REPUBLIC OF SERBIA
Ministry of JusticeLAW ON PERSONAL DATAPROTECTION
Published in:"Official Gazette of the Republic of Serbia" No. 97/08

Prepared by
Jugoslovenski pregled /Yugoslav Survey
Belgrade, 2008.

Note: This is a true translation of the original Law
Original title:
ZAKON O ZAŠTITI PODATAKA O LIČNOSTI„Službeni glasnik Republike Srbije” br.97/08

Translation date: December 2008.

Prepared by: Javna ustanova / Public Agency Jugoslovenski pregled /Yugoslav Survey
Dečanska 8, Beograd; Phone/Fax: + 381 11 / 32 33 610, 32 32 295; 32 41 953, 32 40 291; P.O.B. 80
www.pregled-rs.rs • www.yusurvey-rs.rs • e-mail: info@pregled-rs.rs

LAW ON PERSONAL DATA PROTECTION
I MAIN PROVISIONS
Scope of the Law
Article 1
This Law shall govern the conditions for collection and processing of personal data, therights of data subjects and the protection of rights of data subjects, limitations to data protection,
procedure upon appeal before the authority competent for data protection, data security, data
filing system, transfers of data outside the Republic of Serbia and supervision over the applicationof the Law.
Personal data protection in the Republic of Serbia is provided for each natural person,
regardless of his/her nationality, residence, race, age, sex, language, religious, political and otherbelief, national or social origin, property, birth, education, social status and other personal
characteristics.
The personal data protection tasks are performed by the Commissioner for Information of
Public Importance and Personal Data Protection (hereinafter: the Commissioner) as theautonomous state organ, independent in the execution of his or her competence.

Objective of the Law
Article 2
The objective of this Law is to ensure realisation and protection of the right to privacy andother rights and freedoms regarding personal data processing to every natural person.

Definitions of Terms in this Law
Article 3
Certain terms in this Law shall have the following meaning:
1) Personal data is any information concerning a natural person, regardless of the form inwhich it is expressed and the data format (paper, tape, film, electronic medium and the like),
under whose mandate, in whose name or for whose account the information is stored, the datewhen information originated, the place where the information is stored, the mode of learning theinformation (directly, by listening, watching and the like, or indirectly, by insight into documents■3containing the information and the like), and regardless of other characteristics of the information(hereinafter: data);
2) Natural person is an individual to whom the personal data relates, who is identified or
identifiable by reference to personal name, personal identification number, address code or othermark of his physical, psychological, mental, economic, cultural or social identity (hereinafter: data
subject);
3) Personal data processing is any action performed upon data, such as: collection, recording,transcription, multiplication, copying, transmission, retrieval, organisation, storage, separation,
crossing, unification, adaptation, alteration, provision, use, making available for insight,
disclosure, publication, dissemination, revealing through transmission and otherwise making
available, hiding, dislocation and otherwise making unavailable, as well as undertaking otheractivities regarding the aforementioned data, regardless of whether it is being performed
automatically, semi-automatically or in other manner (hereinafter: processing);
4) Government organ is a state organ, territorial autonomy organ, local self-governmentorgan and organisation vested with the performance of public authority;
5) Personal data filing system controller is a natural or legal person or authority processing
the data (hereinafter: controller);
6) Personal data filing system is a set of data kept in automated or unautomated manner,
available according to, personal, subject-matter related or other criterion, regardless of the mannerand place of their storage;7) Recipient is a natural or legal person, or government organ that is, by statute or person'sconsent, authorised to use the data (hereinafter: recipient).
8) The Processor is a natural or legal person, or government organ, to whom the controller
conferrers tasks related to data processing in accordance with the statute or contract (hereinafter:
the processor).
9) The written form also entails electronic form under the statutory conditions regulating theelectronic signature.
10) The Central Register of the Personal Data Filing Systems (hereinafter: the Central
Register) is a record composed of registers of data filing systems and a catalogue of data filingsystems managed by the Commissioner.

Application of the Law
Article 4
Provisions of this Law shall apply to any automated processing, as well as to processing
contained in unautomated data filing systems.

Data to Which the Law Shall Not Apply
Article 5
Unless contrary interests of the data subject are manifestly prevailing, certain provisions of
this Law on the conditions for processing, as well as on rights and obligations concerning
processing, shall not apply to the processing of:1) data available to anyone and published in public media and publications or available inarchives, museums and other similar organisations;2) data processed for family or other personal use that is not available to third party;■43) data on members of political parties, citizens’ associations, trade unions and similarorganisations that are processed in these organisations, if the member provides written consent
that provisions of this Law shall not apply to such data processing for certain period of time, but
not for a period exceeding the duration of his/her membership;4) data published by a person capable of protecting his/her own interests, concerning
himself or herself.

