent prayer and the right to and need for solitude and seclusion, did privacy in the full sense of the word gain importance. If we also consider the act of confession, and especially the practice in Western Christianity, where confessionals were designed to provide visual privacy for the penitent, we can see how significant privacy within society and in human relations is in the Christian faith. In the relationship with God, however, Christian belief and tradition know no privacy, since the relationship between man and God is direct and transparent.

[1] D. Popović, M. Jovanović, Pravo interneta: odabrane teme (Internet Law: Selected Topics), University of Belgrade Faculty of Law, 2017, p. 123

In its centuries-long struggle to gain a more prominent place in regulatory hierarchies, privacy has had to be balanced against other rights, such as freedom of expression and of the press, and against security and other state and public interests.

Privacy in the form we know it today was incorporated into modern legislation and became a constitutional category only in the 19th century. However, the most important international instrument that firmly placed the right to privacy among fundamental human rights is undoubtedly the European Convention on Human Rights and its Article 8:

Everyone has the right to respect for his private and family life, his home and his correspondence.

In paragraph 2 of the same Article, the Convention already limits this right, taking into account the public interest and the interests of others:

There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

Furthermore, in Article 10 the Convention proclaims freedom of expression and places it in direct relation to the right to private life:

Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises.

The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.

Although Article 8 was established by the Convention back in 1950, the European Court of Human Rights in Strasbourg later extended its effect through its case law to the internet and other electronic communications, and to the monitoring, collection and processing of personal data concerning a person’s physical and psychological integrity, such as health, name, origin, preferences, location tracking and the IP addresses of devices used to access the internet. In the well-known judgment in Von Hannover v. Germany, No. 59320/00, of 24 June 2004, the Court found a violation of the right to respect for private life on account of the publication of photographs relating to the applicant’s private life that did not contribute to a debate of general interest.[2]

[2] Ibid., p. 127

However, the effect of paragraph 1 of Article 8 is not unlimited. In paragraph 2 of the same Article, the Council of Europe provided for limitations, such as the interests of security or the protection of health, but only to a justified extent and in accordance with the principles of suitability, necessity and proportionality. The principle of proportionality requires weighing the importance of the public interest being protected against the value of the good that the restriction affects.

The level of privacy protection in national legal systems varies considerably, depending on the legal tradition and the particular development of each country’s law.

The French Civil Code (Code civil) expressly guarantees the right to respect for private life in its Article 9, making it one of the earlier examples of explicit legal protection of this right in European law. Although intrusion into private life in the 19th century was far less pronounced than it is today, French law already then penalised the unauthorised publication or dissemination of information about a person’s private life, as confirmed by a line of court decisions over time.

The United States, on the other hand, has no express protection of privacy in its Constitution. Instead, privacy is protected implicitly, through the interpretation of certain amendments. The most important of these is the Fourth Amendment, which protects citizens against unreasonable searches and seizures by public authorities, one of the key dimensions of privacy protection, in particular the protection of private space from intrusion by the state. The US Supreme Court has also developed, through its case law, the doctrine of a “right to privacy” as a right implicitly derived from several constitutional provisions, notably the Fourteenth Amendment (due process clause) and the First Amendment, which protects freedom of expression and freedom of assembly. The concept of a right to privacy in the United States was first systematically developed in the famous article by Samuel Warren and Louis Brandeis, “The Right to Privacy”, published in 1890, which described privacy as the “right to be let alone” and opened an important legal debate on privacy as a distinct civil right.

In continental Europe, countries such as Italy and Germany clearly recognise and regulate the right to privacy in detail in their national law. For example, Article 2 of the German Basic Law (Grundgesetz) guarantees the free development of personality, from which the protection of privacy as a fundamental right of citizens derives. The Italian Civil Code and the Italian Constitution also provide broad protection of privacy, further confirmed by numerous court decisions, particularly in relation to the protection of personal data and personal integrity.

The United Kingdom, unlike most continental European countries, has no single written constitution and no expressly established general right to privacy in its national legislation. Instead, it relies primarily on the European Convention on Human Rights (ECHR), whose Article 8 protects the individual’s right to respect for private and family life, home and correspondence. This provision was given effect in the British legal system by the Human Rights Act 1998, which made the Convention directly applicable in UK legal practice.

