Intellectual Property Law

Bosnia & Herzegovina Protection of Personal Data

By IBLS Editor

Concerns about cybercrime and identity theft lead to the enactment of Bosnia and Herzegovina Law on the Protection of Personal Data 2006, which intends to protect citizens? right to privacy. The law provides for the establishment of an Agency for Protection of Personal Data, which is still in the process of being formed. In the interim, the Ministry of Justice regulates data access control and transfer.  This article provides a synopsis of this privacy law.

The June 2006 Law on the Protection of Personal Data (LPPD) codifies the right to privacy in Bosnia and Herzegovina and was enacted as a response to the problem of cybercrime and identity theft.  It establishes an Agency for Protection of Personal Data (?the Agency?) (Chapter IV, Articles 34 to 47). In the interim, departments of the Ministry of Justice will carry out what will be the Agency?s functions. The Agency will be responsible for ensuring the protection of personal data, which includes supervising the implementation of the Data Protection Law and other personal data processing laws; submitting reports to Parliament; proposing legislation; and giving effect to international agreements.  The Ministry of Justice has issued guidance for data access requests, pending the creation of the Agency.

The LPPD regulates the processing and transfer of data. (Article 12). Cross-border  data transfer is brought into line with international standards under the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, 1981, and protocol regarding supervisory authorities and cross-border data flows. (Article 18). The LPPD applies to all public authorities. (Article 2). A responsible person within the public authority may be fined up to KM $5,000 (Article 52) for a breach.  Personal data may only be processed to the extent necessary for a permitted purpose, and only with consent. (Article 4).The data controller and data processor are required to register with the Agency prior to establishing a database. (Article 14); the maximum penalty for failing to do so is a fine of KM$150,000. (Article 50).

On October 31, 2008 Bosnia and Herzegovina signed a South-East European Cooperation Process (SEECP) Memorandum on Legal and Judicial Guarantees against Unlawful Processing of Personal Data. The SEECP includes a declaration of commitment to enforce basic principles for data protection and to establish an independent supervising authority.

The Agency will also have powers under the Freedom of Information Act 2001 (FOIA), last amended in 2008, which provides for a broad right of access to data held by any public authority. The FOIA requires personal information under control of a public organ to be correct, current and complete. Data subjects can request access to information and amendment of the information. Those who have been denied information by a public body can appeal internally, lodge a complaint with the Ministry of Justice (or, in the future, with the Agency), and challenge the decision in court or lodge a complaint with the Federation Ombudsman. There is no right of appeal against the Agency?s decision as such, but judicial review applications can be made under the Law on Administrative Procedure. (Article 40).

What rights do individuals in Bosnia and Herzegovina have to access personal data?
Data subjects are entitled to receive updates on the progress of data processing and to know the legal basis for its collection and its source. (Article 24). Individuals are entitled to access their personal data upon request. Under article 28, exceptions include national security, professional regulations, and economic grounds. Data access requests may not disproportionately compromise the rights of other individuals. The data controller may refuse a request if he is required to process the data by law, if it has already been published publicly, or if he is processing it exclusively for scientific research or archiving.

How are the data subject?s rights enforced?
When a data subject suspects a breach of his rights has occurred or will occur, he may file a complaint with the Agency, which can require the data to be amended or deleted. (Article 30(1)). A court can award damages (Article 32), even from data controllers, for damage caused by a data processor; also, the court can order a public apology.  (Article 33).

The Agency will have extensive investigative, (Article 41(2)), and enforcement powers, (Article 40), including destruction of data; a ban on processing; and issuing a warning or reprimand. The controller must implement measures ordered by the Agency within 15 days (Article 41(1)). Failure to comply constitutes an offense (Article 49).

What penalties can be imposed on data controllers or processors who violated the law?
Chapter 5 of the LPPD creates a graded series of penalties for offenses, including a fine up to $100,000, e.g., failing to check accuracy (Article 49). The responsible person may also be fined up to KM $15,000 for a violation or KM $10,000 if he is an employee. Certain offenses, such as establishing a data filing system before submitting a request with the Agency (Article 14, Paragraph 2), may result in a fine of up to KM $150,000. (Article 50).

Conclusion:
The Law on the Protection of Personal Data 2006 regulates the right to privacy in Bosnia and Herzegovina. The law provides for the establishment of an Agency for Protection of Personal Data.

Full post as published by IBLS Internet Law Blog on September 16, 2009 (boomark / email).