Montenegro PDPL 

What is Montenegro's Personal Data Protection Law (PDPL)?

The Montenegro PDPL (Personal Data Protection Law), also known as Law 79/2008, 70/2009, 44/2012 and 22/2017, is the country’s data privacy law setting out obligations and putting in place protections of personal data “in accordance with the principles and standards contained in the ratified international human rights treaties and generally recognised rules of international law.”

The law bears similarities to the Data Protection Directive (Directive 95/46/EC), being modeled after it, rather than the GDPR. 

How does Montenegro's Personal Data Protection Law (PDPL) define Personal Information and what are other key definitions?

Under Montenegro’s personal data protection law, ‘personal data’ is “any information relating to an identified or identifiable natural person” and a ‘data subject’ is defined as “a natural person who is identified or can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.”

‘Sensitive personal data’ is here called 'special categories of data' and is understood to mean “personal data concerning racial or ethnic origin, political, religious or other beliefs, social origin, trade-union membership, data concerning health, sex life or sexual orientation, biometric data, as well as data from registers of misdemeanor and criminal convictions.”

'Biometric data' under Montenegro’s law refers to “data on physical or physiological features intrinsic to every natural person, which are specific, unique and unchangeable and capable of revealing the identity of an individual either directly or indirectly” and the text of the law offers no exclusions here. 

Consent has to be “a free statement given in writing or orally on record by which an individual signifies his agreement to personal data relating to him being processed for a specific purpose” and the law clarifies what 'processing of personal data' means, namely “any operation which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, use, consultation, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction, as well any other operation performed upon personal data.”

Montenegro’s PDPL defines a 'processor of personal data,' as “a public authority, public administration body, self-government or local administration authority, commercial enterprise or other legal person, entrepreneur of a natural person, who performs tasks concerning the processing of personal data on behalf of the controller, in accordance with this law,” and a ‘personal data filing system controller’ as a “legal person, entrepreneur and natural person, with the seat or domicile in Montenegro, which carries out processing of personal data or establishes personal data filing systems in line with the PDPL.

Last but not least, the data privacy law of Montenegro offers a definition for what it calls a 'personal data filing system,' which is to be understood as “any structured, whether centralized, decentralized or dispersed on a functional or geographical basis, set of personal data which are undergoing processing and which may be accessible according to the specific criteria.”

Who does Montenegro's Personal Data Protection Law (PDPL) apply to?

Montenegro's PDPL law applies to:

• Any state authority, public administration body, local self-government and local administration authority, commercial enterprise, or any personal data filing system controller.
• The processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means which forms part of a personal data filing system or is intended to form part of a personal data filing system.
• A personal data filing system controller whose seat or domicile is outside Montenegro if the equipment for processing of personal data is situated in Montenegro, unless such equipment is used only for purposes of transit through the territory of Montenegro. In such cases, the controller shall designate a representative or an attorney with the seat or domicile in the territory of Montenegro who shall be responsible for the application of this law.