Processing for Historic, Statistical or Scientificand Research Purposes
Article 6
Data collected and processed for other purposes can be processed solely for historical,
statistical or scientific and research purposes, if they do not constitute grounds for passing
decisions or taking measures against a given person, if adequate protection measures are provided.
Measures for protecting data archived solely for historical, statistical or science and research
purposes shall be governed by a separate regulation.

Controller Prescribed by Special Statute
Article 7
If special statute prescribes the purpose and manners of data processing, the controller canbe designated within such regulations.

II CONDITIONS FOR PROCESSING
Unlawful Processing
Article 8
Personal data processing is unlawful if:
1) natural person did not consent to processing or processing is performed without statutory
authority2) the purpose of processing is different than designated, regardless of whether it is donewith data subject's consent or based on statuary authority for processing without consent;3) the purpose of processing is not clearly determined, if it is altered, unlawful or alreadyaccomplished;4) the data subject is identified or identifiable after the purpose of processing isaccomplished;5) the mode of processing is not permitted;6) data being processed is unnecessary or unsuitable for realising the purpose of processing;7) the amount and type of data being processed is disproportionate to the purpose ofprocessing;8) data is false and incomplete, that is, it is not based on a credible source, or is outdated;.

■

5

Decision by Automated Processing
Article 9
Decision generating legal consequences for data subject or deteriorating his/her position
may not be solely based on automatically processed data, which serve for the purpose of assessing
data subject's characteristic (working ability, reliability, credit capacity and the like).
Decision from paragraph 1 of this Article may be passed if so expressly prescribed by law
and when data subject’s request regarding the conclusion or performance of contract is being
adopted, where adequate protection measures shall be implemented.
In the case from paragraph 2 of this Article, the data subject must be informed of theprocedure of automated data processing and manner of passing the decision.

Processing With Consent
Article 10
Valid consent to personal data processing can be given by data subject, after being informedby the controller in terms of provisions of Article 15 of this Law.
The consent may be given orally or in writing to the official record.
The consent may be given through a proxy.
A proxy must be certified, except as otherwise provided by statute.
Statutory representative or guardian grants consent for a person incapable of giving his/her
own consent.
Consent for processing of data on data subject who has deceased, can be granted by spouse,children who have reached the age of fifteen, parents or siblings, legal heir or the person sodesignated by the deceased.

Consent Revocation
Article 11
Consent may be revoked.
The consent revocation may be given orally or in writing to the official record.
If consent is revoked, the person who granted consent will compensate the real justified
costs and damage caused by the revocation to the controller, in accordance with provisions
governing responsibility for damage.
Following the consent revocation, the data processing shall not be permitted.

Processing Without Consent
Article 12
Data processing shall be permitted without consent:
1) for realisation or protection of vital interests of the subject or third party, such as life,
health and physical integrity in particular;2) for the purpose of execution of obligations prescribed by a statute, an act passed inaccordance with a statute or by a contract concluded between the subject and the controller, as
well as for the purpose of preparing the conclusion of contract;■63) in other cases specified by this Law or other regulation passed in accordance with this
Law in order to affect a prevailing justified interest of data subject, controller or recipient.

Data Processing by a Government Organ
Article 13
Government organ, processes data without data subject's consent if processing isnecessary in order to realise tasks from its competence determined by law or other regulation forthe purpose of realising the interest of national or public security, state defence, prevention,
detection, investigation and prosecution for criminal offences, economic or financial interests ofthe state, protection of health and moral, protection of rights and freedoms and other public
interest, and in other cases on the basis of data subject's written consent.

Collection of Data
Article 14
Data are collected from the data subject and from public authorities legally entitled for datacollection.
Data can be collected from a third party if:
1) so stipulated by the contract concluded with data subject;2) so provided by statute or other regulation passed in accordance with statute;3) necessary, given the nature of the operation
4) the collection of data from data subject requires excessive use of time and assets;5) data are being collected in order to realise or protect vital interests of data subject, inparticular his life, health and physical integrity.

Informing about Processing
Article 15
The controller who collects data from data subjects or from third party shall, before datacollection, provide the data subject or the third party with the following information:1) his/her identity, that is, of name or company name, and address, or identity of otherperson responsible for data processing in accordance with law;2) purpose of collecting and further processing of data;
3) manner in which data is used;
4) identity of persons or categories of persons using data;
5) mandatory nature and its legal base, that is, voluntary nature of giving data and its
processing;6) right of data subject to revoke the consent for processing and legal consequences of
revocation;7) rights of data subject in case of unlawful processing;8) other circumstances the withholding of which from data subject or third party would becontrary to conscientious and fair treatment.

