GENERAL DATA PROTECTION REGULATION (EU) 2016/679 (GDPR)
The European Parliament and the Council adopted Regulation (EU) 2016/679, known as the General Data Protection Regulation (GDPR), on 27 April 2016. The Regulation entered into force on 24 May 2016 and has been applicable since 25 May 2018. It replaced Directive 95/46/EC and introduced a more comprehensive framework for the protection of personal data.
Compared with the previous framework, the GDPR introduced a number of new terms and concepts, such as pseudonymisation, biometric data and the main establishment of a controller or processor.
Given the complexity of the subject and of the Regulation itself, whose implementation requires professional expertise and a high level of responsibility, the GDPR introduced the role of the Data Protection Officer (DPO), who advises the controller or processor and monitors compliance. Appointing a DPO is mandatory for public authorities and bodies, except for courts acting in their judicial capacity, and for controllers and processors whose core activities consist of large-scale, regular and systematic monitoring of individuals, or of large-scale processing of special categories of personal data or data relating to criminal convictions and offences.
Unlike the Directive it replaced, the Regulation is binding in its entirety and directly applicable in all Member States, and national laws must not conflict with it. At the same time, it leaves Member States room to regulate certain issues in more detail, for example processing in the employment context or for journalistic purposes, without affecting its basic principles.
Article 3 determines the territorial scope of the GDPR. Where personal data are processed in the context of the activities of a controller’s or processor’s establishment in the EU, the Regulation applies even if the processing takes place elsewhere. It may also apply to particular processing activities of controllers or processors based in Serbia without an EU establishment, where those activities relate to offering goods or services to individuals who are in the EU, or monitoring their behaviour within the EU. Under this latter criterion, the individuals’ nationality is not decisive. The mere accessibility of a website from the EU does not, by itself, establish that goods or services are being offered to individuals there.
GDPR PREAMBLE: WHY IT MATTERS
The preamble of the GDPR, consisting of 173 recitals, is essential for a better understanding of the Regulation’s text and its more precise application, as well as of the reasons why the Regulation was adopted and the principles and values it protects. A regulation of general application in such an important area, with fewer than a hundred articles, cannot formulate every rule simply and precisely for everyone who must apply it. The preamble therefore plays a large part in interpreting the GDPR correctly.
At its beginning, the preamble refers to Article 8(1) of the Charter of Fundamental Rights of the European Union and Article 16(1) of the Treaty on the Functioning of the European Union, and confirms that the protection of natural persons in relation to the processing of personal data is a fundamental right. The rules on the protection of personal data must respect individuals’ fundamental rights and freedoms, whatever their nationality or residence. In this way, the authors of the Regulation link it to other relevant acts and give it legitimacy.
The preamble then addresses limits on the right to the protection of personal data where other interests prevail. This right is not absolute: it must be considered in relation to its function in society and balanced against other fundamental rights, in accordance with the principle of proportionality. The Regulation respects the fundamental rights, freedoms and principles recognised in the Charter of Fundamental Rights of the European Union, in particular respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.
The preamble also clarifies the personal scope of the Regulation: its protection applies to natural persons, whatever their nationality or place of residence, and it does not cover the processing of data concerning legal persons, including their name, legal form and contact details. Contact details of a company, such as its general email address or telephone number, are therefore outside the scope of the GDPR, unlike data that identify an individual employee. The Regulation also does not apply to processing carried out by a natural person in the course of a purely personal or household activity.
The preamble further provides that the competence of supervisory authorities does not cover the processing of personal data by courts acting in their judicial capacity, in order to safeguard the independence of the judiciary. The Regulation itself still applies to such processing, and only the competence of supervisory authorities is excluded (Article 55(3)). Such processing is therefore not left outside the law: its supervision may be entrusted to specific bodies within the judicial system, which should also raise judges’ awareness of their obligations under the Regulation.
An important part of the preamble concerns deceased persons. Since the text of the Regulation does not address this question, the preamble clarifies that the Regulation does not apply to the personal data of deceased persons, while Member States may provide rules on such processing.
As regards children’s consent, Article 8 of the Regulation applies where processing is based on consent in relation to information society services offered directly to a child. Such processing is lawful where the child is at least 16 years old, while Member States may provide by law for a lower age, provided that it is not below 13 years. Where the child is below that age, processing is lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility, and the controller must make reasonable efforts to verify this, taking into account available technology. The Serbian Law on Personal Data Protection sets the age limit at 15 (Article 16). The preamble adds that children merit specific protection, as they may be less aware of the risks, consequences and safeguards concerned and of their rights in relation to the processing of personal data. Such protection should apply in particular to the use of children’s personal data for marketing or for creating personality or user profiles, and to the collection of their data when using services offered directly to a child. The consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child.
