MontenegroLaw on Personal Data Protection, agency, supervision and penal provisions
Law on Personal Data Protection, arts. 47-74 (agency, supervision and penal provisions)
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Reporting, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect a person in Montenegro to be able to submit a request for protection of rights to the supervisory authority, which must decide within 60 days and may temporarily ban further processing meanwhile, under Article 47.
- Expect a person in Montenegro to have a civil damages claim against you under Article 48 for a breach of their rights under this law, separate from an administrative complaint to the Agency.
- Give the Agency's controllers access to your filing systems, files and electronic processing means on request, regardless of the level of data secrecy, under Articles 66 and 67, and comply with an Agency order to eliminate irregularities, stop unlawful processing, erase data collected without a legal basis, stop an unlawful transfer out of Montenegro or disclosure, or stop an unlawful entrusting of processing, under Article 71.
- Expect a fine of EUR 500 to EUR 20,000 for a legal person, EUR 150 to EUR 2,000 for a responsible person in a legal person, a state body or a local government body, and for an individual, and EUR 150 to EUR 6,000 for an entrepreneur, for the violations listed in Article 74.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 74 fines a legal person EUR 500 to 20,000 for each listed misdemeanor; the responsible person in the legal person and an individual are fined EUR 150 to 2,000, and an entrepreneur EUR 150 to 6,000. The ceiling coded is the legal-person figure.
- Rule
- Fixed only
- As of
- Minimum
- 500
- Currency
- EUR
- Fixed cap
- 20,000
Who enforces it
Enforcement body
Agency for Personal Data Protection and Free Access to Information (AZLP), Montenegro's autonomous and independent supervisory authority established under Article 49 of the Law on Personal Data Protection, with legal personality.
Settledness
- As of
- Open questions
- Does Article 48 of the Law on Personal Data Protection, which makes the controller liable 'u skladu sa opštim pravilima o naknadi štete' (in accordance with the general rules on compensation of damage), require the injured person to prove the controller's fault under the general law of obligations, or does a breach of the rights this Law lays down found the claim on its own?
What it makes you log
Logging duty
Articles 47 to 74 set up the Agency, supervision, the inspector's powers and the penal provisions. Article 66 gives the inspector access to personal data, files, documentation and the electronic means of processing, and Article 67 obliges controllers, users and processors to allow that access and to hand over the files and documentation the inspector requests. These are powers to demand information, with no record named, so there is no duty to log and the audit expectation is on request by the regulator. Article 74(6) fines a controller that does not keep the record of third parties and users, but the duty is in Article 19, which this row does not cite. Article 5, the territorial scope clause, is not cited by this row, so no hook is recorded.
- Kind
- None
- As of
What this law does
Article 47 lets a person who alleges a breach of rights under this law submit a request for protection of rights to the supervisory authority, which must decide by ruling within 60 days, and lets it temporarily ban further processing on the applicant's written request while a breach is likely and pending decision. Article 48 makes the controller liable for damage a person suffered from a breach of rights under this law, under the general rules on compensation of damage.
Article 49 sets up the Agency for Personal Data Protection as the supervisory authority, autonomous and independent, with legal personality. Articles 66 and 67 give the Agency's controllers the right of access to personal data, files, documentation and electronic processing means regardless of the level of data secrecy, and oblige controllers, users and processors to allow it.
Article 71 lets the Agency, in supervision, order irregularities eliminated, temporarily ban unlawful processing, order erasure of data collected without a legal basis, ban a transfer of personal data out of Montenegro or disclosure to users contrary to the law, and ban entrusting processing to a processor that does not meet the conditions.
Article 74, as replaced by the 2012 amendments (Official Gazette of Montenegro No. 44/12), fines a legal person EUR 500 to EUR 20,000 for the listed violations of this law. For the same violations it fines a responsible person in a legal person, a state body, a state administration body or a local government body, and an individual, EUR 150 to EUR 2,000. For the same violations it fines an entrepreneur EUR 150 to EUR 6,000.
The Law as first enacted came into force on and has applied since . The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .