Law on the Protection of Personal Data of Bosnia and Herzegovina, the Agency, enforcement and penalties

Article 96 establishes the Agency as an independent supervisory body seated in Sarajevo, Article 97 secures its independence, and Articles 98 to 100 govern the Agency's management, the appointment and dismissal of its Director and Deputy Director, and the incompatibility and professional-secrecy duties of its staff.

Article 101 makes the Agency responsible for the tasks and powers this Act confers and for supervising controllers and processors, other than a court exercising a judicial function, and Article 102 lists the Agency's tasks, including advising public authorities, raising public and controller awareness, deciding a person's complaint within 90 days, and approving codes of conduct, certification mechanisms and binding business rules.

Article 103 gives the Agency investigative powers, including ordering information, inspecting premises and accessing data, corrective powers, including a warning, an order to comply with a data subject's request, an order to bring processing into compliance, a temporary or permanent restriction or prohibition on processing, an order to notify a breach, and a suspension of a transfer abroad, and authorisation and advisory powers, and Article 103(4) makes an Agency decision final in administrative proceedings, subject only to an administrative dispute before the Court of Bosnia and Herzegovina.

Article 105 lets a person confidentially report a violation of this Act, and Article 107 lets the Agency carry out inspections.

Article 108 gives a person the right to complain to the Agency without prejudice to another remedy, and Article 109 gives a person, controller or processor the right to bring an administrative dispute against an Agency decision before the Court of Bosnia and Herzegovina within 60 days, or, where the Agency misses its 90-day deadline or fails to report progress on a complaint, on that same ground.

Article 110 gives a person a standalone right to judicial redress against a controller or processor, alongside the administrative complaint, and Article 111 lets a person authorize a non-profit body active in personal-data protection to exercise these rights, including a claim for compensation, on their behalf.

Article 112 entitles anyone who suffers material or non-material damage from an infringement of this Act to compensation from the controller or, in the narrower cases the article lists, the processor, with joint and several liability where more than one is responsible.

Articles 113 and 114 fix the fines: BAM 10,000 to BAM 20,000,000, or up to 2 percent of worldwide turnover, whichever is higher, for the lighter Article 113(4) violations such as a code-of-conduct or certification breach; BAM 20,000 to BAM 40,000,000, or up to 4 percent of worldwide turnover, whichever is higher, for processing contrary to the principles, lawful-basis or special-category articles, for violating a data subject's rights, for an unlawful transfer abroad, or for defying an Agency order; and a separate fine of BAM 5,000 to BAM 70,000 on the responsible natural person and BAM 500 to BAM 5,000 on an employee for the same violations, with no fine reaching the public body itself.

Article 115 refers a gross violation of this Act to Bosnia and Herzegovina's Criminal Codes for criminal liability rather than stating a penalty in this Act itself, and because the state, the Federation of Bosnia and Herzegovina, Republika Srpska and Brcko District each keep their own criminal code, more than one code can carry the offence depending on which authority is responsible.