■

7

Obligation referred to in paragraph 1 of this Article shall not exist when such providing,
given the circumstances of the case, is impossible or is manifestly unnecessary or inappropriate,
and in particular if the data subject or third party is already informed thereof, or the data subject isunavailable.
Controller who has collected personal data from third party shall provide information on
circumstances listed in paragraph 1 of this Article to data subject forthwith or at the latest upon
first processing, unless such information is not possible, that is, requires excessive use of time andassets or is manifestly unnecessary or inappropriate given the circumstances of the case, and inparticular if the data subject or third person is already informed thereof, or the data subject isunavailable, and if collection and further processing of data from third party is prescribed by law.
In the case from paragraph 3 of this Article, the controller shall be obliged to inform thedata subject as soon as possible, that is, if the data subject so requests.
Information referred to in paragraph 1 of this Article is given in writing when it isprescribed that the consent for processing is granted in written form, unless the data subject the or
third party agree to oral information.
Controller shall inform the data subject and data recipient of alteration, amendment or
erasure of data without delay and at the latest within 15 days from the day of alteration,
amendment or erasure of data.

Particularly Sensitive Personal Data
Article 16
Processing of data on nationality, race, gender, language, religious belief , membership inpolitical party, membership in a trade union, health condition, welfare allowances, victim ofviolence, criminal charges and sex life, is allowed on the grounds of consent of data subject,unless processing even with consent is not allowed by law;
Exceptionally, data related to membership in political party, health condition and welfare
allowances could be processed without consent of data subject, only if stipulated so by law.
In the case from paragraph 1 and 2 of this Article, the data processing must be speciallydesignated and protected.
In case of processing from paragraph 1 and 2 of this Article the Commissioner has the rightof insight and the right to verify the lawfulness of processing ex officio or upon the request of data
subject or controller.
The manner of archiving and measures of data protection from paragraph 1 and 2 of this
Article, with the prior opinion of the Commissioner, shall be regulated by the Government.

Consent to Processing of Particularly Sensitive Personal Data
Article 17Consent for processing of particularly sensitive personal data is granted in writing, including
the designation of the data being processed, purpose of processing and the manner of its use.
If the person granting consent is illiterate or is for other reasons unable to sign the consent in
own hand, consent shall be valid if two witnesses confirm by their signature that the document
includes the statement of will of the person granting consent.

■8

Revocation of Consent to Processing of Particularly
Sensitive Personal Data
Article 18
If consent is revoked, the person who granted consent will compensate the justified costs
and damage caused by the revocation to the controller, in accordance with regulations governing
responsibility for damage, unless otherwise designated in the statement of consent.
Article 11 of this Law shall apply accordingly to the revocation of consent to processing ofparticularly sensitive personal data

III RIGHTS OF DATA SUBJECT AND PROTECTION OF DATASUBJECT'S RIGHTS
1. Rights
Right to Information on Personal Data Processing
Article 19
The data subject has the right to request to be fully and truthfully informed by the controller
on the following:
1) whether the controller processes data on him/her and which action of processing is being
performed
2) which data is being processed;3) who is data collected from, that is, who is the source of data;4) to what purposes are data processed;5) on what legal ground is data processed;
6) in what filing systems is data included;7) who are the recipients of data;8) which data, that is, categories of data, are being used;
9) to what purposes is data being used;
10) on what legal grounds is data being used;
11) to whom is data transferred;12) which data is transferred;
13) to what purposes is data transferred, and
14) on what legal grounds is data transferred15) in what time frame is data processed.
Right to Insight
Article 20
Data subject is entitled to request from the controller to have insight into data concerning
him/her.

■9

Right to insight into data concerning him/her includes the right to see, read and hear the data
and the right to take notes.
Right to Copy
Article 21
Data subject is entitled to request from the controller a copy of data concerning him/her.
Controller gives a copy of data (photocopy, audio copy, video copy, digital copy and thelike) in the form in which the information is, that is, in other form if the information would beincomprehensible to the data subject in the form it is in.
Necessary costs of making and transferring of the copy of data shall be borne by the data
subject.
Rights of Data Subject Regarding Insight Performed
Article 22
Data subject has the right to request from the controller correction, amendment, updating,and erasure of data as well as termination and temporary recess of processing.
Data subject has the right to erasure of data if:
1) the purpose of processing is not clearly determined;
2) the purpose of processing has changed and the conditions for processing for suchchanged purpose are not met;3) the purpose of processing is accomplished, that is, if data is no longer necessary for theaccomplishing of purpose;4) the manner of processing is unlawful;5) data pertains to the amount and category of data the processing of which isdisproportionate to the purpose;6) data is incorrect and cannot be replaced by correct data by correction;7) the data is being processed without consent or authority based on law and in other cases
when processing cannot be conducted in accordance with the provisions of this Law;
Data subject has the right to termination and temporary recess of processing of data in thecase of contesting correctness, completeness and accuracy of data, as well as the right to designate
data as data contested for incorrectness, until the correctness, completeness and accuracy isdetermined.