Thus, despite significant differences in approach and regulation, most developed countries today recognise the importance of the right to privacy and its central place in the protection of human rights and freedoms.

The internet has brought new ways of violating a person’s privacy, with far more damaging and far-reaching consequences for the injured party. Through the personal data that can be collected in this way, it is possible to reach the deepest spheres of personality, and a person’s integrity can be irreparably harmed in the most serious ways.

One of the typical ways of violating the right to personal data protection and privacy on the internet is the unauthorised monitoring, storage and processing of information about the activities of internet users. The most dangerous type of data, revealing a person in the most private sense, is the so-called metadata, discussed further below, which is information about the communications themselves. Such data represents a high-risk category of information for a person’s privacy, because today’s software systems use algorithms to easily link and cross-reference the data obtained and, on that basis, generate a very precise and detailed picture of the contacts, interests and other preferences of the persons to whom the metadata relates.[3]

[3] Ibid., p. 128

For this reason, after several earlier recommendations and guidelines on the protection of privacy, the European Union adopted the Data Protection Directive 95/46/EC of 24 October 1995, which for the first time regulated this area in detail and in binding form. It had two aims: to secure the right to respect for privacy as one of the fundamental human rights, and to ensure the free and secure flow of personal data between EU Member States.

The Directive required Member States to adopt their own laws and to incorporate its rules into them, since directives, unlike regulations, must be transposed into the national law of the Member States.[4]

[4] Ibid., p. 132

In addition to the data subject, defined as any person whose identity is known or can be determined, directly or indirectly, on the basis of some data, the Directive for the first time required the establishment of supervisory authorities in the form of public supervisory bodies.

The basic rights guaranteed to individuals by the Directive were:

the right to information,
the right of access to the data collected, and
the right to object.

Adoption of the GDPR

Although Directive 95/46/EC was a pioneering step in the regulation of personal data protection, it soon proved insufficient in the face of the new challenges of the digital age. The exponential growth of the internet, social networks, digital platforms, artificial intelligence and algorithms processing vast amounts of data created the need for a stricter, more detailed and more uniform regulation. The European Union’s response to these challenges was the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), which entered into force on 24 May 2016 and has applied since 25 May 2018.

The GDPR introduced significant changes compared to the Directive, above all its direct application throughout all EU Member States without the need for implementation in national legislation, which harmonised the legal framework across the European Union.

In addition to the rights already mentioned, the GDPR clearly defined “consent” as a freely given, specific, informed and unambiguous indication of the individual’s wishes. The Regulation also set high standards for personal data breach notification and made the appointment of a Data Protection Officer (DPO) mandatory in certain cases, in particular for public authorities and for controllers whose core activities consist of regular and systematic monitoring of data subjects on a large scale or of large-scale processing of special categories of data.

One of the reasons why the GDPR attracted so much attention is the severe fines for infringements, which can reach EUR 20 million or 4% of a company’s total worldwide annual turnover, whichever is higher. This approach clearly shows the European Union’s intention to counter the misuse of personal data seriously and effectively, protecting citizens in an environment increasingly exposed to the threats of the digital age.

With the rapid development of the internet and high technology, Directive 95/46/EC soon revealed certain shortcomings, particularly with regard to transfers of data between EU Member States and third countries. Transfers of personal data outside the EU were permitted only under certain clearly defined conditions. It was precisely cross-border transfers to third countries, especially those whose privacy standards were considerably lower than or different from European ones, such as the United States, that posed one of the key challenges for the protection of the rights of EU citizens.

In 2000, the European Commission adopted a decision that for the first time allowed transfers of personal data to the United States under the arrangement known as “Safe Harbor”. In 2015, however, this decision was declared invalid by the Court of Justice of the EU in the well-known “Schrems I” case (C-362/14), due to the insufficient level of protection of EU citizens’ personal data, particularly in view of US laws enabling mass surveillance of data by intelligence agencies (such as the NSA).

