Bosnia and Herzegovina

Article 57a permits processing biometric data only where required by law or necessary to protect a person, property, classified information or a trade secret, or for the individual secure identification of a service user, provided the person's conflicting interest does not prevail, and Article 57a(2) makes the person's explicit consent the legal basis for processing their biometric data for secure identification.

Article 57b permits processing an employee's biometric data to record working time or to control entry to and exit from official premises only where required by law or offered as an alternative to another recording or access method, and only with the employee's explicit consent.

Article 35 requires the data controller to notify the Agency of a personal data breach without undue delay and, if possible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to endanger a person's rights and freedoms, giving the Agency the reasons for the delay if notice comes later than 72 hours.

Article 35(2) requires a processor to notify the controller without undue delay after becoming aware of a breach, and Article 35(3) fixes what the notification to the Agency must contain: the nature of the breach and, where possible, the categories and approximate numbers of people and records concerned, the data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed, which Article 35(4) lets the controller supply in phases where they cannot all be given at once.

Article 35(5) requires the controller to document every breach, its facts, consequences and remedial action, so the Agency can review compliance.

Article 36 requires the controller to notify the affected person in writing without delay wherever the breach is likely to result in a high risk to their rights and freedoms, describing the breach in clear and plain language and giving the same contact-point, consequences and measures information, unless the data were rendered unintelligible by a measure such as encryption, a later measure has removed the high risk, or notice would take disproportionate effort and a public notice reaches people as effectively; Article 36(4) lets the Agency require the notice anyway where none of those conditions is met.

Articles 86 and 87 restate the same 72-hour Agency notice and high-risk person notice for a competent authority processing personal data for a criminal-law purpose, and Article 86(8) additionally requires the competent authority to pass the breach information on to the data controller of another country without undue delay wherever the breached data were transmitted by or to that controller.

The Law on the Protection of Personal Data transposes Regulation (EU) 2016/679 for ordinary processing under Part One and Directive (EU) 2016/680 for processing by a competent authority for a criminal-law purpose under Part Two, and Article 6 gives it effect across Bosnia and Herzegovina rather than in one entity alone.

Article 8 sets the lawful bases for processing, running from the person's consent through contractual necessity, a legal obligation, vital interests, a public task or a legitimate interest that does not override the person's own rights, and Article 8(2) leaves the legal basis for a public-interest or official-authority task to the laws of the institutions of Bosnia and Herzegovina and, within their own competences, the entities and cantons.

Article 9 sets the conditions for a valid consent, including the controller's burden to demonstrate it and the person's right to withdraw it as easily as it was given, and Article 13 lets a controller that no longer needs to identify a data subject decline to acquire, keep or process additional information solely to comply with this Act.

Articles 26 to 31 allocate controller, joint-controller, processor and representative duties, and Article 27 requires personal data protection by design and by default. Article 32 requires a written record of processing activities naming the purposes, the categories of data and data subjects, the recipients, any transfer abroad and the envisaged erasure periods, with a limited exemption for an organization with fewer than 250 employees.

Article 34 requires technical and organizational security measures appropriate to the risk, including pseudonymization and encryption where appropriate. Article 37 requires a data protection impact assessment before processing likely to result in a high risk, and Article 38 requires prior consultation with the Agency where the assessment shows a risk the controller cannot mitigate.

Articles 39 to 41 require a Data Protection Officer for a public authority, for large-scale systematic monitoring, or for large-scale processing of special categories or criminal-conviction data. Articles 42 to 45 let the Agency approve a code of conduct or a certification mechanism as evidence of compliance.

Articles 52 to 59 carry sector rules for freedom of expression and information, public access to official documents, a unique identification number, the employment context, archiving and research, video surveillance, churches and religious communities, and professional secrecy.

Articles 60 to 65, 75 to 85 and 88 to 90 restate the same lawful-basis, controller-allocation, security, impact-assessment, prior-consultation and Data Protection Officer duties for a competent authority processing personal data for the prevention, investigation, detection or prosecution of a criminal offence.

Article 46 lets a transfer to another country or international organisation take place only in compliance with this chapter, including an onward transfer. Article 47 lets a transfer proceed without further safeguards where the Council of Ministers, on the Agency's proposal, has decided that the destination ensures an adequate level of protection, a decision the Agency continuously reviews and reports on.

Absent an adequacy decision, Article 48 lets a transfer proceed on appropriate safeguards such as a legally binding instrument between public authorities, binding business rules under Article 49, an approved code of conduct or certification mechanism, or standard contractual clauses the Agency adopts, some subject to the Agency's prior approval.

Article 50 bars recognizing or carrying out a foreign court judgment or administrative decision that would require a transfer or disclosure of personal data unless it rests on an international agreement such as a mutual-legal-assistance treaty between the requesting country and Bosnia and Herzegovina.

Article 51 permits a transfer absent an adequacy decision or appropriate safeguards only on a listed derogation, such as the person's informed explicit consent, contractual necessity, an essential public interest, or a legal claim, and bars relying on the narrower residual derogation in Article 51(2) for a transfer that is repetitive or systematic.