2. Restrictions
Restrictions of Rights
Article 23
The right to information, right of insight and right to copy may be restricted if:
1) data subject requests information referred to in Article 19 subparagraphs 2 and 7-10 ofthis Law, and the controller has entered the data into a public register or has made them available
to public in another manner;■ 102) data subject abuses his/her right to information, insight and copy;3) the controller or third person, in accordance with Article 15 of this Law, has alreadyinformed him/her on the object of inquiry, or if he/she has performed insight or obtained a copy
and if in the meantime no change to the data has occurred;4) the controller would be prevented from performing activities within his competence;5) the providing of information would seriously jeopardise the interest of national andpublic security, country's defence, or actions on prevention, detection, investigation andprosecution for criminal offences;6) the providing of information would seriously jeopardise an important commercial ormonetary interest of the state;7) information would make available data which is, by regulations or official enactments
based on statute, designated to be kept as a secret, where the revealing of such data would result
in serious consequences to interests protected by law;8) information would seriously jeopardise the privacy or vital interest of data subject,particularly life, health and physical integrity;9) as long as data on data subject are used solely for scientific, research and statistical
purposes, for the duration of such use.
Data subject does not have right of insight while recess of processing is in force, if theprocessing is recessed on data subject's request.

3. Request
Request for Realisation of Right
Article 24
Request for information, insight and copy is filed in writing to the controller, except whenoral submission is also acceptable for the controller, particularly for reasons of efficiency andeconomy. Request for realisation of right regarding the performed insight is filed to the controller
in writing.
Request from paragraph 1 of this Article includes: data on identity of the person filing therequest (name and surname, name of one parent, date and place of birth, personal identification
number), address of residence or dwelling place, as well as other necessary contact information.
Request filed by a statutory heir to a person deceased also includes data on the identity of
person deceased. Death certificate, together with the proof of kinship with the deceased or missing
person is attached to the request.
A person who, due to illiteracy, bodily or other disadvantage, is unable to draw up therequest in writing, may state his/her request orally on the minutes.
Controller may prescribe a format for filing of request, but will be under the obligation also
to consider requests not filed in such format.
If the request is incomprehensible or incomplete, the controller is obliged to instruct theperson filing the request on how to eliminate these deficiencies.
If the applicant fails to eliminate the deficiencies within the designated time limit, that is,within 15 days after receiving the instructions on amendment, and deficiencies are such that therequest cannot be acted upon, controller shall pass a conclusion on rejecting the request as
irregular.
■ 11

4. Decision-making
Deciding on the Request for Information, Insight and Copy
Article 25
Controller is obliged to give information on the request filed without delay, and at the latest
within 15 days from the submission of request for information. Information is given in writing,and may exceptionally be given orally, if the person who filed the request agrees so.
Controller is obliged, without delay, and at the latest within 30 days from the day ofreceiving the request for insight, that is, for the issuing of copy, to enable the applicant the insight,that is, to hand over the copy to the applicant.
Controller shall, together with information on providing the applicant insight into data, or
giving him/her a copy of data, also state the time, place and manner in which the information shallbe provided for insight, the amount of necessary costs for the making of copy, and, if he does nothave the necessary technical means for making the copy, controller shall inform the applicant of
the possibility of making a copy using his/her own equipment.
The applicant referred to in paragraph 2 of this Article may, for justified reasons, request to
have insight into data at a different time. As a rule, insight into data is performed on controller's
official premises.
If the controller is unable, for justified reasons, to act on the request within the prescribedtime limit, the controller is obliged to inform the applicant thereof and designate a subsequent
time limit, which may not be longer than 30 days from the day of expiration of time limit fromparagraphs 1 and 2 of this Article.
If he meets the request for information, insight and copy, the controller shall make a note
thereof.
If the controller denies the request he shall be obliged to pass a ruling thereof, which shall
include instructions on legal remedies.
If the controller fails to answer to the request within the time limits referred to in paragraphs
1 and 2 of this Article, and if he denies the request, the applicant may submit an appeal to theCommissioner.
Deciding on Requests Regarding Insight Performed
Article 26
Controller is obliged to decide on the request regarding insight performed referred to in
Article 24 of this Law within 15 days from the day the request is filed and to inform the applicant
on the ruling without delay.
When the controller denies the request from paragraph 1 of this Article, the explication of
the ruling shall include the grounds for denying the request, as well as reasons for lawfulness ofprocession.
The applicant may lodge an appeal against the ruling on denial of the request to theCommissioner within 15 days from the day of receiving the ruling.
If the controller has established that the request in relation to insight performed is grounded,and there are no technical possibilities to act upon the request without delay or if prompt action
upon request would require excessive use of time and assets, the controller shall ex officio
designate the data as contested and temporarily stay their processing.

