Data protection officers in Bosnia and Herzegovina
The data controller and processor are required to appoint a Data Protection Officer (“DPO”) in the following cases:
- when the processing is carried out by a public authority, except for courts acting in their judicial capacity;
- when the core activities of the controller or processor consist of processing operations which, by their nature, scope, and/or purposes, require regular and systematic monitoring of data subjects on a large scale; or
- when the core activities of the controller or processor consist of large-scale processing of special categories of personal data or data relating to criminal convictions and offences.
A group of undertakings may appoint a single DPO provided that the DPO is easily accessible from each establishment.
Public authorities may appoint a single DPO for multiple authorities, taking into account organizational structure and size.
In other cases, controllers, processors, or associations representing them may, or where prescribed by law must, appoint a DPO. A DPO may act on behalf of these associations.
The DPO shall be appointed based on professional qualifications, including expertise in data protection law and practice, and the ability to perform the tasks assigned by law.
The DPO may be employed by the controller or processor or engaged under a service contract.
Controllers or processors must publish the DPO’s contact details and communicate them to the supervisory authority.
Controllers and processors shall ensure that the DPO is properly and timely involved in all issues related to personal data protection. Controllers and processors shall support the DPO in performing their tasks, providing necessary resources, access to personal data and processing operations, and support for maintaining expertise. The DPO shall not receive instructions regarding the performance of their tasks. Controllers and processors cannot dismiss or penalize the DPO for performing their duties. The DPO reports directly to the highest management level. Data subjects may contact the DPO regarding processing of their personal data and exercising their rights. The DPO shall maintain confidentiality of all information obtained while performing their tasks. The DPO may perform other tasks, provided they do not create a conflict of interest.
The DPO shall:
- inform and advise the controller or processor and employees engaged in processing about their obligations under the law;
- monitor compliance with the law and internal policies of the controller or processor, including awareness-raising, training, and audits;
- provide advice, when requested, on data protection impact assessments and monitor their implementation;
- cooperate with the supervisory authority;
- act as a contact point for the supervisory authority on all data processing matters, including prior consultation when required.
While performing their tasks, the DPO shall take into account the risks associated with processing, considering the nature, scope, context, and purposes of processing.
Furthermore, in the event that the personal data of data subjects in Bosnia and Herzegovina is processed by a data controller or processor who does not have a registered office, business establishment, residence, or habitual abode in Bosnia and Herzegovina, and if the processing activity is related to:
- offering goods or services to those data subjects in Bosnia and Herzegovina, regardless of whether the data subject is required to make a payment; or
- monitoring the behavior of data subjects, provided that their behavior takes place within Bosnia and Herzegovina,
the data controller or processor is obliged to appoint a representative in Bosnia and Herzegovina in writing.
However, exceptions to this obligation are provided for:
- processing that is occasional, i.e., where there is no substantial processing of special categories of data or processing of personal data relating to criminal convictions and offences, and where it is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope, and purposes of the processing; or
- processing of personal data carried out by public authorities.
The appointment of a representative of the data controller or processor does not affect the legal obligations that may be directed against the data controller or processor itself.
