19. 08. 2008

PERSONAL OPINION OF THE COMMISSIONER FOR INFORMATION OF PUBLIC IMPORTANCE: THE DRAFT LAW ON PERSONAL DATA PROTECTION CONTAINS SOME ODD PROVISIONS

Privacy Under Surveillance

Belgrade, August 19, 2008 (Danas) – The National Assembly is soon going to consider the Draft Law on Personal Data Protection. This is to be commended, for several reasons. As is often mentioned, adoption of this Law might be a good step forward towards the White Schengen List. What's even more important, the Law could (and would have to) be the main precondition for establishment of a legal mechanism which is still lacking, and which is crucial for a modern, democratic society.

The need for having, after a whole decade, a functioning mechanism for protection of privacy, i.e. personal data, requires the utmost responsibility in preparation of legal framework, as well as in providing organizational, logistical, material and other conditions for its realization.

In this context, the Article 45, paragraph 2 of the Draft Law is of great interest. This provision allows security services to deny, for the reasons of "national and public security", and as long as "the reasons for such decision persist", the access to relevant data and databases, and even the access to premises, to the body which is authorized to protect personal data. Simply put, the Law guarantees citizens protection of their privacy, i.e. protection of personal data, but protection from illegal "processing" by security services will be possible only if these services allow it. At least, this is highly curious, isn't it?

Isn't the Article 45, paragraph 2 asin to the story about the wolf and the sheep? Aren't the mentioned data, databases and rooms similar, for example, to the notorious RATEL's "technical conditions for interception of Internet communication"? Is there any authorized body, whichever it may be, that can guarantee and provide effective protection of data after being faced with such limitations, for reasons which are vague and difficult to verify, and for a period of time which may be extended forever?

These limitations are a serious impediment to effective protection of personal data, regardless of which body is tasked with this mission. In this case, the issue is additionally complicated by the fact that an existing state official – the Commissioner for Information – is tasked with protecting personal data. And according to the Law on Free Access to Information, this official is already explicitly authorized to access, without limitations, all data possessed by authorities.

Isn't this situation controversial? It obviously is. Therefore it seems possible that this solution (un)intentionally creates a possibility of jeopardizing and diminishing the existing authority of the Commissioner for Information of Public Importance, which is of vital, even fundamental, importance for his ability to perform his mission. The possibility of arbitrary and significant limitations to the authority of the relevant body in the process of control and protection of rights is highly curious, not only because it violates the existing mandate of the Commissioner for Information, but because of its compliance with standards defined in international documents in this area, which we have signed and adopted. For example, the provisions of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and the Additional Protocol to this Convention. In the context of the Protocol's provisions regulating the role of monitoring bodies, which among other things specify the mandate to intervene in all legal proceedings without any limitations and point out all violations of the law, including the mandate to perform independent investigations, the limitations defined in the Article 45 paragraph 2 seem sarcastic, and the fact that its adoption in the National Assembly is proposed at the same time as the ratification of the Protocol seems almost cynical.

For all these reasons, these provisions (and some others, equally controversial) should be dropped from the Draft Law. Since the Commissioner for Information has not yet been authorized to propose amendments to laws related to his area of responsibility, not even after the constitutional changes, I have contacted the Ombudsman, who has such mandate in accordance with the Constitution. The Ombudsman will propose the relevant amendments, and I hope that it is not too optimistic to expect the deputies to adopt them.

The situation is even more curious regarding the realistic preconditions for enforcement of the Law. Supposedly having in mind the time necessary to provide such necessary preconditions, the proposers specify January 1, 2009 as the date the Law should enter into force. But is this "realistic" approach really caused by this considerations?

The Law retains the provisions according to which the Commissioner decides on the organization of his administration, but it also specifies that his decision is subject to approval by the National Assembly. And the first, formal but necessary, precondition for the Commissioner's acceptance of new tasks is the modification of the decision on the organization of his administration. This may be a good opportunity to remind ourselves of some earlier situations. The Commissioner for Information has delivered the decision on organization to the National Assembly on two occasions. First time during the formation, and the second time two years later, for the purpose of formal terminological harmonization with the law. In the first case, the approval was given five months later, and in the second case, astonishing 18 months later.

Also, it is well known that the Commissioner for Information, as well as almost all "new", independent bodies, work in inadequate conditions since their inception. Three years later, Government officials have not provided necessary working premises for the Commissioner's administration. All warnings about conditions which hinder the realization of its mission fell to deaf ears. For these reasons, the administration has only seven employees instead of prescribed 21, with all negative consequences to its performance. Is it possible that someone really thinks that in only three months this administration can be tasked with a new mission, which is incomparably more difficult and complex? Or perhaps, like in the Potemkin village, someone thinks that we should be satisfied with an illusion of personal data protection?

The author is the Commissioner for Information of Public Importance, Mr. Rodoljub Sabic

Related News:

* ANEM to Condemn RATEL's Technical Conditions Document and Way of Its Adoption (ANEM Statement, July 29th, 2008)