■ 12

Controller that is a government organ, and that has established that the request regarding
insight performed is grounded, shall designate the data as contested and temporarily recess its
processing. The controller shall not correct, amend, update, erase it or terminate its processing if:
1) the time limit for mandatory keeping of data has not expired;2) it is apparent that acting upon request would seriously damage other subjects’ interests;
3) due to special manner of storing data, acting upon request is impossible or requires
excessive use of time and assets.
Designation of contestation referred to in Article 22, paragraph 3 of this Law shall be erased
on the grounds of competent organ's ruling or upon consent of the data subject.

5. Manner of Realisation of Rights
Manner of Realising the Right to Insight
Article 27
Controller is obliged to make available to the applicant data concerning him/her incomprehensible form.
Controller is obliged to make available to the applicant all data in the given state.
If the data is stored in different forms (paper, audio, video or electronic record, etc.) theapplicant has the right to have insight in the form he/she chooses, unless this is impracticable.
Data subject who is unable to perform insight without accompany, may do so with theassistance of accompany.
Controller shall, at the request of person in need of professional aid in order to understandthe contents of data concerning him/her, provide such aid.
Controller may not condition the performance of right to insight into data by payment of fee.
If the controller disposes of data in a language in which request was filed, he shall beobliged to provide the applicant insight into data and make a copy in the language in which therequest was filed, unless otherwise designated by the applicant, where the controller has thepossibility to meet such request.
Manner of Realising the Right to Copy
Article 28
Controller issues a copy of data (photocopy, audio copy, video copy, digital copy and thelike) in the form the information is in, or in other form, if the form in which the information is
would be incomprehensible to the data subject.
Necessary costs of making and handing over of copy of data shall be borne by theapplicant.

6. Data Processing for Public Media
Article 29
Data processing by journalists and other media operatives, which exclusively serves the
publicising activity of public media, except for processing for the purpose of advertising, shall be■ 13governed by provisions of Articles 3, 5 and 8 subparagraphs 1-5 and Articles 46 and 47 of thisLaw.
For the purposes of data processing from paragraph 1 of this Article, data on membership inpolitical parties could be used, provided that it is relevant regarding public office held by data
subject.
Attaching Replies and Other Information
Article 30
Reply, correction, revocation or other information published at the request of data subject towhom the data from Article 29 of this Law refers shall be attached, by the controller, to theprocessed data and kept for the same period of time as the data itself.
Protection of Personality
Article 31
If the publication of information in public media violates personal right or person's legally
protected interest, the person violated may request, from the editor-in-chief and from the publisherof public media, information on data concerning him/her that is being processed, insight into dataand copy, unless:1) this would reveal data regarding the information source which the journalist and othermedia employee are not under the obligation or are not willing to reveal;2) this would reveal data concerning person or persons who participated in the preparationand publication of information, and editor-in-chief is not willing to reveal them;3) there are circumstances under which informing, insight or making of copy would
considerably hamper the informing of the public about the subjects of public importance.

7. Special Provisions
Forwarding the Request to Commissioner
Article 32
When the controller is not processing the data, he/she shall forward the request to theCommissioner, unless applicant objects to that.
Commissioner’s Legal Actions
Article 33
Upon receiving the request, the Commissionaire checks whether the controller is processing
the requested data.
If he/she establishes that controller is not processing the data, the Commissioner shallforward the request to the controller processing the data and shall inform the applicant thereof, orshall refer the applicant to the controller processing the data, depending on the manner that will
better serve efficient realisation of the request■ 14

If he establishes that the controller is processing the data, the Commissioner shall order by
ruling to the controller to decide upon request.
Controller decides on the forwarded request referred to in paragraph 2 of this Article within
the time limits referred to in Article 25, paragraph 1 and Article 26, paragraph 1 of this Law fromthe day of forwarding, and on request referred to in paragraph 3 of this Article within 7 days fromthe day of receiving the Commissioner’s ruling.
Proxy
Article 34
Performance of rights recognised by this Law may be effected personally or through a proxy.
Proxy must be certified.
Keeping and Use in Case of Death
Article 35
In case of death and declaration of missing person deceased, personal data collected on thebasis of contract, that is, written consent, are kept in accordance with conditions stipulated in thecontract or consent, and personal collected on the basis of statute at least one year from the day ofdeath or declaration of missing person deceased, after which they are destroyed. A note is madeon the destruction of personal data.
Consent to use of personal data on the deceased is granted by persons mentioned in Article
10, paragraph 6 of this Law.
Obligation of Controller
Article 36
If the personal data filing system was established by contract, that is, on the ground ofwritten consent, in case of recession of contract or withdrawal of written consent, the controller isobliged to erase personal data within 15 days from the day of recession of contract or withdrawalof consent, unless otherwise prescribed or stipulated.
Application of Administrative Procedure Law
Article 37
Provisions of statute governing general administrative procedure, shall apply accordingly tothe procedure of deciding on request, unless otherwise provided in this Law.