In response, the European Commission and the United States agreed in 2016 on a new arrangement called the “Privacy Shield“, intended to ensure a higher level of protection for data transferred to the US. However, in July 2020, the Court of Justice of the EU delivered its judgment in “Schrems II” (C-311/18), declaring the Privacy Shield invalid as well, owing to continuing concerns about access by US intelligence services to the personal data of EU citizens.

After this judgment, the European Commission continued intensive negotiations with the United States on a new framework for data transfers, which resulted in the adoption of the “EU-U.S. Data Privacy Framework” in July 2023. The new framework aims to establish stronger safeguards and legal mechanisms for protecting the privacy of EU citizens when their data is transferred to the United States.

Unlike the earlier EU-US arrangements, the new framework, which, like the Privacy Shield, applies to transfers of data to US organisations that have self-certified under it, introduces binding limits on access to such data by US intelligence services and a dedicated redress mechanism for EU citizens. Its focus is on regulating the security and intelligence aspects of access to EU citizens’ data, which is made subject to the principles of necessity and proportionality, principles with a long history in the EU, both in legislation and in the case law of the European Court of Human Rights and the Court of Justice of the EU.

2. Personal Data and Special Categories of Personal Data

One of the most important tasks in raising public awareness of personal data protection is understanding the concept of “personal data”, that is, being able to recognise a particular piece of information as personal data. This understanding is essential so that individuals can exercise their rights and controllers and processors can handle such data appropriately and as required by law.

In this regard, besides obvious personal data such as a person’s name and surname, personal identification number or ID document number, data that at first sight do not lead directly to the identity of an individual, but are nonetheless linked to that person and therefore also qualify as personal data, are often overlooked.

Personal data can be described as any data relating to a natural person who is identified or identifiable. In the age of modern technologies and means of communication, the word “identifiable” should be taken seriously, because modern algorithms make it very easy, by cross-referencing certain data, to discover a person’s identity or obtain data that can identify a particular individual with a high degree of certainty.

As the Regulation provides, an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number (in Serbia, the JMBG), location data, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. The GDPR places the emphasis on identifiability, because with today’s technology and computer algorithms a small amount of data is enough to profile a person or even identify them.

It follows that many other data which indirectly lead to, or make up, the identity of a natural person are also personal data. For example, an IP address, search engine history, the location of a mobile phone, as well as salary or the dates of annual leave, are all data linked to a person and as such are protected under the LPDP.

A narrower group within data relating to natural persons are the special categories of data which, because of their sensitivity and the potential risk that their disclosure and misuse carry, deserve a special regulatory regime. In the data mapping process, it is therefore very important to establish whether the controller collects or processes any data from the sensitive categories. In any event, such processing should be kept to a minimum, that is, limited to what is necessary to achieve a lawful purpose.

Within personal data, the LPDP thus singles out the so-called special categories, that is, data whose processing carries greater risk for the individual than ordinary personal data. Special categories include data on health, political and religious affiliation, sexual orientation and the like. The LPDP regulates the processing of such data separately and permits it only where exhaustively listed conditions are met, and particular attention must be paid to the security of sensitive data during processing.

The GDPR does not apply to legal persons, and its recitals also exclude its application to deceased persons. This is one of the differences between the GDPR and the Serbian LPDP. Since our law did not adopt the solutions from the recitals, it remains unclear from the letter of the law whether it applies to deceased persons. Adding to the confusion, the previous Serbian Law on Personal Data Protection of 2008 expressly provided that its provisions also applied to the privacy of persons who are no longer alive.

Special categories of personal data include:

Racial or ethnic origin
Political opinions
Religious or philosophical beliefs
Trade union membership
Genetic data
Biometric data for the purpose of uniquely identifying a natural person
Health
Sex life
Sexual orientation

The processing of these categories of data is prohibited in principle, with exceptions where one of the following conditions is met, provided that there is also a legal basis for processing under Article 12 of the LPDP:

The data subject has given explicit, freely given and prior consent
Processing is necessary for carrying out the obligations and exercising the rights of the controller or the data subject in the field of employment, social security and social protection law
Processing is necessary to protect the vital interests of the data subject or of another natural person, where the data subject is physically or legally incapable of giving consent
Processing is carried out by a foundation, association or other non-profit body and relates solely to its members
Processing relates to personal data which are manifestly made public by the data subject
Processing is necessary for the establishment, exercise or defence of legal claims before a court
Processing is necessary for reasons of substantial public interest laid down by law, with appropriate and specific safeguards
Processing is necessary for the purposes of public health, preventive or occupational medicine, medical diagnosis, or the provision of health or social care, where it is carried out by or under the supervision of a health professional or another person subject to an obligation of professional secrecy
Archiving in the public interest, scientific or historical research purposes or statistical purposes

Metadata as Personal Data

Alongside the concept of “personal data”, so-called metadata should also be mentioned. Metadata, or data about data, is highly relevant in today’s digital age and can reveal a great deal about the person it relates to, seriously compromising their identity and privacy. The LPDP does not treat metadata separately from ordinary categories of data, but depending on the purpose and manner of processing, metadata may in practice require specific treatment, especially when it is used for some form of automated processing for profiling. In any case, in line with the principle of transparency, the person to whom metadata relates must be informed in advance that such data is processed, with a list of all metadata concerned, a description of the purpose, the retention period and other relevant facts about the processing, in accordance with the LPDP.

Traditional monitoring and surveillance methods often require resources that make them uneconomical, which directly limits the possibility of mass monitoring, collection and processing of data. On the one hand there are the costs of gathering information (recording, wiretapping, questioning), and on the other the costs of having it processed by staff. Moreover, data processed in this way, involving the human factor, is more prone to error, which makes it unreliable.

The ability to collect metadata and process it automatically therefore represents a revolutionary change in the whole concept of monitoring the activities of individuals.

Today’s largest companies, such as Google, Facebook and others, base their business model precisely on collecting and using their users’ metadata. The same applies to many other platforms for free messaging, blogging, and sharing images and videos. Although seemingly free, these services are in fact paid for with private data.

Metadata was traditionally used in library card catalogues until the 1980s, when libraries converted their catalogue data into digital databases. During the 1990s, as digital formats became the main way of storing data and information, metadata also came to be used to describe digital data according to appropriate standards.

The first description of “metadata” for computer systems was given by David Griffel and Stuart McIntosh, experts at the MIT Center for International Studies, in 1967, who defined it as statements in an object language about data descriptions, describing the relationships between data and their transformations.

There are different metadata standards for different disciplines (e.g. museum collections, digital audio files, websites). Describing the content and context of data or data files increases their usefulness. For example, a web page may include metadata specifying the language in which the page is written (e.g. HTML), the tools used to create it, the topics it covers and where more information on the subject can be found. Such metadata can automatically improve the reader’s experience and make it easier for users to find the web page online.

Metadata also tells us the date of creation of data, its purpose, meaning, author or creator, the location of the computer on which it was created, the standards used, file size, quality, the source of the data, and the processes and methods used to produce it.

Although metadata is protected by law and private companies may not collect it without an appropriate legal basis, the problem lies in the fact that users themselves are not sufficiently informed about their rights and the consequences of their actions, and readily accept privacy terms that are often incomprehensible, too long and deliberately placed so as not to be read before consent is given. The new rules have imposed a number of obligations on controllers to inform users better, in clear and plain language, in a separate section provided for that purpose.

Other major processors of metadata are state authorities, that is, public security services, which the law allows to collect and process data without the consent of individuals, but on the basis of law and with respect for predetermined purposes. The legal basis for such processing is the law, not the consent of the individual, and public authorities cannot rely on legitimate interest in the performance of their tasks. The Constitution of Serbia guarantees the confidentiality of letters and other means of communication in Article 41, while Article 42 protects citizens’ data against misuse, which is further defined and regulated in detail by law.

The interest of national security often prevails in practice and in public opinion, both in the US and in Western European countries, many of which themselves take part in developing surveillance and the mass collection of communications metadata. Faced with terrorist attacks on their territory, citizens readily give up part of their rights and freedoms, treating privacy as something they will gladly surrender out of fear of the violence and attacks recorded across Europe and the world. On the other hand, for many users, especially among younger generations, Instagram, Facebook and similar platforms have already rendered old ideas of privacy meaningless, and among young people data protection rules are seen as conservative measures that get in the way of modern everyday life.

