The Agency for the Protection of Personal Data in Bosnia and Herzegovina adopted two special decisions by which it permanently prohibited the Agency for Identification Documents, Records and Data Exchange of Bosnia and Herzegovina and the Administration for Indirect Taxation of Bosnia and Herzegovina from processing personal data for the purpose of issuing qualified electronic certificates for electronic signing, with an exception for the IDDEEA in the process of digital signing in the field of identification documents.
In the procedures it carried out, the Agency acted in accordance with the competences and authorizations given to it by the Law on the Protection of Personal Data, that is, the article prescribing the competence of the Agency for the supervision of personal data processing procedures performed by data controllers and processors and the article prescribing the Agency’s authority to permanently or temporarily limit or prohibit processing.
It follows from the above that the claims in the media that the Agency is not competent to supervise the procedures for processing personal data for the purpose of issuing qualified electronic certificates for electronic signing are not true.
Decisions and imposed prohibition measures refer exclusively to the prohibition of processing personal data by public bodies that are not competent for such processing according to the laws that regulate their jurisdiction, with the exception of processing in the digital signing process in the field of identification documents, which is the competence of the IDDEEA.
From the enacting clause of the Decision, it indisputably follows that the pronounced measures produce legal effect for the future and do not produce legal consequences for earlier procedures for issuing qualified electronic certificates.
It is important to point out that the Decisions do not prohibit the use of electronic signatures in any area, such as the judiciary, the fiscal system, the economy, etc., but the illegal processing of personal data by two public bodies that must act only within the limits of legal competence.
Therefore, the formal acts on security and technical conditions issued to these public bodies by the Ministry of Communications and Transport of Bosnia and Herzegovina are absolutely irrelevant, given that there is no legal authority to process personal data for the purpose of issuing a qualified electronic certificate.
In the earlier period, the Agency issued a Decision prohibiting the IDDEEA from assigning electronic identities to the citizens of Bosnia and Herzegovina, without a legal basis, and ordered it to delete the personal data of citizens that were collected during the testing phase of the electronic identity system of the citizens of Bosnia and Herzegovina.
The Agency’s decision was confirmed by the decisions of the Court of Bosnia and Herzegovina and the Appellate Administrative Council of the Court of Bosnia and Herzegovina, which stated that the IDDEEA is legally authorized to issue qualified digital signatures that are an integral part of the identity card.
It is unacceptable that the IDDEEA, despite the stated position of the Court of Bosnia and Herzegovina, continued with the illegal processing of personal data for the purpose of issuing qualified electronic certificates, while still not acting within the framework of the legal competence for digital signing in the field of identification documents, announced the Agency for the Protection of Personal Data of BiH.
