According to the Commissioner, in general, the Draft Law is far below the expected and necessary level and numerous objections may and must be voiced on its subject matter, contents, methodologies, and even elementary nomotechnique.
The Commissioner Rodoljub Sabic has also stated the following regarding only some of them:
"When it comes to the subject matter of the Law, the first thing that one inevitably notices is that little, quite insufficient attention is devoted to the so-called special forms of data processing. Only a few short and unfortunately not very clear provisions are dedicated to some of them (archiving, scientific research, processing of the Unique Citizen ID Number, etc.), however, some forms of processing such as video surveillance or direct marketing have remained unregulated, even though they are very important and even though they have caused a lot of problems in practice in the past.
At the same time, however, quite a lot of space is incomprehensibly dedicated to one single specific form of data processing. In as many as 59 articles of the Draft the processing by the "competent authorities" for the purpose of "prosecution of perpetrators of criminal offences, enforcement of sanctions and protection against threats to public and national security" is exempt from the general protection regime, which is not applicable to it. In addition, the bodies, procedures and actions to which this applies have not been specified, which leaves room for various "creative" interpretations or abuses.
Without prejudice to the importance of public and national security, a more adequate solution might and must have been found. The Law on Personal Data Protection should focus on protecting the rights of citizens, not the security authorities.
The position of the norms of the Draft on the Commissioner’s institution is also interesting and indicative.
The Draft envisages new extensive Commissioner’s obligations, without any assessment of the funds necessary for meeting them. Bearing in mind the current administrative or factual constraints on the Commissioner, it is completely unclear how it is expected for these obligations to be met.
The Draft Law, contrary to all real needs, terminates the function of the Deputy Commissioner for Personal Data Protection, without specifying any argument for that.
Finally, it foresees exceptionally rigid limitations as to the Commissioner’s personality that are not foreseen for any public official in our legal order. Thus, inter alia, the Commissioner would be prohibited from being a member of any association, which is not only unprecedented, since the Commissioner would be the only banned person in Serbia, but also quite absurd, since he could not be a member of the association of lawyers, philatelists, numismatists, animal lovers, while ignoring the "minor matter" that such a ban is directly contrary to Article 55 of the Constitution.
The prohibition of political activity (not membership in a political party) that could also relate to, for example, the promotion of privacy or transparency as a society's policy, is too wide-ranging and obviously subject to abuse for the purpose of influencing the independency of the authority.
The main problem is that the Draft Law is for the most part only a translation of the provisions of the General Data Protection Regulation 2016/679. These provisions have been copy-pasted without a critical assessment and the necessary adjustment to the Serbian legal system and institutes. Even though the General Regulation allows, or stipulates the possibility to choose solutions, the Draft does not opt for a concrete solution, e.g. the provisions on certification do not stipulate which of the two models from the General Regulation is applicable, i.e. whether the certification is performed by the Commissioner or some kind of a "certification body".
The Draft Law introduces the notion of a "complaint" filed with the Commissioner, leaving it completely unclear what kind of an instrument it actually is, since there is no clear distinction between a formal statutory instrument (appeal against the first instance decision) and an informal instrument (application, report, etc.) by which a potential violation is reported. Of course, it is not only a matter of terminological imprecisions, but also of important differences that determine suitably regulated proceedings instituted upon these instruments, including administrative, administrative -judicial, and judicial proceedings.
Certain provisions of the General Regulation, such as the provisions on legal remedies or judicial protection, have not even been accurately transposed. Examples include provisions allowing "an effective legal remedy" against the supervisory authority, i.e. Commissioner, for entities not covered by the General Regulation, i.e. the controller and processor, which practically means the first instance authority. It is unclear what this actually means. However if it means the application for instituting an administrative dispute before the competent court, it is inadmissible in the Serbian legal system.
The Draft Law contains other non-applicable provisions, such as those that "authorize" the Commissioner to impose a fine for a misdemeanor based on a notice of violation. According to the Law on Misdemeanors, a notice of violation is issued only if a fixed amount is foreseen for a misdemeanor, which is obviously not the case, and, above all, the Commissioner does not have the authority to conduct misdemeanor proceedings.
A significant number of articles of the Draft Law contain long and difficult to understand norms 10 or more paragraphs long, making them difficult to understand even for persons familiar with the subject matter. The first sentence in Article 40 of the Draft Law which reads as follows: "Rights and obligations under Articles 21, 23, 24, 26, Articles 29 - 31, Article 53 and Article 5 hereof, to the extent to which the provisions of Article 5 relate to the exercise of rights and compliance with obligations under Articles 21, 23, 24, 26, Articles 29 - 31, Article 33 and Articles 33 - 39 hereof, may be restricted by law if those restrictions do not affect the essence of fundamental rights and freedoms and, if necessary, constitute a proportionate action in a democratic society for the purpose of ... collecting claims in civil matters. " is a typical, though, unfortunately, not the only example."
