The new Law on Personal Data Protection in Serbia has been adopted in November 2019. However, this Law as such does not regulate sectoral issues, so it was necessary to develop a number of additional legal acts that would also regulate the important specifics that the Law failed to prescribe. Therefore, in the last few years, there has been intense talk about the need to adopt the Strategy on Personal Data Protection, which would set a strategic framework i.e. the direction in which further regulatory and practical changes in the privacy field should be developed.
Partners Serbia are participating in this process, by being included in the Working Group for the development of the Strategy on Personal Data Protection. By being included in this process, Partners Serbia got the opportunity to propose a set of different activities that should be included in the Action Plan for the implementation of the Strategy on Personal Data Protection. The proposals were made based on the information obtained from organizations that provide direct support to members of vulnerable groups whose privacy has been violated, the expertise of Partner Serbia in this area, information from the Commissioner’s website and analysis of the database of privacy violations in Serbia.
With regards to the improvement of the legal framework in this area, the consortium of civil society organizations proposed amendments to the Criminal Code of Serbia, specifically the article regulating the unauthorized collection of personal data. In this regard, it is necessary to ensure better judicial protection of victims, harsher punishments in cases where privacy violations occur, as well as give broader powers to the Commissioner for Information of Public Importance and Personal Data Protection.
it is also necessary to harmonize the existing legal framework of the Republic of Serbia with the Law on Personal Data Protection and to improve the Law on Public Informing and Media, in order to prevent and adequately sanction violations of privacy committed through the use of the media. It is also necessary to find better legal solutions to protect the privacy of victims of trafficking, especially during court proceedings in which these persons appear as victims or witnesses, including organizations that provide legal assistance or support to victims of trafficking and violence.
On the other hand, in order to improve the institutional framework in this area, it is necessary to establish regional offices of the Commissioner’s Office throughout Serbia, in order to ensure a better territorial coverage and easier access to justice for local people. Also, it is necessary to organize trainings for the employees of the Commissioner on new tendencies in the field of personal data protection and to organize specialized trainings on personal data protection in the application of new technologies and artificial intelligence. It is also very important to improve cooperation with institutions dealing with the protection of personal data in other countries, as well as international organizations. The Commissioner should also be given a more active role in prosecuting perpetrators of privacy violations.
It is also crucial to establish an obligation for all foreign companies operating in Serbia to determine a representative in charge of personal data protection, as well as to create guidelines for the development of the study on personal data protection impact assessment, guidelines for personal data protection of victims of trafficking during court proceedings etc.
Guidelines are also necessary for workers in the social welfare system, who very often handle a large amount of personal data, in order to be trained for this kind of work and to take appropriate protection measures when handling personal data of a wider number of beneficiaries. It is also necessary to establish disciplinary responsibility of employees and responsible persons if violations of privacy in the social protection system occur.
It is also very important to improve the capacity of public prosecutors, judges and police officers who are working on privacy violation cases (both in civil and criminal proceedings), so that they are trained to adequately protect the privacy and do not contribute to further victimization of participants in these types of proceedings.
Also, it is fundamentally important to further raise citizens’ awareness about the importance of privacy and personal data protection, through various workshops with young people and members of marginalized groups, by conducting educational campaigns with national frequency on the importance of privacy and trainings for media representatives on how to act in such situations. It would also be quite useful to develop a short guide to the application of the Code of Journalists of Serbia in the field of media reporting, where the right to privacy would be explained in more detail. In addition to the right to privacy, it is necessary to conduct various educational campaigns for citizens on the responsible use of artificial intelligence and new technologies and rights regarding the protection of personal data in artificial intelligence systems.
The Law on Personal Data Protection itself represents a major step forward in improving the right to protection of privacy of Serbian citizens. However, the Law alone is not enough. Therefore, it is necessary to continuously work on improving the situation in this area, both through changes in sectoral laws that would regulate the field of personal data protection in more detail, and through the adoption and adequate implementation of the Strategy on Personal Data Protection.