LEGAL CERTAINTY OF ELECTRONIC SIGNATURE SYSTEM CALLED INTO QUESTION DUE TO LACK OF SUPERVISORY ENFORCEMENT

SARAJEVO, JUNE 23 /SRNA/ - There are serious indications that the supervisory measures prescribed by the Law on Electronic Signature of BiH are not being fully implemented, which calls into question the legal certainty of the electronic signature system, warned Deputy Minister of Transport and Communications in the Council of Ministers, Ognjen Janjić.

He pointed out that the failure to implement supervisory measures particularly relates to the verification of the legal conditions for the operation of certification authorities and the enforcement of binding decisions of competent regulatory and judicial bodies.

"Such conduct creates a serious institutional risk, calls into question the legal certainty of the electronic signature system, and undermines public and business confidence in the digital infrastructure," Janjić told SRNA.

He stressed that the Office for Supervision and Accreditation of Certification Authorities within the Ministry of Transport and Communications was obliged to determine whether all legal requirements for the operation of certain certification authorities had been met, particularly after the decision of the Personal Data Protection Agency of BiH from July 2024 and the final rulings of the Court of BiH from November last year.

"Instead, we are witnessing a lack of adequate supervisory activities and the ignoring of relevant decisions of competent institutions," Janjić stated.

He stressed that such conduct raises serious questions of institutional and potentially legal responsibility for all those who were obliged to act in accordance with the law.

"As Deputy Minister, I have officially warned the minister and the relevant structures about serious legal and institutional problems in the work of the Office for Supervision and Accreditation of Certification Authorities, as well as shortcomings in the functioning of the electronic identity system and trust services in BiH," Janjić said.

He said that he had particularly pointed out that certain activities are continuing despite clear decisions of the Personal Data Protection Agency of BiH and final rulings of the Court of BiH, which confirmed the limits of the competence of individual institutions, as well as the obligation to consistently apply the law in the field of personal data processing and issuance of electronic identities.

He once again called for the urgent alignment of all activities with final court decisions and applicable legal regulations.

"Distorting facts, misleading the public, and continuing to ignore regulatory and judicial acts may produce long-term consequences for the functioning of institutions, legal uncertainty for citizens, and a disrupted legal order in BiH," Janjić stated.

He said that the rule of law cannot be a matter of arbitrary interpretation, but an obligation of all institutions and public office holders.

The Personal Data Protection Agency of BiH issued two decisions prohibiting the Agency for Identification Documents, Registers and Data Exchange /IDDEEA/ of BiH and the Indirect Taxation Authority /ITA/ of BiH from processing personal data for the purpose of issuing qualified electronic certificates for electronic signatures, with an exception for IDDEEA in procedures related to digital signing in the field of identification documents.

The prohibition on issuing electronic signatures remotely was introduced due to the absence of a legal basis for the processing and storage of personal data on the server systems of these institutions.

The Director of the Personal Data Protection Agency of BiH, Dragoljub Reljić, previously said that this agency is the only authority competent to supervise the processing of personal data across all data controllers.