On 28. February 2025. In the official Gazette of BiH, a new BiH was published Law on Protection of Personal Data of BiHwhich brings significant changes in the protection of citizens privacy.
Informed with modern European standards, this Law sets clear frameworks for responsible treatment with personal data in the public and private sectors, and is particularly emphasized Strict financial sanction for all who violate regulations.
High fines in focus
One of the key elements of the new law is the prescribing of high fines. According to the Law, Data Controllers and Processors who perform unauthorized processing of personal data, or violate the rights of data carriers, can be fined amounts that range from 10.000 km to 20,000,000 KM – ie up to 2% of the total annual turnover for entrepreneurs.
In cases of severe offenses, when it comes to data processing contrary to the provisions regarding the rights of citizens or transfer data towards abroad, penalties climb on 20.000 km to 40,000,000 km or up to 4% of the annual turnoverdepending on which amount is higher.
The Agency responsible for the protection of personal data emphasizes that numerous factors are specifically discussed in particular. They are taken into account:
- Nature, weight and duration of injury (given the scope and purpose of processing, number of data carriers and the degree of damage suffered),
- whether the injury was made on purpose or from inaccessment,
- Measures taken to mitigate damage,
- degree of responsibility and applied technical and organizational measures,
- previous injuries of the same controller or processor,
- degree of cooperation with the Agency,
- Personal data category and,
- Respect for approved behavioral codes and certification mechanisms.
In addition, the Agency has the authority to issue a misdemeanor order or apply for the initiation of misdemeanor proceedings before the competent court, depending on the circumstances of the individual case.
Responsible persons and additional measures
The law prescribes individual penalties for responsible persons. For injuries to certain provisions, the person responsible may be punished by a fine of 5,000 km to 70,000 kmWhile the employed person in the control structure can receive a sentence between 500 km and 5,000 km. A similar sanction regime applies to responsible persons in public and competent authorities, which in the event of offenses – such as unauthorized data processing or non-compliance with the Agency’s order – may be punished by the same amounts.
Additionally, the law requires that if the data controller or processing, intentionally or in negligence, violates more provisions, the total amount of the sentence must not be higher than the penalty prescribed for the most serious injury. Also, obsolescence for finishing fines is anticipated five years from the date of the execution of the offense, while public and competent authorities cannot be directly punished, except responsible and employed persons.
Distribution of funds collected
According to Article 114. Financies are paid to the unique Treasury Institutions of BiH, in the way that legal or natural persons are based on the account of the entities or the Brčko District, while in foreign-based individuals. In the Federation of BiH, the distribution is made between cantons and municipalities in accordance with the Law on Public Revenue.
Likewise, the law also prescribes criminal sanctions.
In the case of a rough violation of the provisions of the Law, the application of the BiH Criminal Code provides for additional penalties for illegal processing of personal data, which ensures complete protection of citizens privacy.
This new law represents a significant step in the modernization of Bosnia and Herzegovina legislation, and high-sentences clearly send a message on the seriousness of access to personal data protection.
Companies, state bodies and other liability holders will need to conduct a thorough audit of their procedures to ensure compliance with new standards, which seeks to raise awareness of the importance of privacy in digital age.
We remind you, the House of Peoples of the Parliamentary Assembly of Bosnia and Herzegovina adopted the Law on Personal Data Protection at the end of January.
This law, proposed by the BiH Council, received the support of 11 delegates, while one was against and three restrained.
The adopted law is adjusted with the EU Regulation from 2016. year, which deals with personal data processing, writes Akta.