Articles 91 to 95 restate the same adequacy, safeguards and derogation structure for a competent authority transferring personal data for the prevention, investigation, detection or prosecution of a criminal offence, adding that the transferring authority must weigh the seriousness of the offence and the destination's level of protection before authorizing an onward transfer, and that a transfer of data originally received from another country needs that country's prior authorisation except where an immediate and serious threat to public security makes obtaining it impossible in time.

Article 24(1) gives a person the right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal effect concerning them or similarly significantly affects them. Paragraph 2 lists exceptions, including where the decision is necessary for a contract with the person or is based on their explicit consent.

Paragraph 3 requires the controller, in the contract and consent cases, to take appropriate measures to safeguard the person's rights and legitimate interests, including at least the right to participate in the decision-making, express their point of view, and contest the decision.

Articles 14 to 16 require the controller to tell a person, in a concise, transparent, intelligible and easily accessible form, its identity and contact details, the purposes and legal basis of the processing, the recipients, any transfer abroad, the retention period and the person's rights, giving that information when the data are obtained or, where they come from elsewhere, within a reasonable period and at the latest one month afterward.

Article 17 gives a person the right to confirm whether their personal data are processed and to access them, Article 18 the right to have inaccurate data rectified, Article 19 the right to erasure on the listed grounds, and Article 20 the right to restrict processing; Article 21 requires the controller to tell every recipient the data were disclosed to of a rectification, erasure or restriction, unless that proves impossible or involves disproportionate effort.

Article 22 gives a right to receive personal data in a structured, commonly used and machine-readable format and to have it transmitted to another controller, and Article 23 gives a right to object to processing, including an unconditional right to object to direct marketing that stops the processing as soon as it is exercised. Article 25 lets a special law restrict these rights only where necessary and proportionate to a listed public interest.

Article 96 establishes the Agency as an independent supervisory body seated in Sarajevo, Article 97 secures its independence, and Articles 98 to 100 govern the Agency's management, the appointment and dismissal of its Director and Deputy Director, and the incompatibility and professional-secrecy duties of its staff.

Article 101 makes the Agency responsible for the tasks and powers this Act confers and for supervising controllers and processors, other than a court exercising a judicial function, and Article 102 lists the Agency's tasks, including advising public authorities, raising public and controller awareness, deciding a person's complaint within 90 days, and approving codes of conduct, certification mechanisms and binding business rules.

Article 103 gives the Agency investigative powers, including ordering information, inspecting premises and accessing data, corrective powers, including a warning, an order to comply with a data subject's request, an order to bring processing into compliance, a temporary or permanent restriction or prohibition on processing, an order to notify a breach, and a suspension of a transfer abroad, and authorisation and advisory powers, and Article 103(4) makes an Agency decision final in administrative proceedings, subject only to an administrative dispute before the Court of Bosnia and Herzegovina.

Article 105 lets a person confidentially report a violation of this Act, and Article 107 lets the Agency carry out inspections.

Article 108 gives a person the right to complain to the Agency without prejudice to another remedy, and Article 109 gives a person, controller or processor the right to bring an administrative dispute against an Agency decision before the Court of Bosnia and Herzegovina within 60 days, or, where the Agency misses its 90-day deadline or fails to report progress on a complaint, on that same ground.

Article 110 gives a person a standalone right to judicial redress against a controller or processor, alongside the administrative complaint, and Article 111 lets a person authorize a non-profit body active in personal-data protection to exercise these rights, including a claim for compensation, on their behalf.

Article 112 entitles anyone who suffers material or non-material damage from an infringement of this Act to compensation from the controller or, in the narrower cases the article lists, the processor, with joint and several liability where more than one is responsible.

Articles 113 and 114 fix the fines: BAM 10,000 to BAM 20,000,000, or up to 2 percent of worldwide turnover, whichever is higher, for the lighter Article 113(4) violations such as a code-of-conduct or certification breach; BAM 20,000 to BAM 40,000,000, or up to 4 percent of worldwide turnover, whichever is higher, for processing contrary to the principles, lawful-basis or special-category articles, for violating a data subject's rights, for an unlawful transfer abroad, or for defying an Agency order; and a separate fine of BAM 5,000 to BAM 70,000 on the responsible natural person and BAM 500 to BAM 5,000 on an employee for the same violations, with no fine reaching the public body itself.

Article 115 refers a gross violation of this Act to Bosnia and Herzegovina's Criminal Codes for criminal liability rather than stating a penalty in this Act itself, and because the state, the Federation of Bosnia and Herzegovina, Republika Srpska and Brcko District each keep their own criminal code, more than one code can carry the offence depending on which authority is responsible.

Article 11 prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union affiliation, and processing genetic data, biometric data for uniquely identifying a person, health data, or data about a person's sex life or sexual orientation, unless one of the listed exceptions in Article 11(2) applies, chief among them the person's explicit consent, employment or social-security law, a vital interest, or a substantial public interest carried by a proportionate law.

