Unofficial Translation(Official Gazette of BiH, 32/01)

Based on Articles IV.4, II and III of the Constitution of Bosnia and Herzegovina, theParliamentary Assembly of Bosnia and Herzegovina, in the session of the House ofRepresentatives held on November 30, 2001 and in the session of the House of Peoples
held on December 20, 2001, adopted theLAW ON THE PROTECTION OF PERSONAL DATA
Chapter I
GENERAL PROVISIONS
Purpose of the Law
Article 1

The purpose of this Law is to secure in the territory of Bosnia and Herzegovina for every
individual, whatever his nationality or residence, respect for his rights and fundamental
freedoms, and in particular his right to privacy, with regard to the processing of personal
data relating to him ("data protection").
Scope of the Law
Article 2This Law shall apply to the processing of personal data by:a.

public bodies at the level of Bosnia and Herzegovina,b.

public bodies of the Federation of Bosnia and Herzegovina and Republika
Srpska and the District of Brcko of Bosnia and Herzegovina insofar as theminimum level of data protection provided by this Law is not governed by
the legislation of the Federation of Bosnia and Herzegovina or Republika
Srpska or the District of Brcko of Bosnia and Herzegovina,c.

private bodies of the Federation of Bosnia and Herzegovina andRepublika Srpska and the District of Brcko of Bosnia and Herzegovina
insofar as the minimum level of data protection provided by this Law is
not governed by the legislation of the Federation of Bosnia andHerzegovina or Republika Srpska or the District of Brcko of Bosnia andHerzegovina,
Definitions
Article 3
For the purposes of this Law in particular:'personal data' shall mean any information relating to an identified oridentifiable natural person (hereinafter: 'data subject'); an identifiable person is
one who can be identified, directly or indirectly, in particular by reference to an
personal identification number or to one or more factors specific to his physical,
physiological,
mental,economic,
culturalorsocialidentity;"special categories of data" shall mean any personal data relating toa.

racial origin, nationality, national or ethnic origin, political opinion or
party affiliation, trade union affiliation, religious or other belief, health,sexual life andb.

criminal conviction.
processing of personal data' ('processing') shall mean any operation or set ofoperations performed upon personal data, such as collection, recording,organization, storage, adaptation or alteration, retrieval, consultation, use,
disclosure by transmission, dissemination or otherwise making available,alignment
orcombination,
blocking,erasureordestruction;"data access" means any operation that enables a third party to view personal
data without the right to use it thereafter for other purposes;
controller' shall mean the natural or legal person, public authority, agency or any
other body which alone or jointly with others determines the purposes and meansof the processing of personal data; where the purposes and means of processing
are determined by national or European Community regulations, the controller orthe specific criteria for his nomination may be designated by national or European
Community law;

'processor' shall mean a natural or legal person, public authority, agency or any
other body which processes personal data on behalf of the controller;'the data subject's consent' shall mean any freely given specific and informedindication of his wishes by which the data subject signifies his agreement topersonaldata
relating
tohim
being
processed.

Chapter II.
BASIC PRINCIPLES FOR DATA PROTECTION
Quality of Data
Article 4a.
b.
c.
d.
e.

Personal data undergoing automatic processing shall be:
obtained and processed fairly and lawfully;
stored for specified and legitimate purposes and not used in a way
incompatible with those purposes;
adequate, relevant and not excessive in relation to the purposes for which
they are stored;
accurate and, where necessary, kept up to date;preserved in a form which permits identification of the data subjects for nolonger than is required for the purpose for which those data are stored.

Data Processing
Article 5
Personal data shall not be processed unless:a.

the data subject has unambiguously given his consent; orb.

processing is necessary for the performance of a contract to which the data
subject is party or in order to take steps at the request of the data subject prior
to entering into a contract; orc.

processing is necessary for compliance with a legal obligation to which thecontroller is subject; ord.

processing is necessary in order to protect the vital interests of the data
subject; ore.

processing is necessary for the performance of a task carried out in the public
interest or in the exercise of official authority vested in the controller or in athird party to whom the data are disclosed; orf.

processing is necessary for the purposes of the legitimate interests pursued by
the controller or by the third party or parties to whom the data are disclosed,
except where such interests are overridden by the interests for fundamental
rights and freedoms of the data subject.

