In connection with the announced opening of the National Hotline for Child Internet Safety, the Commissioner for Information of Public Importance and Personal Data Protection sent a letter to the Minister of Trade, Tourism and Telecommunications.

The Commissioner has no intention of questioning the appropriateness of the measures undertaken by the government to ensure maximum online safety for children; indeed, he praises the importance of such measures. However, with this in mind, he believes it is paramount to approach these matters with utmost seriousness and responsibility, which implies compliance with the Constitution and the laws and creating as few risks for legal certainty and as little additional confusion as possible in an already inconsistent existing legal framework for personal data protection.

The Regulation on the Safety and Protection of Children in the Use of Information and Communication Technology, on which the Hotline is based, was adopted without consulting the Commissioner for opinion, which is mandatory in such matters in accordance with the Rules of Procedure. If such opinion had been sought, the Commissioner would have already highlighted a number of contentious issues.

As an example, the following issues arise in this context: whether child protection and safety, as one of the society’s highest values, can indeed be based solely on secondary legislation, in the absence of a relevant law (e.g. the Law on the Rights of the Child, the enactment of which has been announced on many occasions in recent years); whether it is appropriate to stipulate that, even though competent government authorities exist, reports of elements of criminal offences are to be filed with the Ministry of Trade, Tourism and Telecommunications, rather than the Ministry of Interior or the Public Prosecutor’s Office; whether the Serbian Ministry of Interior would be a more “natural” setting for such a hotline at this moment; whether it is redundant to provide information on filed reports to the Cyber Crime Department of the Ministry of Interior РС (even if that is not the Department’s actual name), when this will already have been done by the Public Prosecutor’s Office after receiving the report; whether Article 7 of the Regulation adds new powers to centres for social work (which are ill-prepared for such additional workload) etc.

Although this is not explicitly stated in the Regulation, the activities of the Hotline necessarily imply robust processing of personal data with regard to the receipt of reports “using an electronic form on the website”, which will almost certainly include medical information and personal data of children as victims of violence, even though these data are identified by the law as particularly sensitive and can be processed only on the basis of written consent of the data subject given in the form required by the law. Furthermore, the existing the Law on Personal Data Protection does not recognise online consent given through clear affirmative action as an explicit statement of the data subject’s will (by clicking commands such as Accept, I Agree etc.), which has been identified by the Commissioner as an issue and which he sought to address by calling for urgent passing of a new law.

Under the said Regulation, the Government put the Ministry of Trade, Tourism and Telecommunications in the position of a data controller (within the meaning of the Law on Personal Data Protection) and, within the framework of the stipulated “cross-departmental cooperation”, it also identified the recipients of the data thus collected, although the said Law clearly provides that a data recipient must be a person or entity “authorised to use personal data under the law or on the basis of the data subject’s consent.”

The Constitution explicitly provides that personal data processing must be governed exclusively by a law, rather than secondary legislation. There is also a decision of the Constitutional Court which upheld the position that collecting, keeping and use of personal data can only be governed by a law. It is incompatible with these provisions for the Government to assume the role of the legislator and to include provisions in a Regulation that go beyond what is provided for by the law or regulate the same subject matter differently. When it chooses to do so, this causes harm both in terms of additional legal uncertainty and in terms of spending of financial resources earmarked for implementing such “arrangements.”