The current version of the Personal Data Protection Act (the “Act”), with minor changes, has been in force as of 2009, and was amended in 2009. Even though it has introduced many novelties, a number of its provisions proved to be impractical and were not fully compliant with the EU Data Protection Directive.
In order to harmonize the Serbian legal system with the EU standards, the Serbian Ministry of Justice released at the end of 2015 a Draft Personal Data Protection Act (the “Draft”) which foresees significant changes of the current provisions – among others, the transfer of personal data from the Republic of Serbia.
In short, the Draft significantly simplifies the transfer of personal data abroad by abolishing the current provision which requires the Serbian Commissioner’s for Personal Data Protection (the “Commissioner”) authorization for any transfer of personal data to a country which is not a signatory of the European Council Convention.
Under the Draft, personal data can be transferred abroad when the transfer is determined by law (i.e. any law), bilateral treaty or multilateral data protection treaty. In any case, transfer of personal data is allowed if, among other: (i) the data subject’s consent is obtained, (ii) the transfer is necessary for implementation of an agreement between a data controller and data subject, (iii) the transfer is based on an agreement between the controller in Serbia and a controller, processor or recipient based abroad – provided that the contract is governed by the Serbian law. In these situations a controller is required to notify the Commissioner and the data subject that the data have been transferred.
Therefore, a controller will not be required to obtain approval from the Commissioner for the transfer of data, opposite to what is currently prescribed by the Act.
On one hand, abolition of the Commissioner’s approval will simplify the current tedious and time-consuming procedure, on the other, it could lead to transfer of data to the countries that do not offer adequate level of protection of personal data without any guarantee that the importer will ensure protection of data in accordance with the Serbian law.