In short, metadata is data that provides information about other data.

There are different types of metadata, among them descriptive, structural, administrative, statistical and reference metadata.

Descriptive metadata describes a resource for purposes such as discovery and identification. It may include elements such as title, abstract, author and keywords.
Structural metadata indicates how data is structured. It describes the types, versions, relationships and other characteristics of digital materials.
Administrative metadata provides information that helps manage resources, such as when and how a file was created, and who may access it.
Statistical metadata may also describe the processes that collect, process or produce data for statistical purposes. It is also called process data.
Reference metadata describes the content and quality of statistical data.

Metadata can be embedded in the original digital photograph file (RAW file), identifying the owner, copyright and contact information, the make and model of the camera that created the file, exposure information (shutter speed, f-stop, etc.) and descriptive information such as keywords, which makes the file or image searchable on a computer or on the internet. Some metadata is created by the camera, and some is added by the photographer or by software after the file is transferred to a computer.

Metadata can be used to make post-production easier to organise by means of keywords.

Standards for photographic metadata are maintained by organisations and include, but are not limited to, the following:

IPTC Information Interchange Model IIM (International Press Telecommunications Council),
IPTC Core Schema for XMP
XMP (Extensible Metadata Platform, an ISO standard)
EXIF (Exchangeable image file format), maintained by CIPA (Camera & Imaging Products Association) and published by JEITA (Japan Electronics and Information Technology Industries Association)
Dublin Core (Dublin Core Metadata Initiative, DCMI)
PLUS (Picture Licensing Universal System)
VRA Core (Visual Resources Association)

3. Principles of Data Protection under the Serbian Law on Personal Data Protection and the GDPR

Principle of Lawfulness (Lawfulness, Fairness and Transparency)

The first and most important principle of data protection is the principle of lawfulness, since it determines whether the controller has any basis at all for carrying out a particular processing operation. Processing is lawful if:

the data subject has given CONSENT
processing is necessary for THE PERFORMANCE OF A CONTRACT to which the data subject is party
processing is necessary for compliance with a LEGAL OBLIGATION to which the controller is subject
processing is necessary in order to PROTECT THE VITAL INTERESTS of the data subject or of another natural person
processing is necessary for the performance of a task carried out in the public interest or in THE EXERCISE OF OFFICIAL AUTHORITY vested in the controller
processing is necessary for the purposes of THE LEGITIMATE INTERESTS pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child

Principle of Transparency (Lawfulness, Fairness and Transparency)

The controller must act lawfully, fairly and transparently towards the person whose data is used, which means that the person must be informed of their data protection rights in a clear and unambiguous way, in simple language they can understand. This principle protects individuals from hidden rules, the so-called small print, and from complex technical legal constructions that most people cannot properly understand or have no interest in analysing, and which may even be drafted deliberately to be unclear. This is why the legislator insists on transparency, plain language and the easy visibility of important information. For the same reason, the law requires that a request for consent be clearly distinguishable from other matters and clearly identified as consent.

Principle of Purpose Limitation

Data is collected for specified, explicit, legitimate and lawful purposes and may not be further processed in a manner incompatible with those purposes, except under conditions laid down by law. Data may be used only to the extent necessary to fulfil a specific purpose of processing known in advance. It is therefore recommended to collect and process only the data the controller genuinely needs, and to review from time to time the types of personal data held and assess whether the need to process them still exists, that is, whether the processing purpose still needs to be fulfilled.

Where processing is based on consent, a change of purpose requires new consent, except in cases provided for by the Regulation. Further processing for another purpose without the person’s consent is permitted only under conditions exhaustively set out in the Law. In assessing this, account should be taken of the link between the purpose for which the data was collected and the purpose of the intended further processing, the circumstances in which the data was collected, the relationship between the controller and the data subject, the nature of the data (whether and to what extent it is sensitive), and the possible consequences of further processing for the data subject. Appropriate safeguards must, of course, also be applied.