■ 15

IV PROCEDURE UPON APPEAL
Right to Appeal
Article 38
The applicant may file an appeal to the Commissioner concerning the personal dataprotection:
1) against controller’s decision by which he denies or rejects the request;
2) if controller does not decide upon request in prescribed time limit;
3) if controller fails to provide insight into data, or to issue copy of data or fails to do so inmanner and within the time limit prescribed by this Law;
4) if controller conditions the issuing of data by payment of fee that exceeds the amount ofnecessary costs for making such copy;5) if controller, contrary to the statute, impedes or disables the exercise of the right.
The appeal can be filed within 15 days from receiving the ruling by which the request isdenied or rejected, that is, upon the expiry of the prescribed time limit for deliberation and acting.
The copy of the submitted request, proof of its submission to the controller and the copy ofcontested decision are enclosed with the appeal.

Commissioner’s Ruling upon Appeal
Article 39
Commissioner passes the ruling at the latest within 30 days from the day of filing of appeal.
Appeal is forwarded to the controller for reply. The appellant can file a rejoinder to thecontestations from the reply to appeal.
Commissioner shall reject by a ruling an appeal that is undue or incomplete or an appeal
filed by an unauthorised person.
In a case concerning an appeal due the failure to act upon request, when the Commissioner
determines that the appeal or request is grounded, he or she shall instruct the controller by a rulingto act upon that request within a given time limit.
If, following the filing of appeal due to failure to act upon request, and before a decision on
appeal is passed, the controller enables the realisation of right to insight or copy, or decides on therequest, the Commissioner shall stay the procedure on appeal by a ruling.
Procedure on appeal is also stayed when the appellant waives the appeal.
Establishment of the State of Facts in Proceeding upon Appeal
Article 40
Commissioner undertakes actions for establishing the state of facts necessary for deciding
on the appeal.
Commissioner, or person specially authorised by the Commissioner, shall have, in order toestablish the state of facts referred, the right of insight into data or data filing system, except incase referred to in Article 45, paragraph 2 of this Law.

■ 16

Binding Nature and Enforcement of Ruling
Article 41
Commissioner’s ruling on appeal shall be binding, final and enforceable.
If necessary, the Government shall secure the enforcement of Commissioner’s ruling andmay regulate in more detail the manner in which the ruling is to be enforced.

Legal Remedy against Ruling
Article 42
Administrative dispute may be initiated against Commissioner’s ruling.
Other Procedural Provisions
Article 43
Provisions of statute governing general administrative procedure shall apply to appeal
procedure, unless otherwise prescribed by this Law.

V COMMISSIONER
Competence
Article 44
Commissioner:
1) monitors the implementation of data protection;2) decides upon appeal in case prescribed by this Law;3) keeps the Central Register;4) supervises and permits the transfer of data from the Republic of Serbia;
5) points out the observed abuses in data collection;6) compiles the list of states and international organisations with adequate regulations on
personal data protection;7) gives opinion concerning the establishment of new data filing systems or introducing
new information technologies in data processing;8) gives opinion in case of doubt whether a filing system may be understood as a data
filing system in light of this Law;9) gives opinions to the Government in the procedure of adoption of acts on the modes ofarchiving and protective measures of special categories of data;
10) monitors the implementation of data protection measures and proposes the improvementof these measures11) gives proposals and recommendations for the data protection improvement;12) gives prior opinion on whether certain manner of data processing represent specific risks
for rights and freedoms of citizens;13) monitors the organisation of data protection in other countries;■ 1714) cooperates with authorities competent for supervision of data protection in othercountries;15) determines the manner of further data management cases when the controller ceases toexist, except as otherwise provided;16) performs other tasks that fall within his competence.
Commissioner can have a deputy for personal data protection.
Commissioner shall forward the report he/she files to the National Assembly to the
President of the Republic, to Government and Citizen’s Protector and make it available to thegeneral public in adequate manner.
Right of Access and Insight
Article 45
Commissioner has the right of access and insight to:1) data and data filing systems;
2) full documentation regarding the collection of data and other acts of processing, as well
as realisation of data subject's rights in this Law;3) controller's general acts;
4) premises and equipment used by the controller.
Access and insight from paragraph 1 subparagraphs 1) 2) and 4) of this Article may be
restricted if this would seriously jeopardise the interest of national or public security, country's
defence or actions of preventing, detecting, investigating or prosecuting for criminal offences, forthe duration of grounds for restriction, in accordance with law.
If the controller identifies the reason for restriction from paragraph 2 of this Article, he/she
is obliged to request an opinion of The Supreme Court of Cassation on the existence of the reason
for restriction of the Commissioner’s right to access and insight, within eight days from thesubmission of Commissioner’s request.
The President of The Supreme Court of Cassation is obliged to provide an opinion to thecontroller within eight days from the submission of controller’s request from paragraph 3 of this
Article. The controller is obliged to inform Commissioner on the opinion provided by The
President of The Supreme Court of Cassation