Article 11(4) lets a specific law add further conditions, including limitations, on processing genetic, biometric or health data. Article 12 confines processing personal data about a criminal conviction, offence or related security measure to the supervision of a public authority or to a special law with safeguards, and keeps a register of criminal convictions exclusively under a public authority's control.

Article 10 makes a child's consent to an information-society service offered directly to them lawful from age 16, and below that age lawful only where a parent, adoptive parent or guardian gives or approves it, with the controller required to make reasonable efforts to verify that consent given available technology.

Article 40(1) states that content limitations of copyright are possible only in the cases provided for in the Law's own chapter on limitations, so the Law recognizes no residual fair-use or fair-dealing ground beyond that closed list.

The list, arts. 41 to 54, includes a statutory license for teaching materials and periodicals, free-use grounds such as private reproduction, quotation, and parody, and a database-specific limitation for an authorized user's normal use, but contains no exception naming text-and-data-mining, machine reading, or automated analysis; the Law predates the European Union's 2019 Digital Single Market Directive and its Articles 3 and 4 text-and-data-mining exceptions and has not been amended to add an equivalent.

Separately, art. 8(1) excludes ideas, procedures and methods, official legislative, administrative and judicial texts, political and courtroom speeches, daily news and brief press notices, and folk literary and artistic creations from copyright protection outright, so a scraper reproducing only that excluded subject matter does not implicate copyright at all.

Article 141 confers a sui generis right on the producer of a database, defined as a person who takes the initiative and assumes the risk of investing in the database's making, where obtaining, verifying, or presenting its content required a qualitatively or quantitatively substantial investment of human, technical, or financial resources; this protection is independent of any copyright in the database as a compilation.

Article 142 extends that protection to the whole content, to any qualitatively or quantitatively substantial part of it, and to the repeated and systematic extraction or use of insubstantial parts where that conflicts with the database's normal use or unreasonably prejudices the producer's legitimate interests. Article 143 gives the producer the exclusive right of reproduction, distribution, rental, making available, and other communication of the database to the public.

Article 144 lets an authorized user freely use qualitatively or quantitatively insubstantial parts of a published database's content for any purpose, subject to not conflicting with its normal use or unreasonably prejudicing the producer, and voids a contrary contract term.

Article 146 sets the right's term at 15 years from completion of the database or, if lawfully published within that period, from first publication, restarting on any qualitatively or quantitatively substantial new investment in the database's content.

Article 2(1) applies the law to republic bodies, local self-government bodies, legal entities exercising public authority, and other legal and natural persons that access or handle their data in electronic form. Article 4 provides that information security measures are general rules giving basic protection of data at the physical, technical and organisational level, which the Government of Republika Srpska sets.

Article 5(2) has the minister of science and technology adopt a rulebook on information security standards on the proposal of the Agency for the Information Society. Article 6(2) makes the information security measures cover physical protection, data protection and protection of the information system. Article 12 has the CERT of the Agency coordinate the conduct of the bodies and persons concerned when a computer security incident occurs.

Article 13(1) makes the Ministry of Science and Technology responsible for supervising the application of the law and the Agency responsible for expert supervision. Article 13(2) obliges the bodies and persons concerned to give the supervisors access to premises, computer equipment and devices and to provide without delay the data and documentation needed for supervision.

The Rulebook on information security standards cites the law as published in the Official Gazette of Republika Srpska number 70/11. Article 18 provides that the Law enters into force on the eighth day after its publication in the Official Gazette of Republika Srpska. No commencement notice for the Law has been located.

Article 2 applies the Rulebook to the republic bodies, local self-government bodies, legal entities exercising public authority and other persons that handle their electronic data. Article 107(1) requires the entities it covers to set up a process for managing security incidents with defined responsibilities and procedures. Article 107(2) requires them to prescribe, as a minimum, procedures for reporting, classifying, monitoring and reporting on security incidents.

Article 108(1) requires them, in the case of serious security incidents, to notify the Department for Information Security immediately of the incident, its consequences and the actions taken. Article 108(2) requires the incident report to describe any compromised data and the circumstances of the incident, including its start date and duration. Article 123 provides that the Rulebook enters into force on the day of its adoption. The Rulebook is dated 10 May 2013.

Article 8(1)(d) of the Law on Copyright and Related Rights excludes from copyright protection, before any use-based exception is reached, daily news or information having the character of a brief news item conveyed in a press notice.

Article 47 separately permits the faithful quotation of excerpts from a work already made public, or of individual published works of photography, fine art, architecture, applied art and industrial or graphic design, for scientific research, criticism, polemic, review, teaching or other commentary, to the extent justified by the purpose sought and in accordance with fair practice, with the source and the author's name indicated where they appear on the work used.

Neither provision is limited to the press or carries a headline-length or short-extract cap of its own, and no reported decision of a Bosnia and Herzegovina court applies either provision to a systematic news aggregator rather than an individual quoting a published work.