As part of the horizontal activities of the PLAC III project, an analysis of the alignment of Serbian legislation regulating the processing of personal data through video surveillance with international standards was drafted, with recommendations for improving the legislative framework.
The area of personal data protection falls under the negotiating Chapter 23 (Justice and Fundamental Rights), which, according to the new enlargement methodology, is part of Cluster 1. The EU’s Joint Position with respect to Chapter 23 notes that Serbia should strengthen the regime of basic human rights protection, and, as a part of it, to ensure compliance with EU data protection standards. According to the European Commission, the new Serbian Law on Personal Data Protection, which entered into force in August 2019, is “mainly aligned” with Regulation 2016/679 and Directive 2016/680, which regulate the protection of individuals when it comes to personal data processing and on their free movement. However, it was pointed out that the implementation of the law so far has shown that there are shortcomings, especially when it comes to regulating the field of data collection through video surveillance, so-called CCTV cameras, which led to demands for developing a legal basis for installing such systems in public places.
The main beneficiary institution of the project support was the Ministry of European Integration, but also other ministries covered by the Law on Personal Data Protection. At the workshop held on June 6, the expert of the PLAC III project, Dragan Golubović, presented the results of the analysis of the existing legislative framework, emphasizing that the relevant international standards are also “domestic” standards because they are incorporated into the legal and constitutional order of Serbia.
These are the European Convention on Human Rights (ECHR), the so-called Council of Europe Convention 108 concerning the automatic processing of personal data, as well as its Protocol. Golubović pointed out that the test applied by the ECHR in assessing the legitimate restriction of the right to private and family life and the right to public assembly is especially important. As he said, that test was incorporated in Article 20 of the Serbian Constitution, but also in the Law on Personal Data Protection. The case law of the European Court of Human Rights also applies that test.
Data processing via CCTV by natural and private legal entities is not regulated in Serbia by the Law, but the Law is being applied to all methods of data processing. There are legal gaps and the opinions of the Commissioner for the Access to Information of Public Importance and Personal Data Protection should be a reliable guide, Golubović said. He stated that the Council of Europe has adopted a Guide for the processing of personal data using a face recognition system. As recommendations for improving the legal framework, Golubović mentioned the possibilities of amending the Law on Personal Data Protection, which will regulate basic issues of importance for data processing through “classic” CCTV systems, and amending the Law, which will regulate processing through these systems but with face recognition. As the third option, Golubović mentioned the adoption of the new Law on Personal Data Protection, which will regulate all ways of CCTV data processing, estimating that it is the most rational. He especially emphasized the importance of making an ex ante analysis of legal effects before the adoption of the Law on Internal Affairs.
The workshop was attended by representatives of the Ministry of European Integration, the Ministry of Interior, the Ministry of Human and Minority Rights and Social Dialogue, the service of the Commissioner for Information of Public Importance and Personal Data Protection as well as of the Ombudsman.
