Mr. Milan Marinović has been appointed as Commissioner for Information of Public Importance and Personal Data Protection (the “Commissioner”). Shortly after the election, on 2 August 2019, the Commissioner sent an official letter to the Speaker of the National Assembly requesting the postponement of the implementation of the new Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, “Official Gazette of the RS”, no. 87/2018) (the “Law”), which shall apply from the expiration of nine months from the date of entry into force of the Law, i.e. as of 21 August 2019.
The Commissioner pointed out that the Law represents a great challenge for many authorities that do not have sufficient capacity to respond to the obligations imposed by the Law, as well as for companies. In this regard, the Commissioner requested that the application of the Law is postponed until 1 September 2020.
However, since no response from the competent authorities has been given in the meantime, today, on 21 August, 2019, the Law will begin to apply, and its implementation will be a challenge for both the Commissioner and all other entities that process and handle personal data.
Transfers of personal data to third countries and international organizations
The Law prescribes that the transfer of personal data abroad, without prior approval, may take place, inter alia, where it is determined that the recipient jurisdiction in question ensures an adequate level of protection of personal data. In this regard, the Government of the Republic of Serbia has adopted a Decision on the List of Countries, Parts of Their Territories or One or More Sectors of Certain Activities in Those Countries and International Organizations Where it is Considered That an Adequate Level of Protection of Personal Data is Ensured (Odluka o listi država, delova njihovih teritorija ili jednog ili više sektora određenih delatnosti u tim državama i međunarodnih organizacija u kojima se smatra da je obezbeđen primereni nivo zaštite podataka o ličnosti, “Official Gazette of RS”, no. 55/2019) (the “Decision”).
Among others, countries on the list are:
– Montenegro;
– Bosnia and Herzegovina;
– Republic of Northern Macedonia;
– Republic of Albania;
– Russian Federation;
– Republic of Turkey;
– United States of America (limited to “Privacy Shield framework”);
– Canada (business entities);
– Japan.
The Decision entered into force on 10 August 2019 and shall apply from 21 August 2019.
