While the European Union is working hard to establish technical standards and security protocols for the new EU Wallet digital identity wallet, Bosnia and Herzegovina is still struggling with inconsistent legislation and lack of concern on the part of the authorities to speed up the pace and embark on a digital transformation.
By introducing digital identity through the so-called EU Wallet, BiH citizens would be provided with secure online identification and access to e-services (e-health, e-banking, digital public administration, courts and others), but there is a long way to go, because BiH has not yet developed a digital identity system and harmonized legislation with EU regulations.
According to the interlocutor CAPITALBosnia and Herzegovina is at the beginning of digitization and there is still no consensus or solution for the establishment of elementary digitization processes, and in order to work on that, it would have to have at least a law that would open the way for the first steps.
The former director of the Agency for the Protection of Personal Data, Petar Kovačević, says that in the last few years, the European Union and its members have analyzed thousands of regulations and changed hundreds of them. During that time, nobody here does anything about it, which speaks volumes about the frivolity and lack of commitment of the authorities.
Legal basis and analysis of existing solutions
“In order for Bosnia and Herzegovina to engage in the creation of a digital wallet, a legal basis and an analysis of the compatibility of existing solutions are needed. It is necessary to see whether they are sufficient for the legal processing of personal data. Many activities should be done to ensure the legal processing of personal data in the creation of a digital wallet, such as an assessment of the impact of processing,” says Kovačević.
It explains that the processing of personal data needs to be designed to serve people’s well-being. He says that we still have the problem of providing less demanding processing of personal data, such as asking for a copy of an ID card for everyone and everything. The European standard is “once only” and it means that the citizen is obliged to give the data to the state only once, and that it provides legal exchange or processing.
“The key is the responsibility of the authorities and their reliability, and it can only be found in traces here because superficiality and populism are always in force, in short: the snobbery is generally present and it cannot give itself a positive step forward. The existing Law on the Protection of Personal Data is well harmonized with the General Regulation of the EU, which means that the problem is in application. In the legislative part, the problem is that nothing is done on sectoral legal and by-laws,” says Kovačević.
The illegal processing of personal data by the IDDEEA also speaks of this, because it previously illegally processed the personal data of citizens, says Kovačević, but he also points out that he welcomes their efforts to make a step forward in this field, noting that it must be done carefully.
“Unfortunately, the IDDEEA is not an isolated case. In order for the law to be effective, it prescribes fines that are not small and should be a deterrent, but that does not work here either. The Agency for the Protection of Personal Data of BiH, whose name is mentioned 200 times in the law, also has a great responsibility,” says Kovačević.
The Ministry of Communications and Transport of Bosnia and Herzegovina also says that in order to establish other types of electronic identification besides signatures, it is necessary to harmonize our BH legislation with the EU legislation.
They explain that the eIDAS Regulation (“electronic IDentification, Authentication and trust Services”) represents the EU legal framework that enables secure electronic identification and transactions throughout the EU and establishes the basis for cross-border interoperability of electronic identities and trust services (qualified electronic signature, seal, time stamp).
Draft law at the bottom of the drawer for eight years
“Back in 2017, the Ministry drafted a new law harmonized with the EU Regulation and referred it to the procedure for consideration and adoption, but it was not adopted in the parliamentary procedure. In the meantime, in 2024, amendments were made to the Regulation of the European Parliament and the Council of Europe regarding the establishment of a European framework for digital identity through a European wallet, which will enable citizens and business entities to securely prove their identity and share documents throughout the EU. Compliance with this and other regulations is an obligation of BiH as part of the European integration process and accession negotiations with the EU”, the ministry explains.
When asked how we stand with the deadlines for fulfilling obligations, they are already saying that Bosnia and Herzegovina will be late, as well as with all other obligations towards the EU. There is no specific deadline, they say, but Bosnia and Herzegovina was obliged to harmonize its legislation with EU legislation a long time ago.
“The European Commission predicts that the EU member states should ensure the availability of the European digital identity wallet to citizens by 2026 (although it is very certain that this period will be extended in the EU), while BiH should, through the harmonization process, plan implementation in accordance with its own capacities and the dynamics of European integration. When BiH harmonizes its regulations with EU legislation, it is planned that the digital identity from BiH will also be recognized in EU systems – e.g. banks or public services,” said the ministry.
After the harmonization and adoption of the new law at the state level, the next step is negotiations with the European Commission regarding the recognition of electronic identity from Bosnia and Herzegovina in the EU, and the establishment of a system of recognition and placement of our certifiers on the list of safe certifiers in the EU.
Who does what?
When talking about the control of those who will process the data, they state that the precise roles and responsibilities of the bodies in the digital wallet system will be regulated in detail through a new legal framework harmonized with the eIDAS regulation.
“Within existing competences and in the process of preparation for the implementation of the European digital identity wallet, IDDEEA as a body at the BiH level will be responsible for the field of electronic identification and trust services. In accordance with its mandate, it will participate in the preparation and pilot projects of digital identity, coordinating with competent institutions the implementation of privacy and data security standards,” the ministry said.
According to that decision, the Agency for the Protection of Personal Data of BiH will be the supervisory body for the implementation of the Law on Protection of Personal Data, responsible for monitoring the legality of personal data processing in all systems, including the future digital identity solution.
To our questions about the digital wallet, IDDEEA director Admir Badnjević was not interested in answering and referred us to the Ministry of Communications and Transport and the BiH Parliament.
We also received a short answer to a series of questions from the Agency for the Protection of Personal Data of Bosnia and Herzegovina, from which we tried to find out how citizens’ data will be kept and protected. And they were “excusing” the absence of laws.
“The issue of storing and keeping the data of citizens who will use a digital identity requires the establishment of appropriate legal frameworks and the application of technical and security data protection measures. The aforementioned will ensure the protection of personal data and prevent misuse in accordance with the GDPR (General Data Protection Regulation) and domestic laws. Currently, the priority is the adoption of new laws, and the Agency has no influence on the speed of adoption of those laws,” the agency said.
