{"id":2040,"date":"2019-01-31T15:57:57","date_gmt":"2019-01-31T15:57:57","guid":{"rendered":"https:\/\/milic.rs\/eng\/novisajt\/?page_id=444"},"modified":"2026-10-22T07:33:39","modified_gmt":"2026-10-22T07:33:39","slug":"internet-law","status":"publish","type":"page","link":"https:\/\/www.milic.rs\/eng\/internet-law\/","title":{"rendered":"Internet Law in Serbia"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\n

AREAS AND DEFINITION OF THE INTERNET LAW<\/h2>\n

Internet law is one of the youngest branches of law. It emerged from the need to expand the existing regulatory framework and create a new one that would regulate the internet and provide the necessary legal certainty and security for its users.<\/p>\n

Internet law, or cyber law, largely overlaps with Information and Communication Technology Law<\/a>, and the two areas complement each other.<\/p>\n

Unlike the broader scope of IT law, internet law relates to the internet itself, the regulation of internet governance at all levels, the management of internet domain names and IP addresses, and similar matters.<\/p>\n

In a broader sense, internet law (or cyber law, as it is also called) covers those parts of the legal system and those areas of law that are connected with the internet, and it provides protection to internet users.<\/p>\n\n

INTERNET GOVERNANCE<\/h3>\n

Although the internet is often described as free by its nature and as belonging to everyone, this complex system does not run by itself, nor is it so perfect that its organisation is automated. Internet governance therefore represents a complex structure of bodies and processes which, to a certain extent, shape the regulation and policies concerning the internet.[1]<\/sup><\/p>\n

Like the internet itself, the system of its functioning is layered. The \"lower layer\" is the infrastructural, material and tangible part of the internet, made up of, among other things, networked computer devices. The \"upper layer\" is what we all see on the internet, that is, the content displayed there. The \"middle layer\" is particularly important for internet law. It consists of the system of IP addresses and internet domain names, including the internet access services provided by internet service providers.[2]<\/sup><\/p>\n

Governance within the \"middle layer\" is also complex and hierarchical. Top-level domains are managed by internet domain registries, which receive administrative and technical authority to manage those domains from the organisation responsible for coordinating the global structure of the internet, protocol numbering and the root DNS servers, the Internet Corporation for Assigned Names and Numbers (ICANN).[3]<\/sup><\/p>\n

Understanding this governance structure, as well as the informational and legal nature of internet domain names, is the starting point for questions of liability and identification of registrants of internet domain names<\/a>.<\/p>\n

[1] Dragan Mili\u0107, Dejan \u0110uki\u0107, Pitanje utvr\u0111ivanja identiteta registranta naziva internet domena u svetlu va\u017ee\u0107ih propisa o za\u0161titi podataka o li\u010dnosti, Zbornik radova 35. Susreta Kopaoni\u010dke \u0161kole prirodnog prava, Slobodan Perovi\u0107, Beograd 2022, p. 215
[2] Du\u0161an Popovi\u0107, Marko Jovanovi\u0107, Pravo i internet, odabrane teme, Pravni fakultet Univerziteta u Beogradu, 2017, 11.
[3] The organisation's website is available at: https:\/\/www.icann.org\/<\/p>\n\n

INTERNET SECURITY AND CRIMINAL OFFENSES<\/h3>\n

Given the sensitive relationship between internet service providers and users, the right to privacy, the collection of personal data (including trading in and misuse of such data), and the protection of payment card and bank account data are among the biggest problems faced by internet users today. Companies that collect such data are therefore expected to do everything they can to prevent hacker attacks and other illegal activities. The other side of the coin is the lawful activity of providers, social networks and platforms that collect personal data and, with users' formal consent, use it to generate profit and increase the value of their companies. Monitoring of users' activities by governments and state institutions is a separate problem, which threatens both internet neutrality in general and the privacy and personal interests of individual users.<\/p>\n

Internet security, the protection of intellectual property and copyright online, and the ease with which these rights can be infringed in the online sphere are also widespread problems. There is no complete protection against them, but legislation seeks to establish the highest possible degree of legal certainty and unhindered use of the internet.<\/p>\n

One of the important areas covered by internet law is the criminal law protection of legal entities and natural persons who use the network for private or business purposes.<\/p>\n

In addition to its repressive effect, achieved by prescribing the type and severity of sanctions for certain offences, internet law also deals with studying the weaknesses of the network and improving it, which significantly contributes to the prevention of criminal offences in cyberspace.<\/p>\n

In almost every developed country, special, well trained and equipped units have been set up within the police and the prosecution service to deal with these cases.<\/p>\n

