DPO – DATA PROTECTION OFFICER SERVICES PROVIDED BY OUR LAW OFFICE
One of the services we offer our clients is acting as their Data Protection Officer (DPO), both where controllers or processors are required by law to designate a DPO and where they choose to have professional support in complying with personal data protection legislation and the many obligations it imposes. The Board of the Belgrade Bar Association has officially taken the position that acting as a DPO is not incompatible with the practice of law, so there is no legal obstacle to clients engaging lawyers as external DPOs. Such engagements are subject to the statutory requirements concerning the DPO’s independence and the prevention of conflicts of interest.
In addition to helping clients comply with the Serbian Personal Data Protection Law, drafting internal policies and records of processing activities, maintaining those records and providing all types of advice, we also act as formally designated DPOs, including registration in the register of Data Protection Officers kept by the Commissioner for Information of Public Importance and Personal Data Protection.
Within the engagement, we provide expert and advisory support in fulfilling the obligations under the Law, both as an external Data Protection Officer and through separate legal advisory services and assistance in bringing your business into compliance with personal data protection legislation.
Our services include timely information and advice to the controller or processor and to the employees who process personal data. You will also be informed in good time of all amendments to the law, new bylaws, and opinions and guidance of the Commissioner relevant to your business. We communicate with the Commissioner, both at the Commissioner’s request and on other relevant matters, and act as the contact point for the supervisory authority. This includes giving advice on data protection impact assessments where they are required, monitoring their implementation and assisting in their preparation.
When determining whether a data protection impact assessment is required, we analyse the nature, scope, context and purposes of the intended processing, as well as the risks it may pose to the rights and freedoms of individuals. Where an assessment is required, we provide expert support in its preparation and implementation.
If you would like us to act as your Data Protection Officer, please contact us.
WHY YOU SHOULD APPOINT A DATA PROTECTION OFFICER
The General Data Protection Regulation (EU) 2016/679 (GDPR), which has applied since 25 May 2018, established a comprehensive framework for the protection of personal data in the European Union. Its provisions address the territorial scope of data protection legislation, the rights of data subjects, the obligations of controllers and processors, and the conditions under which personal data may be lawfully processed. The GDPR applies directly in the Member States, while national legislation may further regulate certain matters within the limits the Regulation allows.
Serbia’s Personal Data Protection Law, which has applied since 21 August 2019, largely follows the principles and regulatory approach of the GDPR, while establishing a separate legal framework applicable in the Republic of Serbia.
The GDPR provides for substantial administrative fines for infringements of data protection obligations. Depending on the nature of the infringement, fines may reach up to EUR 20 million or 4% of an undertaking’s total worldwide annual turnover in the preceding financial year, whichever is higher. When determining the appropriate fine, supervisory authorities consider factors such as the nature, gravity and duration of the infringement, whether it was intentional or negligent, the categories of personal data affected, previous infringements and cooperation with the supervisory authority.
The Serbian Personal Data Protection Law provides for a separate system of misdemeanour liability, with fines for legal entities ranging from RSD 50,000 to RSD 2,000,000, while the GDPR applies to companies in Serbia where the conditions for its territorial scope are met.
For these reasons, both the GDPR and Serbian law require, or allow, the designation of a Data Protection Officer.
Designating a DPO is mandatory where:
- the processing is carried out by a public authority, except for courts acting in their judicial capacity;
- the core activities of the controller or processor consist of processing operations which, by their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale;
- the core activities of the controller or processor consist of large-scale processing of special categories of personal data, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation, or of personal data relating to criminal convictions and offences.
A group of undertakings may appoint a single DPO, provided that the DPO is easily accessible from each establishment. Public authorities may also designate a single DPO, taking into account their organisational structure and size, and should assess whether one person can perform the role for several bodies or whether more DPOs are needed.
In other cases, controllers and processors may designate a DPO voluntarily. Given the complexity of data protection legislation, we recommend having an internal or external person trained to oversee data protection.
The DPO may be an employee of the controller or processor, or may perform the tasks under a service contract. The DPO is designated on the basis of professional qualities, in particular expert knowledge and experience in data protection law and practice, and the ability to fulfil the statutory tasks.
Under Serbian law, controllers and processors must publish the contact details of their designated DPO and provide the required information to the Commissioner for Information of Public Importance and Personal Data Protection, who keeps the register of Data Protection Officers.
RESPONSIBILITIES OF THE DATA PROTECTION OFFICER
Under Article 39 of the GDPR and Article 58 of the Serbian Personal Data Protection Law, the Data Protection Officer has the following principal responsibilities:
- informing and advising controllers, processors and their employees on their obligations under applicable data protection legislation;
- monitoring compliance with data protection legislation and internal policies, including the allocation of responsibilities, staff awareness and training, and related audits;
- providing advice, upon request, regarding data protection impact assessments (DPIAs) and monitoring their implementation;
- cooperating with the competent supervisory authority and acting as a contact point on matters relating to personal data processing.
In performing these duties, the DPO must take into account the risks associated with processing operations, considering their nature, scope, context and purposes. The DPO performs their duties independently and without a conflict of interest, reports directly to the management of the controller or processor, and may be contacted by data subjects on all matters relating to the processing of their personal data and the exercise of their rights. The controller or processor remains responsible for compliance with applicable legal obligations.
In addition to statutory DPO responsibilities, MILIĆ Legal provides legal assistance in preparing data protection policies, records of processing activities, data processing agreements, data protection impact assessments and other documentation required for compliance with applicable data protection legislation.
Representative in Serbia
Under Article 3(4) and Article 44 of the Serbian Personal Data Protection Law, controllers and processors without an establishment in Serbia must designate in writing a representative in the Republic of Serbia where they process personal data of individuals residing in Serbia in connection with offering them goods or services or monitoring their activities in Serbia.
The Law provides exemptions for occasional processing that does not involve large-scale processing of special categories of data or data relating to criminal convictions and offences and is unlikely to result in a risk to the rights and freedoms of individuals, as well as for public authorities.
MILIĆ Legal assists foreign controllers and processors in assessing their obligations under Serbian data protection law and acts as their designated representative in the Republic of Serbia and as the contact point for the Commissioner and data subjects.
If your business needs data protection advice or an external DPO, our law office can help. We have been practising data protection law for many years. Dragan Milić, attorney-at-law, is an experienced lecturer in personal data protection law and has delivered professional training courses attended by hundreds of Data Protection Officers and other professionals.