Principle of Accuracy

Data must be accurate, and the person concerned should be able to point out inaccuracies free of charge and request that such data be updated or erased. For example, if a person points out that some of their personal data is inaccurate, the controller is obliged to update it, failing which it will be in breach of the law.

Principle of Data Minimisation

Data may be used only to the extent necessary to fulfil the purpose of processing, that is, the smallest possible scope of processing. The starting point for anyone choosing the method of processing and the amount of data to be processed must therefore be: the less, the better. Processing any unnecessary data increases the risk of a data leak and, depending on the nature of the data, may also require entirely different security measures from the controller. For example, a company that collects employees’ fingerprints to record their arrival at work not only uses a method that is unnecessarily invasive of privacy for the purpose pursued, but must also raise its information security system to a significantly higher level, which can be complicated and costly.

Principle of Storage Limitation

Data must be kept for as short a time as possible, that is, no longer than is necessary for the purposes for which it was collected, and the person must be informed of how long their data will be stored.

Principle of Integrity and Confidentiality (Security of Data)

The controller and processor must do everything to ensure appropriate security of the data, including protection against unauthorised or unlawful processing and against accidental loss. The legislator deliberately did not prescribe in detail which level of security is to be applied in which situation, or in relation to which data and processing operations. Encryption and pseudonymisation are indeed recommended, but it is for the controller to choose the level of security on the basis of a risk assessment, and it will be accountable for that choice if it turns out that the data was not sufficiently protected and it was responsible for that.

The controller is also required to demonstrate that its activities comply with all the principles listed above, that is, to prove the lawfulness of its conduct and its legitimate interest in collecting and processing data in a particular way and to a particular extent. Although negative facts are very difficult to prove in practice, for the sake of “higher” interests and the adequate protection of individuals and their privacy, the Law places this burden on the controller.

Principle of Accountability

The controller is responsible for complying with its legal obligations and the principles of processing, and bears the burden of proving such compliance. In other words, it must be able to demonstrate that it applies them.

4. Consent to the Processing of Personal Data

Although the LPDP provides for six different legal bases on which processing may rely, consent is one of those most often referred to in practice. Where processing cannot be based on any other ground under the LPDP, consent may be an appropriate basis, but only if the legal conditions for it are met, above all that it is freely given.

Consent can be defined as any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

Consent must be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of their personal data, such as a written statement (including an electronic statement) or an oral statement. Although the law accepts the oral form as a lawful way of obtaining consent, the possible difficulty of proving it should be borne in mind, which is why this form is not recommended.

Consent may include ticking a box when visiting a website, choosing technical settings for information society services, or another statement or conduct which clearly indicates in that context the data subject’s acceptance of the proposed processing of their personal data.

Consent will not be lawfully obtained if:

the user’s conduct is passive or the user remains silent
the consent box in an electronic form is pre-ticked
there is a clear imbalance between the parties (especially where one party is a public authority)
there is no genuine and free choice
it is impossible to refuse or withdraw consent without detriment

The legislator pays particular attention to the conditions for consent, because the burden of proving that a person has given consent lies with the controller. When consent is sought, the person must be fully informed in a clear and unambiguous manner, in an intelligible and easily accessible form. It is also very important to clearly separate the consent text from other text or information.

A person who has given consent has the right to withdraw it at any time, and withdrawing consent must be as easy as giving it. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Under the GDPR, the processing of the data of a child under 16 in relation to information society services requires parental consent, and Member States may lower this age limit to 13. Under the LPDP, a minor who has reached the age of 15 may give consent independently in relation to information society services, while for younger children consent is given by a parent or other legal guardian.

A specific feature of obtaining parental consent is that, in addition to the burden of proving that consent was obtained, the Regulation requires the controller to make reasonable efforts to verify that consent was actually given by the child’s parent or legal guardian. The LPDP lays down the same obligation.

5. Rights of Data Subjects

In addition to complying with the principles of processing, it is very important for controllers to ensure that the persons whose data they process are informed in a timely and detailed manner about all essential elements of the processing and about the rights the law guarantees them in relation to it.

RIGHT TO INFORMATION

The controller takes appropriate measures to provide the data subject with all information and communications relating to processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child.