Although it is up to the state authorities to protect internet users, much can be prevented by informing citizens and company employees about all the important aspects of protection and preventive conduct.<\/p>\n

It is therefore important to stay informed, because technology develops rapidly and those who use it to commit criminal offences improve and upgrade their methods just as quickly. These types of offences have the highest growth rate in the world. The global network enables cross-border activity, so these problems are no longer only a matter for national legislation, but a problem for the whole world, which must be addressed in a coordinated and joint manner.<\/p>\n\n

SPECIAL PART OF THE CRIMINAL LAW OF THE REPUBLIC OF SERBIA IN CONNECTION WITH OFFENSES COMMITTED AGAINST DIGITAL DATA AND ON THE INTERNET<\/h4>\n

The current Criminal Code of the Republic of Serbia regulates offences committed on the internet or in connection with high technologies in the chapter entitled \"Criminal Offences against the Security of Computer Data\".<\/p>\n

This chapter provides for the offence of Damaging Computer Data and Programs, for which, depending on the amount of damage caused, a prison sentence of up to 5 years may be imposed.<\/p>\n

The same maximum penalty is prescribed for entering, destroying, deleting, altering, damaging or concealing a computer program or computer data, or destroying or damaging a computer or other equipment for electronic data processing, thereby preventing or substantially hindering data processing that is of importance for state authorities or other institutions (the offence of computer sabotage).<\/p>\n

For creating and introducing computer viruses into another person's computer or computer network, the penalty may be up to 2 years in prison, depending on whether damage was caused.<\/p>\n

Under the Criminal Code, the traditional offence of fraud also has a special form when committed online or in connection with computer data. For the aggravated form of computer fraud, where the unlawful material gain obtained exceeds RSD 1,500,000, a prison sentence of two to ten years is prescribed.<\/p>\n

For unauthorised access to a protected computer, computer network or electronic data processing, a fine or imprisonment of up to six months is prescribed. If the data obtained in this way is used, the penalty may reach 2 years in prison, and if serious consequences occur, 3 years.<\/p>\n

The law also prohibits preventing or restricting access to a public computer network, as well as unauthorised use of another person's computer or computer network.<\/p>\n\n

INTERNET LAW AND INTELLECTUAL PROPERTY<\/h3>\n

Although intellectual property law<\/a> is a separate branch of law, with the advent of the internet it has faced many challenges, and a specific approach has become necessary to protect subjective rights in intellectual creations online. Copyright, as the most important and most widespread segment of intellectual property, suffers the greatest damage from new technologies. Today, trademarks designate not only traditional goods and services but also products and services offered online, as well as a wide variety of website platforms.<\/p>\n

One of the common causes of domain disputes is the registration of an internet domain name that is identical or similar to another person's trademark, especially where the registrant has no right or legitimate interest in using it. The protection of trademarks in relation to internet domain names and the procedure for transferring such domains lie at the intersection of intellectual property law and internet law. The practice of buying cheap internet domains for resale has led to a wider application of these rules in practice, in Serbia as well. This type of abuse of domain names is called \"cybersquatting\".<\/p>\n

Other well-known unlawful practices involving internet domains are \"typosquatting\" (registration of an internet domain name that differs from a well-known name by a typing error, in order to exploit users' mistakes when typing an address and mislead visitors into believing they are at the right address) and \"pagejacking\" (copying part of an original website and placing it on another, fake website so that it looks like the original, usually with a changed bank account number and payment instructions). Internet fraudsters use this method for so-called \"phishing\".<\/p>\n

For this reason, ICANN adopted the Uniform Domain Name Dispute Resolution Policy (UDRP) as a faster and more efficient alternative mechanism for resolving certain domain disputes, while preserving the possibility of court protection. As regards the .rs and .\u0441\u0440\u0431 internet domains, the Commission for Resolving Disputes Relating to the Registration of National Internet Domain Names operates at the Chamber of Commerce and Industry of Serbia and decides under the Rulebook on the Procedure for Resolving Disputes Relating to the Registration of National Internet Domain Names (Official Gazette of the Republic of Serbia No. 30\/2026).<\/p>\n

It should also be noted that a computer program is a copyright work within the meaning of the Serbian Law on Copyright and Related Rights. The author of a computer program therefore enjoys copyright protection and all the economic and moral rights that the Law grants to authors. A specific feature of a computer program as a copyright work is that its author, in addition to the right to authorise or prohibit the reproduction of the work, has that right also in respect of a computer program created by modifying, adapting or otherwise transforming the author's program, that is, a program created on the basis of the original one. There is also an important exception to this right: the author cannot prohibit a person who has lawfully obtained the program from reproducing it where this is necessary, for example, to use the program in accordance with its intended purpose, to correct errors, or to achieve interoperability of an independently created program with other programs through decompilation, under the special conditions prescribed by the Law.<\/p>\n

In addition, if an author creates a computer program in the course of employment, while performing their work duties, the employer is the permanent holder of all exclusive economic rights in that program. This does not have to be the case if the employment contract expressly provides that the economic rights belong to the employee, that is, the author. The author is entitled to special remuneration for a computer program created in the course of employment only if such remuneration has been specifically agreed.<\/p>\n

Read more about Intellectual Property<\/a>.<\/p>\n\n

CONTRACTS ON THE \"CYBER SPACE\" AND INTERNET<\/h3>\n

Although most internet users believe that contract law does not apply online, this is a misconception. Almost every exchange of information or purchase of goods or services on any serious internet platform requires prior acceptance of the terms of use. This is nothing other than accepting an offer to conclude a standard form contract. This is particularly important for online shops, that is, for e-commerce business<\/a>, where goods are sold or services provided over the internet. For a legal relationship to arise between the seller or service provider and the buyer or user, they must conclude a contract in electronic form by electronic means, and the validity of such a contract cannot be challenged solely because it was made in electronic form. This type of business and this type of contract are regulated by the Serbian Law on Electronic Commerce, which prescribes information obligations before the conclusion of the contract, as well as the manner and moment of its conclusion. Among other things, the Law provides that the service provider must, without delay, by a separate electronic message, confirm receipt of an electronic message containing the buyer's or user's offer, or the acceptance of an offer to conclude a contract if the provider made the offer to the other party. This obligation does not apply to contracts concluded by e-mail or other forms of individual electronic communication, and contracting parties that are not consumers may expressly agree to depart from it. As regards the moment of conclusion, a contract in electronic form is concluded at the moment the offeror receives the electronic message containing the offeree's statement of acceptance.<\/p>\n

With the development of technology, there is a growing need to implement contracts in the computer code itself, but this is the area of smart contracts, which falls under IT law<\/a>.<\/p>\n\n

PERSONAL DATA PROTECTION, RIGHT TO PRIVACY AND GDPR AS PART OF INTERNET LAW<\/h3>\n

The regulation and control of personal data collected by entities acting as controllers or processors is, and will increasingly be, a major problem for individuals and for society as a whole. Personal data<\/a> has become a product and is traded, so far mostly for marketing, personalisation of offers and artificial intelligence.<\/p>\n

Although almost all countries limit the retention period of such information by law, it can never be established with certainty where and for how long it is stored. This problem therefore has to be approached systematically, through the active involvement of communities of states and high-level institutions, because it is very difficult for individuals to exercise on their own the rights guaranteed to them by law to a greater or lesser extent.<\/p>\n

Not all legal systems provide the same level of protection or take the same approach to privacy. Approaches range from treating it as a subjective right whose exercise is a personal matter for the individual, to elevating personal data and the right to its protection to the level of fundamental human rights, as is the case in Europe. This started with the European Convention on Human Rights of 1950 (Council of Europe), and today the protection of personal data in the European Union is specifically regulated by the General Data Protection Regulation<\/a> (GDPR), which radically changed the approach to the collection and processing of personal data within the EU, and also beyond its borders to the extent and in the manner provided for by the Regulation.<\/p>\n

Serbian legislation has followed the same path by adopting the Law on Personal Data Protection, which has applied since August 2019 and was drafted on the model of the GDPR. Serbian legislation thus keeps pace with European regulation, aiming at harmonising the mechanisms for protecting personal data, as a particularly sensitive and important category of data that represents the private, personal sphere of every individual.<\/p>\n

Since the matter regulated by the Serbian Law on Personal Data Protection is quite complex and difficult for many to understand, especially for controllers and processors who must comply with their obligations under the Law, they may engage a Data Protection Officer (DPO)<\/a> with special expertise and experience in personal data protection. The DPO informs and advises the controller or processor and their employees about their data protection obligations, monitors compliance with the Law and other regulations and internal acts in this field, cooperates with the Commissioner for Information of Public Importance and Personal Data Protection, and generally takes part in raising awareness and training of employees involved in processing operations. The DPO also performs other tasks and assists the controller and processor in protecting personal data. The DPO may be designated from among the employees of the controller or processor, on the basis of professional qualities, in particular expert knowledge and experience in personal data protection, or may be a third party engaged by the controller or processor under a separate contract. It is important to note that the Law also specifies cases in which controllers and processors are obliged to designate a DPO.<\/p>\n\n

