SerbiaLaw on Personal Data Protection, special categories of personal data and minors
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Do not process data revealing racial or ethnic origin, political opinion, religious or philosophical belief, or trade union membership, or process genetic data, biometric data for unique identification, health data, or data about a person's sex life or sexual orientation, unless a listed exception applies, such as the person's explicit consent for one or more specified purposes.
- Where a minor is 15 years old or older, their own consent is enough to process personal data for an information-society service; below that age, get consent from the parent exercising parental responsibility or another legal representative, and take reasonable steps to verify it.
- Process data about a person's criminal convictions, offences, or related security measures only under the control of, or as specifically permitted by law for, a competent authority, and keep any unified register of criminal convictions solely under that authority's control.
- Where a competent authority processes special categories of personal data for law-enforcement or national-security purposes, apply Article 18's narrower list of exceptions instead of Article 17's, and only where necessary and accompanied by appropriate safeguards.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 16 to 19 set the age of consent for information society services, ban the processing of special categories subject to listed exceptions, limit processing by competent authorities, and place processing of criminal-conviction data under the control of a competent authority. They require a check of parental consent but state no record, log or documentation duty. Article 19 provides that the unified record of criminal convictions is kept by a competent authority, which is a public register and not a record kept by a controller. The Articles carry no scope clause of their own, so no territorial hook is read.
- Kind
- None
- As of
What this law does
Article 17 prohibits processing that reveals racial or ethnic origin, political opinion, religious or philosophical belief, or trade union membership, or that involves genetic data, biometric data used to uniquely identify a person, health data, or data about a person's sex life or sexual orientation, unless one of ten listed exceptions applies, among them the person's explicit consent for one or more specified purposes, necessity under employment or social-security law, protecting vital interests where the person cannot consent, a nonprofit political, philosophical, religious or trade-union body processing only its own members' data, data the person has manifestly made public, preventive or occupational medicine, and archiving or scientific, historical or statistical research.
Article 18 applies a narrower version of the same prohibition to a competent authority processing special categories of personal data for law-enforcement or national-security purposes, permitting it only where the authority is authorized by law, the processing protects vital interests, or the data was manifestly made public by the person.
Article 19 confines processing of data on criminal convictions, offences and security measures to processing under the control of, or specifically authorized by law for, a competent authority, and keeps any unified register of criminal convictions solely under that authority's control.
Article 16 lets a minor of 15 or older give their own consent to processing personal data for an information-society service, and below that age consent must come from the parent exercising parental responsibility or another legal representative, with the controller required to take reasonable steps, considering available technology, to verify it.
Serbia has not adopted a standalone biometric-identifier statute, and the definition in article 4 and the restriction in article 17 treat biometric data as one item within this special-categories regime rather than a dedicated one.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .