Law note · Montenegro
Law on Personal Data Protection
This is the working resolution of a genuinely unresolved status question: whether the 2008 Law on Personal Data Protection, as amended through the August 2024 amendment (OG 77/24), or a separately reported 2023 replacement (OG No. 21/2023) currently governs.
This document records the 2008 act as enacted rather than in_effect: this research could not source a specific promulgation, publication, or commencement date for the 2008 act or any of its four amendments from a primary source, only the general year 2008 and the amendment year 2024, so no effective_date is recorded.
Primary text, read through a 70/09-consolidated English translation hosted by AZLP, confirms biometric data as a special category under a generic definition with no enumerated examples, distinct in kind from the enumerated-example definitions found elsewhere in this batch, plus a dedicated Biometric Measures chapter (Articles 31-32) scoped narrowly to workplace access control and presence recording, not a general commercial biometric-capture regime.
It also confirms a civil damages right under Article 48 and a cross-border transfer regime under Article 41 requiring the prior consent of the supervisory authority. This text is not confirmed unchanged by the 44/12, 22/17 or 77/24 amendments, and whether it remains the operative law at all, rather than having been superseded by a 2023 replacement, was not resolved in this research.
What it asks of an app
- Establish a lawful basis before processing personal data of a person in Montenegro under this law.
- Treat biometric data as a special category requiring an exception, such as consent, before processing it under Article 7; the only dedicated biometric-processing chapter, Articles 31 and 32, is scoped to workplace access control and presence recording and does not by itself establish a general commercial biometric-capture regime.
- Obtain the prior consent of the Agency for Personal Data Protection and Free Access to Information before transferring personal data of a person in Montenegro outside the country, under Article 41.
- Expect a person in Montenegro to have a civil damages claim under Article 48 for a breach of their rights under this law, separate from an administrative complaint to the Agency.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions, processes_voice, processes_biometrics