Serbian Experience Of The Role Of Data Protection Authorities (DPAS) In Digital Privacy Protection Presented by: Prof. Dr. Popović Date: 1 December 2022 Duty To Establish An Independent Data Protection Authority - A non-binding but unanimous resolution of the UN General Assembly, adopted in 1991, was the first international data protection text to include a requirement of an independent DPA. - As a member of the Council of Europe, the Republic of Serbia ratified the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108) and the Additional Protocol to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, regarding supervisory authorities and transborder data flows (ETS No. 181). - The Republic of Serbia also ratified the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 223), which has not yet entered into force. - Serbia signed the Stabilization and Association Agreement with the EU in 2008. Under Art. 81 of the SAA, dedicated entirely to the personal data protection, Serbia is required to harmonize its legislation concerning personal data protection with EU law and other European and international legislation on privacy upon the entry into force of the SAA. Main Characteristics Of The National Personal Data Protection System - The first attempts to regulate personal data protection in Serbia were made in 1998, when the Law on Personal Data Protection was passed. Unfortunately, that law remained 'dead letter', since only a few marginal cases of attempted application of the law by the data handlers were recorded over a period of ten years of its application. - Serbia adopted its first modern legislative act regulating the personal data protection in 2008 and adopted the Strategy for personal data protection in 2010. Following the entry into force of the 2008 Law on Personal Data Protection, a national DPA was established. - The main piece of legislation currently regulating personal data protection in the Republic of Serbia is the Law on Protection of Personal Data, adopted in November 2018 and applicable since August 2019. Specific rights of data subjects - The national data protection authority responsible for overseeing the implementation of the LPPD is the Commissioner for Information of Public Importance and Personal Data Protection. - Right to be informed; right to access personal data; right to have inaccurate personal data rectified; right to have personal data deleted; right not to be subject to a decision based solely on automated processing, including profiling, if such decision produces legal effects concerning to the data subject or in a similar manner significantly affects the data subject; right to lodge a complaint before the DPA... Main powers, duties and responsibilities of the Serbian DPA - The inspections undertaken by the DPA have proven to be crucial for the efficient enforcement of the LPPD. The inspectors act upon information acquired ex officio or received from complainants. - Certain breaches of law are set out as misdemeanors for which the LPPD prescribes fines. The DPA is authorized to initiate misdemeanor proceedings before the competent court. When the legislator prescribed pecuniary fines for misdemeanors in fixed amounts, the DPA may impose the fines directly. Concluding remarks - The procedure before the DPA represents an efficient mechanism for terminating various offline and online breaches of data protection rules. - The main deficiency of the Serbian personal data protection system that our analysis identified is the inadequate articulation of different protection mechanisms. - There is also a need for better articulation of activities of different national DPAs.