Regulators Demand Data Protection Measures in the Balkans

The digital landscape in the Western Balkans is facing significant challenges regarding privacy and data protection, as highlighted by Željko Rutović, President of the Council of the Agency for Personal Data Protection in Montenegro. In a recent interview, he emphasized the urgent need for legislative frameworks that safeguard citizens’ personal information from multinational corporations like Meta and Google, which currently operate without adequate oversight in the region.

The increasing reliance on digital communication and commerce has transformed how individuals and businesses interact. Yet, this shift has raised critical concerns about the protection of personal data. Rutović pointed out that without proper regulations, citizens of Montenegro, Serbia, and Bosnia and Herzegovina are vulnerable to commercial and political manipulation.

Despite the European Union’s enforcement of the General Data Protection Regulation (GDPR), which sets a high standard for privacy protection, Montenegro has yet to incorporate this framework into its legal system. Rutović noted, “The country remains legally bound to outdated mechanisms and norms, while citizens face daily challenges with mass data collection by major companies.” He specifically referenced the pervasive activities of platforms such as Facebook, Instagram, Google, and X, which have become integral to daily life.

In highlighting the gravity of the situation, Rutović stated that personal data has become a commercial commodity of enormous value. He explained how companies engage in extensive profiling of individuals—including their preferences and desires—ultimately converting this information into profit. “Mass data processing opens avenues for direct influences on consumer behavior as well as political conduct,” he added.

Calls for Regional Cooperation

Montenegro has yet to enact a new data protection law or adopt the GDPR, leaving it in a precarious position. Rutović argues that the only feasible path forward for smaller nations is through collaborative efforts with neighboring countries. “We felt the need to collectively approach Google, Meta, and X, urging them to establish a regional office for the Western Balkans. This would significantly strengthen our position compared to individual outreach,” he stated.

This initiative has gained momentum, with two meetings held in Sarajevo and Podgorica, and a third anticipated in Belgrade. Such collaboration is viewed as a temporary measure until national laws can be aligned with European standards.

Limited Regulatory Power

Rutović highlighted the constraints faced by local institutions, stating, “The only action we can take is to send a letter to companies outlining the problem. However, these letters lack legal authority, and companies are not obliged to respond.” In contrast to Serbia, which has aligned its legislation with GDPR, Montenegro remains restricted in its regulatory capabilities.

One of the central criticisms from European regulators is Meta’s justification for data processing, which is often based on “legitimate interest.” This approach prioritizes profit over citizens’ rights to privacy and has already led to multiple legal losses for Meta in European courts. Rutović explained that while European users enjoy rights to consent and notification regarding their data use, citizens in Montenegro, Serbia, and Bosnia and Herzegovina lack these protections due to unaligned local legislation.

Resource Challenges and Public Awareness

The capacity of data protection agencies in the region is limited, with Rutović acknowledging that these institutions lack both financial and human resources. “Our agencies do not even have the basic tools for operation, let alone the means for staff development and training,” he explained. This lack of capacity is particularly concerning in light of the rapid advancements in artificial intelligence and digital tools, which many stronger EU states struggle to keep pace with.

The current state of affairs leaves citizens vulnerable to various abuses, including data leaks and unauthorized processing of personal information. Rutović emphasized that there is still a low level of public awareness regarding the significance of personal data as a fundamental human right. He warned that if this issue is not addressed promptly, there is a risk of becoming “digital colonies of large corporations, without the power to control our own data.”

In conclusion, Rutović advocates for a comprehensive response to data protection challenges that transcends the regulatory sphere. He insists that the issue requires a concerted effort from the government, academic institutions, media, and the public. “Protecting personal data is not merely a technical concern; it is a deeply political and civilizational issue that touches on human rights, security, and the future of our societies,” he stated.

The establishment of a Meta office in the Balkans could serve as an initial step toward balancing corporate interests with the protection of citizens’ rights. However, without robust legal regulations and alignment with European standards, such a move would likely remain a temporary fix. The forthcoming period will be crucial for Montenegro, Serbia, and Bosnia and Herzegovina, as they strive to secure their citizens’ fundamental right to privacy in a digital age.