1. TRANSBORDER TRANSFER OF PERSONAL DATA OUT OF THE REPUBLIC OF SERBIA Milica Basta Senior Adviser DPA Serbia Sarajevo 11-12 May 2016

2. GENERAL INTRODUCTION DPA in the REPUBLIC OF SERBIA - COMMISSIONER FOR INFORMATION OF PUBLIC IMPORTANCE AND PERSONAL DATA PROTECTION Established in 2004 - FAI Established in 2004 - FAI Independent body Independent body Status regulated by: Status regulated by:  Law on Free Access to Information of Public Importance (  Law on Free Access to Information of Public Importance ("Of. Gazette RS" No. 120/04, 54/07, 104/09 and 36/10) and  (  Law on Personal Data Protection ("Of. Gazette RS" No. 97/08, 104/09, 68/12 and 107/12) Competences in the field of personal data protection acquired in 2009 Two complementary competences Two complementary competences

3. Article 53 of the Law on Personal Data Protection Transborder transfer of personal data Article 53 of the Law on Personal Data Protection Transborder transfer of personal data Two regimes: Two regimes:  Free transfer to states parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108)  Obtaining Commissioner’s permission for transfer to other states and international organisations

4. Decisions of the Commissioner Decisions of the Commissioner In 2014:  8 transborder transfer permissions  1 request rejected for formal deficiencies  5 proceedings suspended In 2015:  7 transborder transfer permissions  2 proceedings suspended Proceedings are conducted under the Law on General Administrative Procedure (33/97 and 31/01 and 30/10) Proceedings are conducted under the Law on General Administrative Procedure ("Of. Gazette FRY" No. 33/97 and 31/01 and "Of. Gazette RS" No. 30/10)

5. SOLVED CASES PARTICULARITIES SOLVED CASES PARTICULARITIES Countries of destination: United States of America, India, Mexico, China Personal data most frequently transferred: data on employees in multinational companies, data on natural persons cooperating with multinational companies (e.g. in tobacco industry), data on international hotel chains’ guests Most frequent reasons for transfer: HR and other business management, meeting hotel guest’s needs in any country they may stay

6. CIRCUMSTANCES OF TRANSBORDER TRANSFER ESTIMATED BY THE COMISSIONER CIRCUMSTANCES OF TRANSBORDER TRANSFER ESTIMATED BY THE COMISSIONER Commissioner estimates submitted contracts concluded among data exporters and data importers and particularly clauses thereof regulating:  importer’s obligations concerning data security (implementing security measures such as: keeping data in protected premises, passwords providing access only for authorized staff, video surveillance, declarations of confidentiality etc.)  importer’s obligations when the processing is over (e.g. to delete data or to bring them back to the exporter)  applicable law and jurisdiction in case of potential dispute (e.g. law and court of the Republic of Serbia).

7. OBTAINING DATA SUBJECT’S CONSENT OBTAINING DATA SUBJECT’S CONSENT Not the question of transborder transfer, but of the very data processing  when exporting data to controllers or users – consent is needed  for exporting data to processors – consent is not necessary

8. SOLUTION ENSHRINED IN MODEL LAW ON PERSONAL DATA PROTECTION PREPARED BY THE COMMISSIONER Article 74 of the Model Law – General provisions SOLUTION ENSHRINED IN MODEL LAW ON PERSONAL DATA PROTECTION PREPARED BY THE COMMISSIONER Article 74 of the Model Law – General provisions 1. Free transfer to countries and international organizations  which are parties to international agreements ratified by the Republic of Serbia, containing provisions on data exchange  when the transfer is governed by a special law  when the country or international organization ensures an adequate level of personal data protection 2. Transfer upon Commissioner’s permission

9. SOLUTION ENSHRINED IN MODEL LAW ON PERSONAL DATA PROTECTION PREPARED BY THE COMMISSIONER Article 77 of the Model Law SOLUTION ENSHRINED IN MODEL LAW ON PERSONAL DATA PROTECTION PREPARED BY THE COMMISSIONER Article 77 of the Model Law Cross-border transfer of data out of the country without prior Commissioner’s decision authorizing the transfer:  upon consent of data subject, given in writing, after having been informed of the potential consequences of such transfers  when the transfer is necessary in order to save the life or body of the data subject  when data to be transferred are contained in registers or records which are publicly available in accordance with the law.

10. THANK YOU FOR ATTENTION ! THANK YOU FOR ATTENTION ! Contact information: Commissioner for Information of Public Importance and Personal Data Protection Bulevar kralja Aleksandra 15 11 000 Belgrade Serbia E-mail: office@poverenik.rs Telephone: +381 11 3408 900 Fax: +381 11 3343 379office@poverenik.rs