Pursuant to the provisions of Article 56 of the Law on Personal Data Protection (“Official Gazette of the RS”, No. 87/2018 of 13 November 2018; hereinafter: the LPDP), the Controller and the Processor of personal data ARE OBLIGED to appoint a Data Protection Officer in the following cases:
- If processing is carried out by a public authority, except where processing is carried out by a court acting in the exercise of its judicial authority. A “public authority” means a state authority, an authority of territorial autonomy and a local self-government unit, a public enterprise, an institution and other public service, an organization, or any other legal or natural person exercising public powers.
- If the core activities of the controller or processor consist of processing operations that, by virtue of their nature, scope, and/or purposes, require regular and systematic monitoring of a large number of data subjects.
- If the core activities of the controller or processor consist of the processing of special categories of personal data (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation), or of personal data relating to criminal convictions, criminal offences and security measures, provided that such processing is carried out on a large scale.
Data Controllers and Processors who are required to appoint a Data Protection Officer and fail to do so commit a misdemeanor punishable by a fine ranging from RSD 5,000 to RSD 2,000,000, depending on whether the Data Controller or Processor is a legal entity, an entrepreneur or a natural person. In addition, the responsible person in the legal entity, state authority, authority of territorial autonomy or local self-government unit, branch or representative office of a foreign legal entity shall also be punished.
All other Data Controllers and Processors ARE NOT OBLIGED, but MAY appoint a Data Protection Officer.
Each Data Controller or Processor who is required or who chooses to appoint a Data Protection Officer shall appoint only ONE natural person, and not several.
This clearly follows from the LPDP as well as from the EU General Data Protection Regulation, which served as the basis for the adoption of the national law, not only because the noun “person”, i.e. “officer”, is used in the singular in both texts, but also because of the attributes linked to the position of these persons within the organization (expressed independence and direct accountability to the Head of the Data Controller or Processor, i.e. the highest level of management), which would lose their importance and meaning if they were linked to several different natural persons.
Naturally, the above does not exclude the possibility of establishing a team of data protection experts who, for organizational or other practical reasons, may provide support to the appointed Data Protection Officer. The decision to establish such a team must be the result of a prior assessment by the Data Controller or Processor, taking into account the scope and types of personal data processing, the scope and complexity of overall business processes, the number of employees, the complexity of the organizational structure, financial capabilities, etc. In any case, if a support team is established, the roles and responsibilities of its members (who are not Data Protection Officers) should be clearly defined, just as the LPDP and the GDPR define them with regard to the Data Protection Officer.
Moreover, when a group of undertakings appoints a common Data Protection Officer (which it is entitled to do provided that the officer is equally accessible to each member of the group), this is again ONE natural person, as is the case where Data Controllers or Processors acting as public authorities or competent authorities assess that it is appropriate to appoint a single common Data Protection Officer, taking into account the organizational structure and size of those public authorities.
All those who APPOINT a Data Protection Officer, including those who are not required to do so under the LPDP, ARE OBLIGED to:
- Publish the contact details of the Data Protection Officer, and
- Submit them to the Commissioner.
Failure to do so constitutes a misdemeanor punishable by a fine of RSD 20,000, RSD 50,000, or RSD 100,000, depending on the same criteria applicable to the offence of failing to appoint a Data Protection Officer.
Based on the submitted data, the Commissioner keeps a Register of Data Protection Officers, which contains: – the first and last names of Data Protection Officers, – their contact details, and – the names and contact details of the controllers or processors.
The form and method of keeping the Register of Data Protection Officers are prescribed by the Rulebook on the Form and Method of Keeping the Register of Data Protection Officers (“Official Gazette of the RS”, No. 40/2019), an integral part of which is a form of the following content:
The data forming part of the Commissioner’s register shall be submitted by the Data Controller or Processor at their discretion, in one or more of the prescribed ways:
- in writing, in person;
- by post; or
- by email to: licezazastitu@poverenik.rs
Submission of such data to office@poverenik.rs, or to any other email address of the Commissioner, IS NOT IN COMPLIANCE with the adopted Rulebook.
One of the basic obligations of the appointed Data Protection Officer is to cooperate with the Commissioner, to serve as the CONTACT POINT for cooperation with the Commissioner, and to consult with the Commissioner on matters relating to processing, including notification and obtaining opinions in relation to conducted data protection impact assessments of intended processing operations.
For the above reasons, it is VERY IMPORTANT that Data Controllers and Processors, after appointing a Data Protection Officer, submit to the Commissioner valid and usable official contact details of the officer (official telephone number, official email address, address of the registered office of the legal entity, and not a private residential address), so that, if necessary, communication can be established in the fastest and most efficient manner.
The above recommendations imply:
- opening a separate email account for the Data Protection Officer, and NOT using or submitting to the Commissioner a general contact email address or an email address used by multiple persons or persons whose correspondence is not related to data protection duties;
- providing a separate mobile or landline telephone number for the Data Protection Officer or, alternatively, a switchboard number with an extension enabling direct contact, and NOT providing a general contact number through which all external persons communicate with the Data Controller or Processor, or a switchboard number where one must wait for a free line, or where an answering machine plays lengthy announcements about products, services or other business information.
For all other important facts not covered by this text and relating to the appointment, position, and obligations of the Data Protection Officer, please refer to the statutory provisions, in particular Articles 56, 57, 58, and 95 of the LPDP.
Note:
If a Data Controller had, prior to the commencement of application of the Law, already designated a person to perform certain tasks in the field of personal data protection (for example, in relation to data processing or handling requests of data subjects), there is no obstacle to designating the same person under the Law on Personal Data Protection, provided that the conditions prescribed by the Law are met. The Data Controller or Processor is obliged to notify the Commissioner in accordance with the above.
At this point, we also recommend that you familiarize yourself with:
General Data Protection Regulation (GDPR)
Article 29 Working Party Guidelines on Data Protection Officers
Commissioner for Information of Public Importance and Personal Data Protection
Milan Tomanović – Data Protection Officer appointed by the Commissioner
Bulevar kralja Aleksandra 15, Belgrade
Tel: +381 11 3408 900
Email: lzzpol@poverenik.rs
The Data Protection Officer appointed by the Commissioner performs the duties prescribed by Article 58 of the Law on Personal Data Protection (“Official Gazette of the RS”, No. 87/2018 of 13 November 2018), which include, inter alia, informing and providing opinions to the Commissioner and its employees on statutory obligations relating to personal data protection.
The Data Protection Officer appointed by the Commissioner does not provide legal advice to other controllers or to natural persons who the Commissioner does not employ.