Personal data disclosing racial origin, political opinion, religious or other belief as well as
personal data about health or sexual life cannot be proceeded automatically unless theappropriate protection is provided by law. This shall also apply to personal data related tocriminal convictions.
Personal data shall not be transferred and files or records shall not be consolidated(merged, connected, or otherwise conjoined) unless the conditions set out in paragraphs 1
and 2 of this Article are complied with.
Para (3) shall apply to the consolidation of files processed by the same controller.
Purpose of Data processing
Article 6
Personal data shall be processed only for a specified purpose, in exercise of a right orin compliance with a legal obligation. In the case of compulsory data transfer oraccess, the legal rule ordering such data handling shall also be indicated to the person
obliged to furnish the data.
No personal data shall be processed other than that indispensably required forsatisfying the purpose of processing and only in a way compatible with that purpose.
Data shall not be used excessively and longer than is required for that purpose.
Article 7
Before collecting any personal data the data subject shall be advised whether thecollection is voluntary or compulsory. In the case of the compulsory supplying of
personal data the title of the relevant law ordering data processing shall be stated.
The data subject shall be notified of the purpose of the processing of the data and of
the identity of the controllers and the processors and whether the data is collectedfrom the data subject or a third party.

Data Transfer Abroad
Article 8
Personal data shall not be transferred from the country to a data controller or dataprocessor abroad, whatever the data medium or the mode of transmission is, unlessthe conditions of Article 5 of this Law are complied with and provided that the same
principles of data protection are obeyed by the foreign controller in respect of thedata.
Technical Data Processing
Article 9
The obligations of a data processor concerning the processing of personal data are
determined by the data controller according to the provisions of this Law and otherapplicable laws on data processing. The data controller is responsible for the legalityof the instructions concerning the operations performed upon personal data.
The data processor is responsible for the processing of personal data under theinstruction of the data controller. In fulfilling his functions the data processor shallnot delegate his responsibilities to other data processors unless explicitly instructed to
do so by the data controller.
Data Security
Article 10
The data controller and, within its competence, the data processor shall ensure data
security and shall take all technical and organisational measures and develop rules ofprocedure required for the enforcement of this Law and other regulations concerning
data protection and secrecy.
Data, and, in particular, special categories of data, shall be protected against
unauthorised access, alteration, transfer, deletion, damage, or destruction.
Article 11
Data processing operations concerning special categories of data as referred to in Art.
3.2 shall be examined by the Data Protection Commission following receipt of a
notification from the controller that such data is to be processed. Such processing
operations must only be started after the Data Protection Commission has completed
its examination or two months have passed since the Commission has been notified.

Prior to commencement of any such data processing operation, the data controller
shall notify the Data Protection Commission of:
a.
b.
c.
d.
e.
f.
g.
h.

the purpose of the data processing;
the type of processed data and the legal basis therefor;the range of data subjects;
the source of data;
the type of transferred data, the recipients of such data, and the legal basisof transfer;the deadlines for deletion of certain types of data;
the name and address of data controller and of data processor, the actual
place of data processing (including technical processing), as well as any
activity of data processor related to the processing of personal data;
proposed transfers of data to third countries.

Any change in data specified in paragraph. (2) shall be reported to the Data Protection
Commission within 8 days.
Access to Personal Data
Article 12
The data controller shall inform the data subject of the processing of his or her
personal data performed either by the data controller or by a data processor, thepurpose of the processing, its legal basis and duration, the name and address andactivity in connection with the data processing of a data processor, as well as whoreceived or will receive data and for what purpose. The length of records on transfer
and, the duration of obligation to give information, may be restricted by laws on dataprocessing. This duration shall not be less than five years with regard to personal dataor less than twenty years with regard to special categories of data.
Article 13
The data subject shall have the right to:a)b)

request information on the processing of his or her personal data;
request the rectification of his or her personal data, or deletion thereof
when demonstrated to be incorrect or processed unlawfully.

The data controller shall furnish such information in writing, in an intelligible form,
within 30 days from the submission of a request.
Information referred to in paragraph (2) of this Article shall be free, except for those
repeatedly requested by the same person on the same area from the same controller
within a period of one year.