VI DATA SECURITY
Confidentiality
Article 46
Commissioner, Deputy Commissioner and employees of expert service shall be obliged tokeep confidential any and all data they learn during their work, in accordance with regulations
governing the confidentiality of data, except as otherwise provided.
Obligations from paragraph 1 of this Article shall be extended even after the termination of
office of Commissioner and Deputy Commissioner, or after the termination of employment in theexpert service.
Controllers are obliged to inform the person processing the data or the person who has
insight into data with measures of confidential data protection.
■ 18

Organisational and Technical Measures
Article 47
Data must be adequately protected from abuse, destruction, loss, unauthorised changes oraccess.
The controller and the processor are obliged to provide necessary organisational andtechnical measures for data protection, in accordance with prescribed standards and procedures,
which are necessary to protect data from loss, destruction, unauthorised access, alteration,
publishing and any other abuse, as well as to prescribe obligation of keeping the confidentiality ofdata for those who work on data processing.

VII RECORD
Record on Processing
Article 48
Controller establishes and keeps record containing the following information:1) type of data and name of data filing system;2) type of processing action;3) name or company name of controller and his address or seat,;4) date of commencement of data processing or of data filing system establishment;5) purpose of personal data processing;6) legal grounds for processing or establishment of data filing system;7) categories of data subjects;8) types and levels of data confidentiality ;9) manner of collecting and preserving of personal data;10) period of time for which the data will be kept or used;
11) name or company name of filing system recipient and his address or seat;12) code of entry, that is transfer of personal data from the filing system across the bordersof the Republic of Serbia together with the name of the state or internationalorganisation and the name of the international recipient, legal grounds and purpose ofsuch entry or transfer;13) undertaken data protection measures ;14) requests concerning the data processing.
Controller shall not be under the obligation to form and keep records of processing of: dataprocessed solely for family or other personal use in terms of provision of Article 5 subparagraph 2of this Law, data processed for the purpose of keeping a register the keeping of which isprescribed by law, data for data filing system comprised solely of published data, and of data
relating to a person the identity of which has not been established, and the controller, processor orrecipient are not authorised to establish such person’s identity.
Controller updates the record in cases of changes concerning basic data referred to inparagraph 1 of this Article within 15 days from the day the change occurs.

■ 19Format for keeping records and manner of keeping records from paragraph 1 of this Article
are prescribed by the Government.

Notification of the Commissioner
Article 49
Before starting the processing and/or establishing the data filing system, controller isobliged to notify the Commissioner of the intention to establish the data filing system, together
with the information from Article 48 of this Law, as well as of any subsequent intended dataprocessing, before assuming the task of processing, at the latest 15 days before the data filingsystem is established.
The obligation of prior notification from paragraph 1 of this Law does not refer to thecommencement of processing or data filing system establishment in case when a special
regulation prescribes the purpose of collecting and processing of data or categories of data being
processed, categories of recipients that will have access to data, as well as the time period forwhich the personal data will be archived.
Prior Verification
Article 50
After receiving notification referred to in Article 49 of this Law, the Commissioner shall,
before the establishment of data filing system, verify those acts of processing that might to aconsiderable extent lead to violation of person's rights.
Manner of verification from paragraph 1 of this Article shall be governed by an
Commissioner’s act.
Obligation of Forwarding
Article 51
Controller forwards to the Commissioner record on data filing system, that is, changes indata filing system at the latest within 15 days from the day of establishment or change.
The notification from Article 49, paragraph 1 of this Law and the records from paragraph
1 if this Article shall be integrated in the Central Register.
Central Register
Article 52
The Commissioner establishes and keeps the Central Register.
The Central Register is composed of the data filing system register and data filing system
catalogue.
Data filing system register contains data from Article 51, paragraph 2 of this Law.
Data filing system catalogue contains the description of recorded data filing systems.
Central register of data filing systems is public and has to be published on the Internet.
Once a year, Commissioner publishes a list of data filing systems in the "Official Gazette of
the Republic of Serbia".

■ 20

Commissioner shall deny the right of insight into filing system record if so requested bycontroller, provided that it is necessary for realisation of prevailing interest of preservation ofnational or public security, country's defence, work of state organs, monetary interest of the state,or provided that law, other regulation or act based on law designate that record on filing system is
kept as a secret.

VIII TRANSFER OF DATA FROM THE REPUBLIC
OF SERBIA
Article 53
Data may be transferred from the Republic of Serbia to a state signatory to the Council ofEurope Convention for the Protection of Individuals with Regard to Automatic Processing of
Personal Data.
Data may be transferred from the Republic of Serbia to a state not signatory to theConvention from paragraph 1 of this Article, or international organisation, if in this state orinternational organisation regulations or contract on transfer provide for a level of data protectionin accordance with the Convention.
Upon the data transfer from paragraph 2 of this Article, Commissioner establishes whether
conditions are met and data security measures undertaken upon data transfer from the Republic of
Serbia and gives permission for transfer.

