Guidelines on Data Protection In Proceedings Before the Commission for the Protection of Competition Have Been Published

Namely, pursuant to provisions of Article 45 of the Law, the Commission for Protection of Competition (“Commission”) is entitled to impose a measure for protection of data source or certain data (protected data) on the basis of a request of one of the following persons:

• a party; or
• a person who is an applicant of an initiative for examination of competition violation; or
• third party who submitted, or made available for inspection, requested data in the procedure before the Commission.

The data protection measure shall be determined by the Commisiion, i.e. the Chairperson of the Commision by a conclusion, pursuant to Article 45 of the Law, only in case the Chairperson assesses that the applicant’s interest for data protection is justified and significantly greater than the interest of the public regarding the subject of a pending request.

In addition, the Law stipulates that the applicant of a request for data protection is obliged to make likely the cause of significant damage due to the disclosure of a data source, i.e. certain data to which the request relates, and for the avoidance of doubt, the Law additionally stipulates that data protected in the procedure before the Commission does not have the status of information of public importance, in relation to the provisions of the law regulating free access to information of public importance.

The Commission issued the Instruction in accordance with its competence prescribed by Article 21 of the Law, thus we present below some important information contained within the Instruction:

• Applicant – applicants of a request for an opinion (in connection with application of applicable regulations in the field of antitrust matters) cannot submit the mentioned request for data protection, unless such applicants submit certain data at the request of the Commission;
• Subject of protection – The Instruction provides further insight to what is meant by protection of data source and additionally states that a party in a procedure before theCommission cannot demand its identity to be protected as a data source (except when otherwise specified in the Instruction itself);
• Data which cannot be the subject of protection – the Commission determines in more detail which data cannot be covered by a request for data protection, such as, for example, publicly available and commonly known data, data regarding an authorized person in a procedure, data that has lost commercial significance due to the passage of time, etc.;
• Protection of business secret – data which represents business secret, in accordance with the law governing protection of business secrets, is protected as business secret;
• Protection of other confidential data – if subject of protection is other data that an applicant considers to be confidential, an applicant is obliged to state basis and reasons related to the confidentiality of data;
• Content of the request for data protection – the Instruction prescribes duties of an applicant in the course of submitting a request for data protection, such as applicant’s obligation to point out the likelihood of damage occurence due to the disclosure of certain data, quantification of damage, as well as to point out the exact data for which an applicant requests protection, etc.;
• Request submission – the Instruction provides insight into the procedure for submitting a request for data protection, the Commission’s actions after the receipt of a request for data protection as well as steps in the course of rendering a decision.

We can conclude that the purpose which shall be achieved by data protection in the proceedings before the Commission, pursuant to the provisions of the Law and the Instruction, implies that data to be protected shall not be made public, i.e. protected data shall be omitted from decisions and acts of the Commission that are made public, and thus protected data cannot be reviewed or to copied in the course of inspection of case files, regardless of whether such data are in hard copy or electronic form, in Serbian or foreign language.

The Appendix to the Instruction also includes the Data Protection Request Form, which is submitted to the Commission in procedure of protection of data, whereas we would like to emphasize that the Form contains certain guidelines which could be useful to applicants when filling out the Form and submitting it to the Commission.

By Ivana Ruzicic, Managing Partner and Sara Ostojic, Senior Associate, PR Legal