Read more about Personal Data Protection<\/a> and GDPR<\/a>.<\/p>\n\n

REGISTRATION OF INTERNET DOMAIN NAMES<\/h3>\n

Registration of internet domain names<\/a> is a type of service and is carried out on the basis of a contract that the registrant concludes with a registrar or a registry, depending on the applicable model. For clarity, a registry is the organisation that manages a top-level internet domain and enters registered domain names, usually through registrars, which offer the service to end users. In practice there are cases, although rare, where registration is made directly with the registry. Contracts on domain name registration usually state that the registrant acquires the right to use the registered domain name in the manner agreed. Registries may phrase this legal relationship differently, but the general terms of registration of internet domain names as a rule regulate the right to use the registered domain name for a certain period, and not the acquisition of ownership of it.[4]<\/sup> This is therefore a specific user relationship under which the registrant acquires the right to use the internet domain name for a certain period, in practice most often from one to ten years.[5]<\/sup><\/p>\n

[4] Du\u0161an Popovi\u0107, Marko Jovanovi\u0107, Pravo i internet, odabrane teme, Pravni fakultet Univerziteta u Beogradu, 2017, 11.
[5] Dragan Mili\u0107, Dejan \u0110uki\u0107, Pitanje utvr\u0111ivanja identiteta registranta naziva internet domena u svetlu va\u017ee\u0107ih propisa o za\u0161titi podataka o li\u010dnosti, Zbornik radova 35. Susreta Kopaoni\u010dke \u0161kole prirodnog prava, Slobodan Perovi\u0107, Beograd 2022, p. 215<\/p>\n

Read more about internet domain names<\/a>.<\/p>\n

Read more about IT\/ICT law<\/a>.<\/p>\n\n

RESPONSIBILITY OF ONLINE PLATFORMS FOR THE EXCHANGE OF CONTENT AND ACTIVITIES OF USERS ON THE INTERNET<\/h3>\n

The interest of technology companies that control social networks is certainly to assume as little responsibility as possible for the content their users publish and, if possible, to disclaim all responsibility for their users' actions through disclaimers contained in the terms of use of such services. However, such disclaimers do not have full legal effect. The responsibility of an internet company that provides an information society service cannot be avoided. Whether it derives from special rules on e-commerce or consumer protection or from the general rules of the legal system, and regardless of whether a public interest or the subjective rights of an individual are at stake, a certain degree of responsibility must exist.<\/p>\n

Whether we call them online content-sharing service providers or social information service companies, internet giants such as Alphabet (Alphabet Inc.) and Meta (Meta Platforms Inc.) have reached a level of value and power that no one could have imagined a decade or two ago. These companies, whose business is based on providing services to individuals who use the internet, have put to the test traditionally designed legal systems, not only of nation states but also of the European Union. The response to the tendency of technology companies to disclaim responsibility for their users' conduct came first through case law and soon afterwards through EU regulation. The need to protect, above all, the public interest (with an emphasis on the interests of minors), as well as the subjective rights of individuals (such as intellectual property rights), has led to a broader interpretation of existing mandatory rules and to the adoption of new ones, with the aim of filling the legal gaps created by rapid technological change that bureaucracy finds hard to keep up with.<\/p>\n\n

EU directives which regulate the liability of internet platforms<\/h4>\n

One of the primary questions regarding the responsibility of technology companies is the moment when that responsibility arises. Service providers take the position that their platforms cannot be held liable for unlawful content before they become aware of it, or before a third party has made its unlawfulness apparent. However, as technology advances, and especially the modern algorithms that online service providers possess, there is a growing need to extend their responsibility so that technology companies use those algorithms to prevent a large part of unlawful posts and block them already at the attempt to publish them. In line with this need, the European legislator, in the Directive on copyright and related rights in the Digital Single Market (Directive 2019\/790), introduced a certain liability of service providers for copyright infringements committed by their users against third parties, and obliged them to take a number of measures to prevent copyright infringements. At the same time, neither the Directive (Article 17(8)) nor the Digital Services Act (DSA, Article 8) allows a general obligation to monitor the content that providers transmit or store to be imposed on them.<\/p>\n

Advocates of internet freedom and opponents of Article 17 of the Directive pointed out, during and after the public debate on its adoption, the consequences of such liability. Service providers, in order to avoid liability and without any motive to take risks, could remove content even where they are not sure whether it was posted lawfully or unlawfully. This would inevitably restrict freedom of expression, the availability of content and the right to receive information, and therefore the flow of information in general. On the other hand, one of the main arguments for increasing the responsibility of service providers is establishing legal order on the internet, preventing violations of the law and helping people exercise their subjective rights.<\/p>\n\n

