The Personal Data Protection Bill brings in nearly a decade of long-awaited European standards and significantly stricter penalties for data misuse, but at the same time leaves unclear relations within the Agency for Personal Data Protection and Free Access to Information and raises the question of whether the institution that protects privacy will continue to do so to the detriment of the public's right to know.
This was stated by an expert for personal data protection and free access to information in a statement for "Vijesti". Radenko Lacmanović, who believes that the new regulation is more a result of Montenegro's obligation to harmonize its legal framework with the acquis communautaire than of the state's real determination to provide citizens with adequate privacy protection.
On August 7, the government approved the Bill and submitted it to the Parliament with a suggestion that it be adopted as a matter of urgency. The regulation introduces the right to delete data, or the “right to be forgotten”, the possibility of compensation for material and non-material damage if citizens’ rights are violated, the obligation to report data leaks, as well as administrative fines that can reach two million euros for the most serious violations for companies.
Lacmanović believes that the fact that such a regulation has been awaited for almost ten years is an indicator of the institutions' attitude towards this area.
"Citizens do not have a developed awareness of the importance of protecting their personal data and readily give it away anywhere and to almost anyone who asks for it, just to complete even the smallest task more easily and quickly. Also, state bodies and institutions perceive personal data as a consumable commodity, which should be used whenever you need it and to the extent that guarantees easier achievement of the desired goal," he warns.
If the attitude towards privacy had been different, he adds, Montenegro would not have "waited almost a decade" to align its legislation with the EU's General Data Protection Regulation - GDPR, nor would it have been "the last country in the region to do so."
Right?
Lacmanović considers the criteria for selecting the president and members of the Agency Council to be particularly problematic.
The proposal requires that the candidate have professional knowledge and experience in the field of personal data protection. However, knowledge in the field of free access to information is not required, although the same Agency decides on this right.
"They are required, among other things, to have knowledge in the field of personal data protection, but not the right to free access to information, although they should also decide on this constitutional right, as a second-instance body," says Lacmanović.
This, in his opinion, opens up another question - how many people outside the Agency itself can actually prove the required experience.
"The question arises as to how many people outside the Agency have knowledge about personal data protection, so there is a justified fear that the circle of those who can apply for these positions is being deliberately narrowed," he warns.
For the director, the criteria, he says, are further narrowed by the requirement that the candidate must have a law degree.
"That is strange considering that the Council is supposed to decide on citizens' rights and possible violations. It would be more logical and justified if this condition were prescribed for the president and members of the Council," Lacmanović said.
Who mows, and who carries water
Lacmanović emphasizes that the main "flaws" of the Proposal relate to the Agency itself. The first weakness, he points out, is the insufficiently demarcated responsibilities of the Council and the Director.
"The weaknesses of the text in question primarily relate to the completely unregulated responsibilities between the Council and the Agency's director. Considering the ten-year experience in the Agency's work and the problems that have arisen in the relationship between the Council and the director, I expect that this ambiguity will be further deepened," he warns.
According to him, the only clearly defined competence of the Council in the Proposal is contained in Article 66 and refers to the obligation to submit an annual report to the Parliament, or more frequent reporting when there are special reasons for it.
He considers such a solution insufficient, given the institution's previous experiences. Lacmanović also points out that it is "symptomatic and unusual" that the same length of mandate is prescribed for the members of the Council and the director.
"It is also interesting that the existence of a deputy director is foreseen, but not the conditions for that position, who appoints and dismisses him, what his responsibilities are...", he warns.
In his opinion, new supervision rules could also cause problems. The previous controllers should become inspectors, but Lacmanović estimates that it remains to be seen what this change will mean in practice.
"The deadline for deciding on a request for protection of rights has been significantly extended, and what's worse, it is not clear who makes the final decision," he warns.
He also considers the criteria for selecting inspectors problematic.
"They require a high level of education, without specifying the level or work experience in which field, so there is a real danger that the head of the agency is given too much freedom to creatively interpret who meets the requirements to be hired," says Lacmanović.
Because of all this, he believes that the Proposal should be improved with amendments before adoption.
"This will not jeopardize any of the GDPR compliance obligations, as it allows member states to regulate the internal organization of the supervisory authority themselves," Lacmanović said.
