The Commissioner for Information of Public Importance and Personal Data Protection has prepared a new Model Law on Personal Data Protection, aligned with the current standards of the relevant European documents, primarily, with the General Data Protection Regulation, and opened public consultations on it.
The current Law on Personal Data Protection does not contain even the minimum provisions that would relate to a few, from the standpoint of personal data processing, very important and delicate areas. As a result, for a long time, practically every day, we have been faced with the fact that it is very difficult and often impossible to ensure unhindered exercise of the right to personal data protection in all areas of life. The Commissioner has already publicly pointed this problem out on numerous occasions, initiated its resolution, including the forwarding to Government of articulated normative solutions in certain areas, however the competent authorities have failed to provide an adequate response in all instances.
The need for adoption of the new law was recognized back in mid-2012, when the Government formed some sort of an inter-agency working group for this purpose. However, the work of this Working Group failed to yield any results. In an effort to provide assistance, the Commissioner, prepared and put a full, brand new Model Law at the disposal of the Government in the second half of 2014. In its Action Plan for Chapter 23, the Government stipulated that the new law would be enacted by the end of 2015, based on the Model prepared by the Commissioner. However, the Law has not been adopted yet, and the Draft presented by the Ministry of Justice has almost nothing in common with the Commissioner’s model and does not comply even with the minimum requirements.
In the meantime, since no one has been waiting for us, major, capital changes in the field of personal data protection have occurred in the EU - adopted in the General Data Protection Regulation. This has resulted in the need for updating the Model prepared by the Commissioner in 2014.
Personal data protection is a permanent task in the negotiations with the European Union and, more importantly, it is imperative for the interests of the citizens of the Republic of Serbia. The deadline for adopting the new Law on Personal Data Protection in the Action Plan for Chapter 23 has been repeatedly postponed for several years in a row now. The final deadline for adoption was the end of 2016; the law has not been passed by that date, the new deadline is not known.
In the Working Document Serbia 2016 Progress Report dated 11 September 2016, the European Commission stated, inter alia, that "A new law on personal data protection in line with EU standards needs to be adopted urgently. Processing and protection of sensitive personal data, biometrics and video surveillance, security of data on the internet and direct marketing remain inadequately regulated, leaving significant scope for abuse."
Bearing in mind all of the above, the Commissioner has compiled this new text of the Model Law, and put it forward for public consultations, inviting all interested parties to engage in the debate and make proposals and comments.
