Does a representative office of a foreign company have a duty to report its data files to the Commissioner's Central Register?

According to Article 3, item 5 of the Law on Personal Data Protection, data controller means a natural person, legal entity or public authority responsible for data processing.

The provisions of Article 574 of the Law on Companies (Official Gazette of RS, Nos. 36/2011 and 99/2011) sets out the following: "A representative office of a foreign company (hereinafter referred to as a "representative office") means a separate organisational unit of a foreign company that may carry out preliminary and preparatory work leading to the conclusion of a transaction by that company. A representative office shall not have legal personality. A representative office may only enter into transactions relating to its current operations. A foreign company shall be liable for any obligations towards third parties that may arise in the operations of its representative office."

From the provisions of the Law on Companies quoted above it follows that a representative office does not have legal personality, which in turn means it cannot be a data controller within the meaning of Article 3, item 5 of the Law on Personal Data Protection. In this specific case it means that the foreign legal entity which formed such representative office, rather than the representative office itself, has the duty to report data files to the Central Register maintained by the Commissioner for Information of Public Importance and Personal Data Protection.