The GDPR has generated a lot of public attention, especially after its adoption in the EU in May last year. Our country has harmonized its legislation with the GDPR in early November. We have talked with Slobodan Kremenjak, Technology, Media and Telecommunications Partner at Živković Samardžić Law Firm, about what awaited companies in the future following the Law on Protection of Personal Data (LPPD) coming into force.
What can we expect to happen following the implementation of the GDPR in Serbia?
— The easiest thing to do is just to translate a directive. However, the problem arises when you have to understand the reasons behind such a directive being adopted by the EU. Harmonization is generally good, and we have to think in the context of these rules being devised with developed countries in mind and about institutional capacities for their implementation. It is important that we therefore work on the digital transformation of society and improving competences. We need to develop bodies and institutions, because without them it would be very difficult to implement a regulation in practice. The problem arises with cross-border and overseas data transfer. It should be noted that we are not in the EU and that, for instance, the EU-US treaties about the protection level do not apply to us. That’s where the problem lies.
Your peers have been talking about the Commissioner for Personal Data Protection being given an extended authority, although the Commissioner’s Office does not have enough capacity to deal with the GDPR provisions. What is your view on that?
— The regulation that was simple has already been harmonized. This is how things are done in the personal data protection segment too because some things were completed almost 10 years ago. Now, we are dealing with details and upgrade that require fine measurements, judgments and capacities. The most important issue now is whether we have the required capacity, because all that is left to do is nuances and I don’t think that we have either knowledge or capacity to do them.
How does all of this affect companies in Serbia? Do they come to you with questions?
— The commotion that the GDPR caused in Europe and the world had somehow spilt over into Serbia too, even before the relevant law was adopted. Companies, especially those that do business with the EU countries, have shown great interest in this topic, because they realized that something serious was happening over there and were informed about possible sanctions. Of course, there will always be large companies targeting the Western market, as well as companies that are part of some international groups that have done more on the harmonization, while small and medium-sized enterprises have been lagging behind a little bit. The institutions play a big role because they should educate people about it. Most of the questions were related to the period before the adoption of laws and harmonization with the GDPR. The most frequently asked questions related to what extent is directive applicable to them, if at all.
What were the reactions to the penalties for not implementing the GDPR being much lower in Serbia than in the EU? What do you think of this decision made by lawmakers?
— Yes, penalties here are much lower than in the European Union. However, what would really cause a problem, also in the EU, would be if you authorized various bodies and institutions to charge those penalties although you are not really sure that they are competent enough to implement the GDPR and determine an adequate penalty. It remains to be seen how ready, trained and capacitated are our authorities to deal with this new and complex regulation and on top of that, determine pretty hefty penalties. The fact that the penalties are much lower here can still cause worry that penalties will not be respected, but on the other hand, it leaves room for the authorities to catch up so that the initial mistakes they make do not have drastic consequences.
MEDIA STRATEGY
Slobodan Kremenjak is probably the only attorney in Belgrade to receive a journalistic award. As an expert on media law, in 2006, he received ANEM’s Lighthouse Ward. Since, he has also been assisting with the development of the Media Strategy, our next question is about the progress made so far with this.
– I started representing the media in Serbia twenty year ago. In fact, we started as attorneys for B92 in the 1990s. Working with journalists is difficult because they don’t trust you that easily, but when trust is established, then it becomes a pleasure to work with them. The whole story about the journalistic strategy is complicated because the previous one expired in 2016, and drafting of a new one has been delayed. There is a public debate about the Draft Strategy, based on which additional corrections are expected to be made. After that, the Strategy is going to be adopted, followed by the adoption of an Action Plan which is important because it prescribes adequate measures and determines who implements them. The key aim of this Strategy is evaluation, or rather facilitating its valuation. Boosting the state’s capacity is very important in this context because oftentimes strategies are never implemented. At the moment, it is important that we regulate the subsidizing of the media.