IX SUPERVISION
Competence
Article 54
Supervision over the implementation of this Law is performed by the Commissioner.
The Commissioner shall perform the tasks from paragraph 1 of this Article throughauthorised persons.
The authorised person is obliged to perform supervision professionally and in due time andto make minutes on supervision performed.
In the performance of supervision, the authorised person acts on the ground of knowledge
acquired ex officio, from the applicant who submitted the appeal or from third party.
In the performance of supervision, the authorised person is obliged to show his or her
official identification. The identification form is regulated by the Commissioner.
Enabling Supervision
Article 55
Persons who, under this Law, have obligations concerning personal data protection are
obliged to enable the inspector to perform supervision without interference and to enable him
insight into all the necessary documentation.

■ 21Commissioner’s Powers in Supervision
Article 56
If it is established in the course of supervision that statutory provisions regulating the dataprocessing were violated, the Commissioner shall warn the controller about the unlawfulness inpersonal data processing.
Based on the authorised person’s findings, the Commissioner may:
1) order the elimination of irregularities within a certain time limit;
2) temporarily prohibit processing of data that is performed contrary to the provisions of
this Law;
3) order the erasure of personal data collected without legal ground.
Appeal against the ruling from paragraph 2 of this Article shall not be permitted; however,administrative dispute may be initiated.
Implementation of measures from paragraph 2 of this Article shall be governed byCommissioner’s act.
Commissioner is obliged to file a petty offence report for violations of provisions of thisLaw.

X PENAL PROVISIONS
Article 57
A fine of from 50,000 to 1,000,000 dinars shall be pronounced for petty offence tocontroller, person processing data or recipient who:
1) processes data without consent contrary to conditions from Article 12 of this Law;
2) processes data contrary to conditions from Article 13 of this Law;3) collects data from third party contrary to conditions from Article 14 paragraph 2 of thisLaw;4) before collection, fails to inform the data subject or third party on conditions Article 15,
paragraph 1 of this Law;
5) processes special categories of personal data contrary to Articles 16 to 18 of this Law6) fails to make data available in the condition they are in contrary to Article 27 paragraph
2 of this Law;
7) fails to issue copy of document contrary to Article 28 paragraph 1 of this Law;8) fails to erase personal data from filing system contrary to Article 36 of this Law;
9) fails to enforce the Commissioner’s ruling on appeal (Article 41 paragraph 1 of thisLaw);10) acts contrary to obligation of confidentiality from Article 46 paragraphs 1 and 2 of thisLaw;11) acts contrary to obligation of taking measures from Article 47 paragraph 2 of this Law;12) fails to establish record or fails to update record contrary to Article 48 paragraphs 1 and
3 of this Law;

■ 2213) fails to notify the Commissioner on the intended establishment of filing system within
the prescribed time limit, contrary to Article 49 paragraph 1 of this Law;14) fails to forward to the Commissioner record on filing system, or changes in data filingsystem in the prescribed time limit (Article 51 paragraph 1 of this Law);
15) transfers data from the Republic of Serbia contrary to Article 53 of this Law;16) fails to enable to authorised person undisrupted supervision and fails to enable him/herto access and dispose of necessary documents (Article 55 of this Law);17) fails to act on the Commissioner’s orders (Article 56 paragraph 2 of this Law).
Entrepreneur shall be punished for petty offence from paragraph 1 of this Article by afine of from 20,000 to 500,000 dinars.
Natural person or responsible person in a legal person, state organ or organ of territorialautonomy or of local self-government unit shall be punished by a fine of from 5,000 to 50,000
dinars.

XI TRANSITIONAL AND FINAL PROVISIONS
Article 58
Provisions of the Free Access to Information of Public Importance Law ("Official Gazetteof the Republic of Serbia", No. 120/04 and 54/07) shall apply to seat, election, termination of
office, status of Commissioner, Deputy Commissioner, professional service, financing and filingof reports.
Article 59
The Commissioner for Information of Public Importance, established by the Free Access toInformation of Public Importance Law ("Official Gazette of the Republic of Serbia", No. 120/04
and 54/07) shall continue to operate under the title of Commissioner for Information of Public
Importance and Personal Data Protection
Article 60
Subordinate legislation based on this Law shall be passed within the time limit of six
months from the entry into force of this Law.
Article 61
Data filing systems and records established by the entry into force of this Law shall be
adjusted to its provisions within twelve months from the entry into force of this Law.
Controllers shall be obliged to submit records from Article 48 to the Commissioner withintwelve months from the entry into force of this Law.
Article 62
On the day of entry into force of this Law the Personal Data Protection Law (“Official
Gazette of FRY”, No. 24/98 and 26/98 - correction) shall cease to be valid
Article 63This Law shall enter into force on the eighth day from the day of being published in the"Official Gazette of the Republic of Serbia", and shall apply as of January 1, 2009.

■ 23