Two agencies instead of one?
Lacmanović believes that in the long term, a more fundamental reform of the Agency should be considered. One possibility is for it to be managed by a separate body, instead of the current model of a Council and a director.
"This way, the conflict between the two bodies, which has been going on since the establishment of this institution, would be avoided," he said.
Another option is to split the current Agency into two institutions - one for personal data protection and the other for free access to information. Lacmanović cites Croatia as an example, assessing that such a split would not necessarily generate additional costs, as employees would continue to work in the areas they previously worked in.
Behind this proposal, however, he sees an essential question: can one institution equally protect two rights that in practice are often on opposite sides of the scale.
"This approach could be justified, because usually such institutions, which are supposed to decide on the balance between two rights, give priority to the one that first fell under their jurisdiction," says Lacmanović.
He believes that this is exactly what has already happened in Montenegro.
"This is the case with our Agency, which usually sides with the protection of personal data and thus threatens the public's right to know," Lacmanović concludes.
Fines will "sober up" both citizens and data controllers
Despite the criticism, Lacmanović believes that the Proposal should be supported because it brings a number of important innovations. He particularly highlights the penal policy, which has attracted the most attention due to the amount of up to two million euros.
"The penal provisions have, as expected, attracted the most attention, because they are unusually high for our circumstances. However, it should be remembered that in the countries we want to join, they are many times higher and that they have already been imposed," he says.
He estimates that high sanctions could have a dual effect - forcing data controllers to take the law more seriously, but also changing the attitude of citizens themselves towards privacy.
"These sanctions, besides believing that they will be deterrent, I expect that they will also be stimulating for citizens, because they will help them understand: since the fines are so high, my data is certainly important, so I want to protect it and be more responsible towards it than before," says Lacmanović.
The proposal foresees administrative fines for companies for violating the fundamental principles of data processing, unlawfully transferring data to third countries and international organizations, failure to cooperate with the Agency or failure to act on its orders. For the most serious violations, the fine can be up to two million euros.
At the same time, administrative penalties will not be imposed on state bodies, state administration bodies, local governments and public institutions.
The right to have data “forgotten”
As one of the most important innovations, Lacmanović highlights the right to erasure, or the right of a citizen to, under prescribed conditions, request that their data no longer be processed.
"This Proposal, as well as the General Regulation, are an attempt to respond to contemporary challenges in the world of information technologies. That is why the text also provides for the right to erasure and to be forgotten," he explains.
This, says Lacmanović, practically means that the controller or processor, when the legal requirements are met, will have to delete the data of a certain person, but also notify other entities to which the data was previously provided.
The proposal does not, however, treat the “right to be forgotten” as absolute. Deletion will not apply, among other things, when processing is necessary for the exercise of freedom of expression and information, the fulfilment of an obligation in the public interest, archiving, scientific and historical research, or the protection of legal claims.
It is also good, Lacmanović believes, that the conditions for transferring data to third countries and international organizations have been regulated more precisely.
"Clear criteria for transferring personal data to third countries, as well as international organizations, in which the Government of Montenegro also plays a role, additionally provide a special level of verification when making a decision on transferring personal data of our citizens to controllers or processors outside the state," he states, adding that he sees Article 87 as a step forward, which recognizes churches and religious communities as entities from which an appropriate level of personal data protection is expected.
They are striving for a political replacement of the Agency's leaders.
Lacmanović also considers the solutions regulating the dismissal of the president and members of the Council, as well as the director of the Agency, to be positive.
He believes that it is good that, in addition to the usual reasons for termination of office, the reasons for dismissal are also specified, along with mechanisms that should reduce the possibility of political influence.
"It is good that there are additional mechanisms to prevent political influence in such cases, such as the fact that a motion for dismissal must be supported by at least a third of MPs, and the decision is valid if a majority of the total number of people's representatives in the Parliament votes for it," says Lacmanović.
It also states that the Proposal no longer specifically regulates some forms of data processing that were characteristic of the previous regulations.
"The proposal does not prescribe special types of processing, such as records of entry into official and business premises, biometrics and video surveillance, and this processing will be treated like the others," Lacmanović explained.
See more:
Download the app and follow the news
FOLLOW US ON
