Status date: 5 September 2026. Status: In process (draft/bill). Instrument: Predlog zakona o potvrđivanju Protokola o izmjenama Sporazuma između strana Konvencije o policijskoj saradnji u Jugoistočnoj Evropi o automatizovanoj razmjeni DNK podataka, daktiloskopskih podataka i podataka o registraciji vozila — EPA 1184 XXVIII, filed with the Skupština on 4 September 2026. The instrument it amends is the Agreement confirmed in Službeni list CG — Međunarodni ugovori 11/2019.
A bill whose title runs to three lines about automated exchange of DNA, dactyloscopic and vehicle registration data reads, at first glance, as though the exchange starts now. It does not. If you hold a residence file here, or your car carries Montenegrin plates, the date that matters passed six years ago. Below is the chain, then what this bill genuinely adds, and last the part we cannot show you today.
What the text says
Three instruments sit on top of each other. The Agreement, together with its Implementing Agreement, was signed in Vienna on 13 September 2018 and published in Službeni list CG — Međunarodni ugovori 11/2019. The Ministry of Foreign Affairs notice of 11 August 2020 then fixes the date in one sentence: the Agreement "enters into force for Montenegro on 14 September 2020". That notice sits at number 27 of Međunarodni ugovori 7/2020.
The instrument now before parliament is a third layer: the Protocol that Montenegro signed in Podgorica on 8 February 2022. It inserts two paragraphs, both of them about the legal frame around data protection rather than about the data.
Article 1 adds a second paragraph to Article 12 of the Agreement. Article 12 as it stands obliges each Party to ensure, in its national legislation, a level of protection for personal data supplied under the Agreement that is "essentially equivalent to the principles and standards enshrined in Directive (EU) 2016/680" and the relevant Council of Europe Convention. The new paragraph draws a boundary around that promise: "This Agreement is not meant to certify whether or not a third country to the European Union ensures an adequate level of data protection according to EU legislation and, in particular, within the meaning of the Directive (EU) 2016/680."
Article 2 adds a third paragraph to Article 22: Parties which are members of the European Union shall, in their mutual relations, apply the rules of the European Union so far as EU rules govern the subject concerned. The Protocol's own preamble states the purpose plainly — to clarify the primacy of EU law for EU members and the point that adequacy decisions on the data protection level in third states are for the European Commission alone.
| Instrument | Gazette | Date | What it does |
|---|---|---|---|
| PCC SEE Convention | Sl. list CG 1/2008, no. 2 | 2008 | The regional police cooperation frame |
| Agreement and Implementing Agreement | Sl. list CG - MU 11/2019, no. 53 | Signed 13 September 2018, Vienna | Automated exchange of DNA, dactyloscopic and vehicle registration data |
| Entry-into-force notice | Sl. list CG - MU 7/2020, no. 27 | 14 September 2020 for Montenegro | Fixes the date the Agreement binds Montenegro |
| Protocol (ratification bill) | EPA 1184 XXVIII | Signed 8 February 2022, ratification pending | One paragraph each into Articles 12 and 22 |
What the text does not say
The bill says nothing about which data categories are actually flowing today. Article 21 of the Agreement puts a gate in front of that: the evaluation "must be carried out before starting the data exchange", and it is carried out with respect to the data categories for which exchange has started among the Parties concerned. Article 23(2) points the same way, since a Party becomes entitled to apply the Agreement towards other Parties once a positive evaluation has been made. Where Montenegro stands in that evaluation, category by category, we cannot show from a written source today.
The Protocol's own commencement is open as well. Article 4(1) requires ratification by all Parties to the Agreement as of the date of signature, and then sixty days from the deposit of the last instrument, so one slow Party holds the whole thing. Article 4(2) opens a side door: a Party may declare that it will apply Articles 1 and 2 provisionally until the Protocol enters into force. We saw no such declaration by Montenegro in the bill. The deposit record is kept by the Depositary, and under Article 24 of the Agreement the Depositary is the Republic of Serbia; we did not open that register in this run.
The reading we work with
We read this as a boundary-drawing exercise rather than a change in surveillance. The new paragraph does not withdraw the Article 12 promise of essentially equivalent protection; it says that promise is not to be treated as an EU adequacy finding. Montenegro remains a third country for EU data protection purposes, and the basis for a flow to or from an EU-member Party stays what it was: the Agreement's own rules and the national law of the Party concerned.
The provisions that are useful to you personally are already in force, and most readers have never been told about them. Article 18 gives the data subject, on proof of identity, information about the data processed on them, the origin of the data, the recipient and the intended purpose, together with the right to have inaccurate data corrected and unlawfully processed data deleted. The same article names an effective complaint to an independent court or tribunal within the meaning of Article 6(1) of the European Convention on Human Rights, or to an independent data protection authority, and the possibility of claiming damages. Article 17(5) is blunter still: anyone can ask those authorities to check the lawfulness of the processing of data concerning their person. Logs are kept for two years and the results of such checks for eighteen months; where a data protection authority asks for the logs, the recording body has at most four weeks.
So the practical point is not to wait for this bill. The clocks are already running and the request route is open today.
What did not change
The scope of the Agreement is untouched: DNA data, dactyloscopic data and vehicle registration data, plus the subsequent personal and case-related data exchanged in the event of a hit. The purpose limitation in Article 13 stands, so data may be processed only for the purposes for which they were supplied, and any other purpose needs the prior authorisation of the Party administering the file. The technical detail stays in the Implementing Agreement and the user manuals. The list of Parties is the same: Albania, Austria, Bulgaria, Hungary, Moldova, Montenegro, North Macedonia, Romania and Serbia. No reservations may be made to the Protocol, which Article 3(5) states in terms.
How to verify
The full text of the bill sits on the Skupština's act page: zakoni.skupstina.me/zakoni/web/app.php/akt/4357. The lines to find are the phrase "potpisan od strane Crne Gore u Podgorici, 8. februara 2022" in Article 1 of the law, and Articles 1 and 2 of the English original of the Protocol. For the commencement date, the Ministry of Foreign Affairs notice is at sluzbenilist.me/propisi/292873, where the sentence to look for is "stupa na snagu za Crnu Goru 14. septembra 2020. godine". The Agreement itself, Articles 12, 17, 18, 21 and 22 included, is in Međunarodni ugovori 11/2019.
For readers with a residence file open here, or a car on Montenegrin plates, this heading belongs to the same family as our note on crypto-asset user reporting: both are about which of your data travels to which authority, through which channel. If you want to look at the data side of your own file, our Montenegro residence permit page is the way to reach us, and we will follow this bill through parliament on our Legal Updates page.