The information is provided in writing or by other means, including, where appropriate, by electronic means.

On request, the controller provides the data subject with information on the action taken without undue delay and in any event within 30 days of receipt of the request (one month under the GDPR).

That period may be extended by a further 60 days where necessary (two months under the GDPR), taking into account the complexity and number of requests.

The controller informs the data subject of any such extension within 30 days of receipt of the request, together with the reasons for the delay.

RIGHT OF ACCESS AND TO A COPY

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them is being processed and, where that is the case, the right of access to the personal data and the right to a copy of it.

Where the request for a copy is made by electronic means, the information is provided in a commonly used electronic form, unless the person requests otherwise.

RIGHT TO RECTIFICATION

The data subject has the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning them.

Taking into account the purposes of processing, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement.

RIGHT TO BE FORGOTTEN

The data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay (and the controller must inform the recipients to whom the data has been disclosed of the erasure), where one of the following conditions is met:

the personal data is no longer necessary for the purposes for which it was collected
the data subject has withdrawn consent and there is no other legal ground for the processing
the data subject has objected to the processing and there are no overriding legitimate grounds for the processing, or the objection relates to direct marketing
the personal data has been unlawfully processed
the personal data must be erased for compliance with a legal obligation of the controller
the personal data has been collected in relation to the offer of information society services to a minor (Article 16 LPDP)

The right to be forgotten and to erasure does not apply where processing is necessary:

for exercising the right of freedom of expression and information;
for compliance with a legal obligation of the controller which requires processing, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
for reasons of public interest in the area of public health
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, where erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing
for the establishment, exercise or defence of legal claims

The right to be forgotten is a product of EU case law. Relying on Directive 95/46/EC, a Spanish citizen, Mario Costeja González, asked the Spanish data protection authority (AEPD) to order Google not to display, in its search results, pages containing personal data about him that were no longer relevant. The authority upheld his complaint against Google, and Google challenged that decision before the Spanish National High Court (Audiencia Nacional), which stayed the proceedings and referred a question for a preliminary ruling to the Court of Justice of the EU. The Court’s decision was very important for the protection of personal data on the internet at the time, and it also paved the way for the development of the right to erasure, which indirectly influenced the inclusion of this solution in the GDPR. Although the original reach of the right to be forgotten was considerably narrower and concerned only the removal of pages from search engine results, compared with its much broader effect today, the legacy of this judgment for our right to privacy is immeasurable.

RIGHT TO RESTRICTION OF PROCESSING

The data subject has the right to obtain from the controller restriction of processing where one of the following applies:

the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify its accuracy
the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead
the controller no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise or defence of legal claims, or whenever courts are acting in their judicial capacity;
the data subject has objected to processing, pending verification of whether the legitimate grounds of the controller override those of the data subject

The data subject also has the right to rectification of data already collected and the right to be forgotten, that is, to have the data erased under certain conditions.

RIGHT TO DATA PORTABILITY

The data subject has the right to transmit the data (directly) to another controller without hindrance from the controller to which the personal data has been provided, where both of the following conditions are met:

the processing is based on consent or on a contract
the processing is carried out by automated means

RIGHT TO OBJECT

The data subject has the right to object at any time where data is processed on the basis of legitimate interest or for the performance of a task carried out in the public interest, including profiling. Where processing is based on consent, the person may withdraw it.

The controller must stop processing unless it demonstrates that there are legitimate grounds for the processing which override the interests, rights or freedoms of the person.

Where the objection concerns the use of data for direct marketing, the data may no longer be used for that purpose.

Irrespective of the right to lodge a complaint with the Commissioner, the data subject may in any event bring court proceedings for compensation of damage.

6. The Commissioner as the Supervisory Authority

Through a supervisory authority vested with public powers, the legislator has provided stronger protection of data, with the aim of better control over its processing and transfer. In the Republic of Serbia, the role of the supervisory authority is performed by the Commissioner for Information of Public Importance and Personal Data Protection.

Among other things, controllers are required to notify the Commissioner of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, while a processor must notify the controller of a breach without undue delay. The controller’s conduct before the Commissioner, and its attitude towards its obligations to the Commissioner, will be taken into account, among other things, when determining the amount of any fine that may be imposed on it in misdemeanour proceedings.