As regards the right to be forgotten, the Regulation provides that the data subject has this right, among other cases, where the data are no longer necessary for the purposes for which they were collected or otherwise processed. The preamble also refers to other grounds: where the data subject has withdrawn consent and there is no other legal ground for the processing, where the data subject has objected to the processing and there are no overriding legitimate grounds for it, or where the processing otherwise does not comply with the Regulation. The right is not absolute: Article 17(3) sets out exceptions, for example where processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest in the area of public health, for archiving, research or statistical purposes, or for the establishment, exercise or defence of legal claims. This right is particularly relevant where the data subject gave consent as a child, without being fully aware of the risks involved, and later wants to remove such personal data, especially from the internet. To strengthen the right to be forgotten online, a controller who has made personal data public and is obliged to erase them should inform other controllers processing such data to erase any links to, or copies or replications of, that data. In doing so, the controller should take reasonable steps, including technical measures, taking into account available technology and the means available to it. This is not an easy task, but it contributes to a higher level of protection of individuals.
The Regulation also provides that, if the controller cannot identify the data subject from the data it processes, it is not obliged to obtain additional information in order to identify the data subject. The preamble adds that the controller should not refuse to take additional information provided by the data subject in order to support the exercise of his or her rights. Identification should include digital identification of the data subject, for example through an authentication mechanism such as the same credentials the data subject uses to log in to the online service offered by the controller. In practice, a verification code or link may also be sent to an email address or phone number, bearing in mind that this confirms control over that address or number, not necessarily the identity of the individual.
GDPR PREAMBLE AND SPECIAL CATEGORIES OF PERSONAL DATA
The preamble includes in the special categories personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms, as their processing could create significant risks to those rights and freedoms. These include, among others, personal data revealing racial or ethnic origin. The processing of photographs should not systematically be considered processing of special categories of personal data: photographs are covered by the definition of biometric data only when processed through specific technical means allowing the unique identification or authentication of a natural person, as is the case with online platforms that use software to recognise people in photos. Processing of special categories of personal data is in principle prohibited, unless one of the specific cases set out in the Regulation applies. Member States may lay down specific provisions in order to comply with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The prohibition may also be lifted where the data subject has given explicit consent that meets the conditions for its validity.
The preamble further states that derogations from the prohibition may be allowed for health purposes, including public health and the management of health-care services, in particular to ensure the quality and cost-effectiveness of the procedures used for settling claims for benefits and services in the health insurance system, and for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
A derogation should also allow the processing of such personal data where this is necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.
DATA PROTECTION IMPACT ASSESSMENT IN THE PREAMBLE
Under Article 35(1), a data protection impact assessment is required where processing is likely to result in a high risk to the rights and freedoms of natural persons. The preamble explains, through examples, when such an assessment should be carried out. It should in particular apply to large-scale processing operations which aim to process a considerable amount of personal data at regional, national or supranational level, which could affect a large number of data subjects and which are likely to result in a high risk. An impact assessment is also required where a systematic and extensive evaluation of personal aspects, including profiling, is used as the basis for decisions that produce legal effects concerning individuals or similarly significantly affect them, and where special categories of personal data, such as biometric data, or data relating to criminal convictions and offences are processed on a large scale (Article 35(3)).
An impact assessment is also required for the systematic monitoring of publicly accessible areas on a large scale, especially when video cameras are used.
LEGITIMATE INTERESTS AS A LEGAL BASIS FOR PROCESSING IN THE PREAMBLE
The Regulation sets out several legal bases on which processing is lawful: consent, the performance of a contract, compliance with a legal obligation, the protection of vital interests, the performance of a task carried out in the public interest or in the exercise of official authority, and legitimate interests. Although legitimate interests are one of the most important and most flexible legal bases, the 99 articles of the GDPR do not define the term, which leaves room for interpretation and legal uncertainty. The preamble, however, addresses this legal basis in some detail. It states that the legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller. Such a legitimate interest could exist, for example, where there is a relevant and appropriate relationship between the data subject and the controller, such as where the data subject is a client of the controller or in its service. In any case, the existence of a legitimate interest requires careful assessment, including whether the data subject can reasonably expect, at the time and in the context of the collection of the personal data, that processing for that purpose may take place. The interests and fundamental rights of the data subject may in particular override the interest of the controller where personal data are processed in circumstances in which data subjects do not reasonably expect further processing. The preamble also clarifies that public authorities should not rely on legitimate interests for processing carried out in the performance of their tasks.
The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the controller, and the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest, subject to the data subject’s right to object to such processing at any time.
GDPR AND COMPANIES IN SERBIA
Serbia is not an EU Member State, and personal data processing in Serbia is primarily governed by the Serbian Law on Personal Data Protection (ZZPL). However, the GDPR may also apply to particular processing activities of controllers and processors based in Serbia where the criteria in Article 3 are met. In that case, a controller or processor without an EU establishment will, as a rule, also have to designate a representative in the EU (Article 27). The GDPR recitals are not part of Serbian legislation, but they may serve as a comparative interpretive aid for domestic provisions based on GDPR concepts, including those concerning legitimate interests.
If you need to assess whether the GDPR applies to your company, or to align your processing with the GDPR and the Serbian Law on Personal Data Protection, see our GDPR Compliance in Serbia service.