Article 14
The data controller shall not deny access to information to a data subject except
where provided by law.
The data controller shall state the reason for denial of the information requested.
The controller shall annually report on applications denied to the Data Protection
Commission.
Article 15
The data controller shall correct inaccurate data.
Personal data shall be deleted ifa.
the processing of such data is unlawful, orb.
the data has been obtained in an unlawful manner, orc.
requested so by data subject, ord. the purpose of processing has ceased.
Article 16
The data subject and any other person to whom data is transferred for processing shallbe informed of any rectification and deletion of the data. Such information may bedispensed with, in view of the purpose of processing, if the legitimate interest of data
subject is not infringed thereby.
Article 17
The individual rights of the data subject (Articles 11. 12 and 15) may be restricted bylaw in the interest of the external and internal security of the State, in the areas ofnational defence, national security, crime prevention or criminal investigation as wellas in the monetary interest of the State, or protecting the data subject or the rights orfreedoms of others. Such restrictions are only permissible to the extent that they arenecessary in a democratic society for one of the listed purposes.

Compensation

Article 18
The data controller shall pay compensation for any damage caused to a data subject asa result of the processing of his or her data. The data controller is liable for any
damage to a data subject caused by a data processor. The data controller may be
exempted from this liability, in whole or in part, if he proves that he is not responsible
for the event giving rise to the damage
No compensation shall be paid for damage caused by the injured person's intentionalor seriously negligent conduct.
Chapter III
DATA PROTECTION COMMISSION

Article 19
The Council of Ministers of Bosnia and Herzegovina (hereinafter: the Council ofMinisters) shall, on the proposal of the Ministry for Civil Affairs andCommunications, appoint a commission for data protection and to monitor the accessto and transfer of personal data to be called the Data Protection Commission(hereinafter: the Commission). The members of the Data Protection Commission
may only be citizens of Bosnia and Herzegovina and they shall have the powers,duties and functions as set out in this Chapter.
Members of the Commission shall be independent and impartial and shall not beelected officials or hold any political mandate.
The Commission shall have five members who will be appointed by the Council ofMinisters. The members of the Commission shall hold office for three years.
The members of the Commission shall have at least a university degree and be
selected upon the basis of their professional experience in conducting and supervisingproceedings involving data protection, and their demonstrated ability to exercise theirfunction within an appeals panel. Three members of the Commission must be
qualified lawyers.
The Commission shall decide by simple majority.
The members of the Commission may be removed from office on the proposal of theCouncil of Ministers. The Council of Ministers shall submit the proposal for removalof the member of the Data Protection Commission to the House of Peoples of theParliamentary Assembly of Bosnia and Herzegovina. The grounds for removal of amember of the Commission shall be: conviction of the member of serious crime,
physical or psychological incapacity or persistent failure to act in the fulfilling of hisoffice.
When investigating a complaint the Commission shall have regard to the rights of an
accused person and in particular the following:a)to be informed promptly, in a language which he understands and indetail, of the nature and cause of the accusation against him;b)to have adequate time and facilities for the preparation of his defence;c)

to defend himself in person or through legal assistance of his own
choosing or, if he has not sufficient means to pay for legal assistance, to begiven it free when the interests of justice so require;d)to examine or have examined witnesses against him and to obtain theattendance and examination of witnesses on his behalf under the same
conditions as witnesses against him;e)to have the free assistance of an interpreter if he cannot understand or
speak the language used in court in the proceedings.
Article 20

The Commission shall:
a.
b.
c.

observe the implementation of this Law and other laws on dataprocessing;examine complaints lodged with the Commission;present a report on data protection to the Parliamentary Assembly of
Bosnia and Herzegovina annually.