Data Protection Lawyer in Serbia

Information about people and their characteristics, whether it leads directly or indirectly to a person’s identity, is recorded, processed and transferred almost constantly, so the legal and technical protection of such data has become one of the key issues of modern society. A growing number of organisations recognise their duty to handle the data of their clients, users, employees and business partners responsibly, both for the sake of real protection and because they must observe strict legal requirements. Compliance with personal data protection rules is a deep and layered process that calls for a serious, comprehensive, analytical and strategic approach. This is where the role of a lawyer specialised in this field begins: from setting up the initial methodology, through data mapping, to drafting the final documentation, the lawyer follows the processing and points out any irregularities along the way.

Serbian data protection law does not apply only to companies established in Serbia. Under Article 3 of the LPDP, it also applies to controllers and processors established abroad when they offer goods or services to individuals in Serbia or monitor their behaviour in Serbia. In such cases, a foreign company is, as a rule, required to appoint a representative in Serbia in writing (Article 44 LPDP). We advise both domestic and foreign companies on compliance with the LPDP and the GDPR.

What Sets a Data Protection Lawyer Apart

A lawyer working in personal data protection must be a legal expert, but also someone who understands the wider context of the digital environment. Besides a thorough knowledge of Serbian legislation, such as the Law on Personal Data Protection, a good understanding of European standards is expected, in particular the General Data Protection Regulation (GDPR), as well as familiarity with relevant case law and regulatory guidance.

What makes this field specific is that it brings together different disciplines: law, information security, risk management, IT processes and business ethics. A successful legal adviser in this area must recognise where the rules are not sufficiently clear, how to apply them in a specific context, and how to enable an organisation to handle data lawfully and responsibly without compromising its efficiency.

How a Data Protection Lawyer Helps in Practice

In practice, a data protection lawyer performs a range of tasks:

analysing and organising internal procedures relating to the collection and processing of data;
drafting documents such as privacy policies, data processing agreements and consent forms;
taking part in risk assessment and risk management when new technologies are introduced;
advising on how to respond to personal data breaches;
assisting in communication with the Commissioner and taking part in inspection proceedings and proceedings for the protection of rights.

Legal support also includes staff-related measures, including regular employee training, since the human factor is often the most vulnerable point of any system.

Lawyer as Data Protection Officer (DPO)

In certain cases, the law requires organisations to appoint a person responsible for personal data protection (known as the Data Protection Officer, DPO). A lawyer working in this field can take on this role as an external adviser, giving the organisation an independent and expert adviser who monitors compliance with the rules and at the same time builds a bridge between the legal framework, technical teams and management.

The Importance of Legal Support in Data Protection

Sound and thorough advice from a lawyer specialised in data protection enables organisations to significantly reduce their legal risks, bring them down to an acceptable level, or even eliminate them entirely. The high fines provided for under the GDPR, which can seriously threaten a company’s financial stability, business reputation and long-term sustainability, should be borne in mind in particular. The fines prescribed by the Serbian LPDP are not negligible either. There is also reputational risk. For this reason, engaging an expert in good time can be a key step in avoiding or mitigating the consequences of any irregularities in data processing.

Legal support from a competent expert in this field also makes it possible to identify, in good time, opportunities to improve business processes in line with applicable regulations, ensuring transparency towards users and earning and maintaining their trust.

Contrary to common prejudice and stereotypes, the role of a good lawyer specialised in data protection is by no means to restrict a company’s activities unnecessarily or slow down its development. The lawyer’s task is to point out, clearly and concretely, the permitted legal framework and thereby enable maximum business efficiency and growth, while ensuring that personal data is processed lawfully and transparently to the greatest possible extent. This creates the conditions for successful business that respects the rights of individuals, which has become an indispensable standard of good business practice in modern society.

If you need legal support in applying data protection rules in Serbia, see our service LPDP and GDPR compliance.

This text is strictly informal and informative in nature and should not be construed as legal advice. It reflects the state of legislation and practice on the date of publication, and the application of the rules described depends on the circumstances of each individual case.