The Republic of Srpska

Yesterday, in its reaction to the statement of the Republic of Srpska Minister of the Interior, Mr Siniša Karan, the Agency for Identification Documents, Registers, and Data Exchange of Bosnia and Herzegovina (IDDEEA) did not dispute the fact that they do not have legal basis for remote issuing of electronic certificates or in a cloud, for creating ‘BIH e-identity’ and that they do not own the personal data they process. The problem is that IDDEEA abused its legal competence in a crude manner in order to provide technical support to the ministries of the interior in BIH, and went to an adventure of illegal and unreliable remote identity creation, thus calling into question the protection of personal data.  Minister Karan did not dispute the Agency’s right to issue digital certificates related to personal documents. In order to do this properly, it is necessary to create a legal basis and the only manner for these certificates to be issued is for the competent ministry of the interior to process the requests, as defined by the regulations. At the same time, it is necessary to completely harmonise the legal framework, since the Law on Digital Signature of BIH is from 2006, the Law on IDDEEA is from 2008, and the Law on ID cards is from 2012. Additionally, in the meantime, the legal regulations in the European Union have changed significantly, as well as the security standards that have not been established at the level of BIH. The manner in which IDDEEA is functioning presents a risk for the complete system of records in BIH. The Ministry of the Interior and the Republic of Srpska are not going to allow this or any of the competence to be taken away from the Republic of Srpska. IDDEEA has a role in the system of issuing personal documents and acts as a provider of technical support, and these are the roles the Agency has to continue to perform, nothing more and nothing less. Citizens can address only the ministries of the interior for these services, and every attempt to open some offices disguised as a part of digitalisation process is illegal and impossible. Every aspect of responsibility will be demanded for such attempts.