BELGRADE, November 26, 2025 – Partners Serbia expresses serious concern regarding the Draft Law on Data Exchange in Cases of Temporary Incapacity for Work through the software solution “e-Sick Leave – Employer.” Although the law is presented as a step toward modernization and administrative simplification, its content indicates excessive centralization of sensitive data, unclear privacy safeguards, and a risk of undermining employees’ rights.

The Draft Law designates the Office for IT and eGovernment as the controller of sensitive health data, without clear limitations, defined retention periods, or a mandatory data protection impact assessment. In practice, this means that hundreds of thousands of sick leave reports, employees’ personal information, and details about their health conditions would pass through a single centralized system whose technical and security guarantees have not been explained.

Particularly concerning is the provision enabling the automatic issuance of reports on temporary incapacity for work—without assessment by the selected physician—in situations where the employee fails to appear for a medical examination or at the end of the month. This opens the door to incorrect, unfounded, or arbitrary decisions that directly affect employees’ rights, while no mechanisms exist for the rapid and effective correction of algorithmic errors. Such solutions do not represent progress; rather, they risk degrading health and labor rights.

The Draft Law also enables broad inter-institutional data exchange with other registries, yet without clearly defining the scope of data, technical constraints, or protective mechanisms. In a country where public administration information systems have repeatedly faced incidents and data breaches, this level of imprecision is unacceptable and poses a significant risk of abuse.

Furthermore, the fact that use of the system will be mandatory for all employers as of 2026 disregards the reality of the limited technical capacities of small businesses and entrepreneurs, who may face penalties not due to violations of the law, but due to the inability to meet the system’s technical and digital requirements.

Partners Serbia calls on the Ministry of Health and other competent authorities to withdraw this proposal from the legislative procedure and develop an entirely new version of the law—one that includes a mandatory data protection impact assessment, a public consultation process involving professional associations, civil society organizations, and independent oversight institutions, as well as the introduction of clear, stricter, and verifiable safeguards for data protection and employees’ rights. The digitalization of healthcare processes must strengthen the system, not increase risks for citizens.