Limitations of the algorithm and consequences for user's subjective right<\/h4>\n

In these circumstances, platforms have widely started to use algorithms that, already at the moment of posting, flag content as contrary to public morals, the law or the platform's general rules, and prevent it from being posted. In addition to these preliminary checks on the platform's own initiative, increased attention has been paid to the grounds on which third parties can report abuse and to the handling of such reports. Although internet platforms previously offered options for reporting unlawful content or content that violates the public interest, morals, public order or the subjective rights of others, the list of grounds for reporting content keeps growing as the level of responsibility increases.<\/p>\n

However, where there are rules, there are also attempts to abuse and circumvent them. Consequences in the form of restrictions of other people's rights are inevitable. The eternal balancing between two rights or two values, private and public interest, the right to privacy and the right to information and freedom of expression, has gained a new arena, this time on and about the internet.<\/p>\n

The assessment of whether a report of unlawfulness or infringement is justified is all the more questionable because it is made by internet platforms on the basis of criteria that are not always clear and transparent, which raises doubts as to whether such decisions are fully automated, without any human involvement, even in a supervisory role. The Digital Services Act (DSA) has partly addressed this issue: online platforms must provide an internal complaint-handling system for users, and decisions on complaints may not be taken solely by automated means, but under the supervision of appropriately qualified staff (Article 20). Users may also turn to a certified out-of-court dispute settlement body (Article 21). These obligations do not apply to online platforms that qualify as micro or small enterprises, unless they have been designated as very large online platforms (Article 19). Arbitration by the platform in such situations is certainly necessary. If the exercise of subjective rights were left exclusively to the courts, that is, if platform users or third parties had to pursue their claims only through the courts, such proceedings would be inaccessible to many, both for financial reasons and because of the inevitable international element resulting from the global nature of the internet.<\/p>\n\n

New EU rules on digital services<\/h3>\n

It is no secret that users of information society services and e-commerce are exposed to a high risk of fraud and security threats, and are limited in exercising the rights they are legally entitled to.<\/p>\n

Although most experts and the general public agree that the benefits of digital transformation are great, the process has numerous consequences for individuals, society and the economy. One of the dominant problems is online trade in illegal goods and the exchange of questionable content. Even online services have become something that can easily be manipulated through misused algorithms, influencing the information process, the content of information, leading people to wrong conclusions, influencing public opinion or otherwise harming users. Digitalisation has also shaped the market in such a way that only a few large platforms control a large part of the user network and set their own rules, the application of which often results in monopolistic behaviour and unfair competition, with users ultimately suffering the greatest harm.<\/p>\n

For this reason, the trend of regulating digital and online services, which began with the GDPR and the Directive on copyright in the Digital Single Market, was continued by the European Union in 2022 with the adoption of two more important acts, the Digital Services Act (DSA) and the Digital Markets Act (DMA), first proposed on 15 December 2020. The primary aim of these new regulatory trends in the EU is to ensure a higher level of security and protection of the rights of users of digital services, and greater legal certainty.<\/p>\n

The common purpose of these acts is to create a safe digital environment that reduces the chance of users being deceived into buying counterfeit goods and in which users can more easily exercise their guaranteed rights, as well as to lay the foundations for the further sound development, growth and competitiveness of the digital industry, both in Europe and globally.<\/p>\n

The DSA lays down specific obligations to assess systemic risks for very large online platforms and very large online search engines. These risks include the dissemination of illegal content, negative effects on the exercise of fundamental rights, effects on civic discourse, electoral processes and public security, as well as risks related to gender-based violence, the protection of public health and minors, and the physical and mental well-being of individuals. Particular attention is also paid to the possibility of platforms being misused through fake accounts, bots and other forms of automated manipulation.<\/p>\n\n

Which services does the DSA apply to?<\/h4>\n

The DSA applies to intermediary services provided over the internet: mere conduit services (for example, internet access providers), caching services and hosting services, including online platforms and search engines. A website that only displays its own content, without acting as an intermediary for third-party content, is as a rule not covered by these rules. Services provided through websites and applications may include platforms acting as intermediaries in e-commerce, content-sharing platforms, social networks, dropshipping platforms and similar services.<\/p>\n\n

What does the DMA regulate?<\/h4>\n

The Digital Markets Act sets out the rules for so-called gatekeepers, online platforms that act as a link between businesses and users, and regulates in more detail the digital services provided by such platforms.<\/p>\n

To be designated as a gatekeeper under the DMA, a company must meet the following criteria:<\/p>\n