Page 1

2468
Pursuant to Article 54, paragraph 5 and Article 55, paragraph 10 of the Law on Data Protection o
persons ("Official Gazette of RS", No. 87/18) and Article 33, paragraph 5 of the Law on Freedom
access to information of public importance ("Official Gazette of RS", No. 120/04, 54/07,
104/09 and 36/10),
The Commissioner for Information of Public Importance and Personal Data Protection issues
DECISION
on the list of types of personal data processing operations for which it must be performed
assess the impact on the protection of personal data and seek an opinion
Commissioner for Information of Public Importance and Personal Data Protection
1. This decision determines the list of actions for processing personal data for which
the operator, before starting the processing, must perform an impact assessment on
protection of personal data and seek the opinion of the Information Commissioner from
of public importance and protection of personal data.
2. The assessment of the impact on the protection of personal data referred to in item 1 of this Decision shall be performed in
case:
1) systematic and comprehensive assessment of the condition and characteristics of the natural person being performed
by automated processing of personal data, including profiling, on
the basis on which decisions are made that are important for the legal position of an individual or similar
way significantly affect it;
2) processing of special types of personal data, ie data by which it is disclosed
racial or ethnic origin, political opinion, religious or philosophical belief or
union membership as well as genetic data processing, biometric data in
for the purpose of uniquely identifying persons, health data or data
on the sexual life or sexual orientation of a natural person or data on
persons in connection with criminal convictions and criminal offenses and security measures, in
large volume;
3) systematic supervision of publicly accessible areas to a large extent;
4) processing of personal data of children and minors for the purpose of profiling,
automated decision making or for marketing purposes;
5) use of new technologies or technological solutions for data processing on
personality or with the possibility of processing personal data used for analysis or
predicting the economic situation, health, preferences or interests, reliability
or the behavior, location or movements of individuals;
6) processing of personal data in a manner that includes tracking the location or
behaviors of the individual in the case of systematic processing of communication data generated
using telephone, internet or other means of communication;
7) processing of biometric data for the purpose of unique identification of employees
by the employer and in other cases the processing of personal data of employees
by the employer using applications or systems to monitor their work,
movements, communications, etc .;
8) processing of personal data by crossing, linking or checking
multi-source matches;
9) processing of special types of personal data for the purpose of profiling or
automated decision making.

Page 2

3. Except in the cases referred to in item 2 of this Decision, the operator is obliged to perform
assessment of the impact on the protection of personal data and in other cases if it is
likely to do some kind of processing, especially using new technologies and taking
given the nature, extent, circumstances and purpose of the processing, cause a high risk to the rights
and the freedom of individuals.
4. After the assessment of the impact on the protection of personal data, the controller is
obliged to, before starting the processing of personal data, the Commissioner for
information of public importance and personal data protection apply for
giving opinions.
5. For the request for giving an opinion from item 4 of this decision, the republic fee is paid
administrative fee in accordance with the law.
6. Publish this decision in the "Official Gazette of the Republic of Serbia" and on the Internet
page www.poverenik.rs.
7. This Decision shall enter into force on the eighth day from the day of its publication in the “Official Gazette
Gazette of the Republic of Serbia ”, and has been applied since the day of application of the Law on Protection
personal data ("Official Gazette of RS", No. 87/18).
Number 021-00-14 / 2019-04
In Belgrade, June 19, 2019
Deputy Commissioner,
Stanojla Mandić, s.r.