Article 21
The Commission shall monitor the conditions for protection of personal data, present
proposal for adoption or modification of legislation concerning data processing andgive opinion on such draft legislation.
The Commission observing an unlawful processing of data, shall require thecontroller to discontinue the processing. The controller shall take the necessary
measures without delay and inform the Commission in writing within 15 days
thereof.Article 22
In exercising its functions the Commission may request a controller or processor tofurnish it information on any matter, and may inspect any documents and records
likely to bear on personal data.
The Commission may enter any premises where data are processed. The property
and premises of non-statutory data controllers may only be entered and inspectedduring business hours.
State and official secrets shall not prevent the Commission from exercising its rights
stated in this Article, but the provisions on secrecy shall bind it as well. In cases
affecting state or official secrets the members of the Commission shall exercise theirrights in person.
All authorities are obliged to support the Commission in carrying out its duties uponrequest.
Article 23
Anyone may apply to the Commission in case of violation of his or her rights, or of adirect danger thereof, concerning the process of his or her personal data.
The Data Protection Commission may:
a.
b.
c.

hear the applicant;call witnesses and experts when it deems necessary;ask for and obtain from the authorities concerned all relevant
information.

Decisions of the Commission shall be:
a.
b.
c.

subject to any judicial review in the State Court of Bosnia andHerzegovina;
reasoned on legal grounds;
notified to the appellant within 7 days.

No one shall suffer any prejudice on the grounds of his or her application to the Data
Protection Commission.
Chapter IV
DATA PROCESSING IN RESEARCH INSTITUTES

Article 24
Personal data collected and stored for purposes of scientific research and statistics
shall not be used for other purposes.
Personal data, as much as it is possible with regard to the research, shall beanonymised. Data capable of identifying a specified or specifiable natural person
shall be stored separately. These data shall not be connected with other data except
when it is required for the purposes of research.
An organisation or a person performing scientific research may disclose information
obtained from personal data if consented to by the data subject or when data areprocessed solely for purposes of scientific research or are kept in personal form for aperiod which does not exceed the period necessary for the sole purpose of creatingstatistics.

Chapter V
PENALTY PROVISIONS
Offenses
Article 25
Whoever:a.

unlawfully transfers, facilitates access to, exploits or uses personal
data that has been put into his/her care or has become accessible tohim/her solely due to his/her professional involvement in electronic dataprocessing, orb.

unlawfully discloses information to another person obtained fromdata that has been put into his/her care or has become accessible tohim/her solely due to his/her professional involvement in electronic dataprocessing, and is to be fined or punished by imprisonment not exceeding
two years.

shall be punished with a fine in the amount ranging from KM 5,000.00 to KM 15,000.00.
The procedure, under this Article, may not be initiated upon a request of the affected
person.

Article 26
Whoever:
a.
b.
c.
d.
e.
f.
g.
h.

starts data processing without having complied with the duty ofnotifying the Data Protection Commission in advance, orstarts data processing without having obtained permission from theData Protection Commission in cases in which this is necessary, orcontinues data processing in spite of the fact that the Data
Protection Commission has legally prohibited such processing, ordoes not implement a legally binding decision that instructs toprovide information on stored data, to rectify data or to delete data,transmits personal data abroad without the permission of the Data
Protection Commission, orviolates his obligations to inform data subjects on personal data,
rectify incorrect data, delete data, orseverely violates his obligation to ensure confidentiality and secrecyof processed data ordoes not co-operate with the Data Protection Commission, refuses
to provide it with requested information or refuses to let the Data
Protection Commission enter its premises, shall be punished with a fine in
the amount ranging from KM 1,000.00 to KM 10,000.00.

Chapter VI
FINAL PROVISIONS

Article 27
The Ministry of Civil Affairs and Communications in consultation with the Data
Protection Commission shall issue bylaws in the following areas:a.
b.

data security and data processing by the institutions of Bosnia andHerzegovina;
all other matters necessary to implement this Law.

The Commission may issue guidelines on the tasks and rules for the appointment ofthe personal data protection official.

Procedure for Accessing Information of Public Interest
Article 28
The provisions of this Law shall be taken into account in the application of the Law
on Free Access to Information in Bosnia and Herzegovina (Official Gazette of BiH,number 28/00)
Article 29
This Law shall enter into force 30 days after the date on which it is published in theOfficial Gazette of BiH and it shall also be published in official gazettes of theEntities and Brcko District of Bosnia and Herzegovina.
PS BiH number 69/01
December 20, 2001
Sarajevo
Speaker
Speakerof the House of Peoplesof the House of Representativesof the Parliamentary Assembly of BiH of the Parliamentary Assembly of BiH
Sejfudin Tokic
Zeljko Mirjanic