Badnjević ignores BiH Court ruling: IDDEEA collects citizens' electronic signatures 'remotely' without legal basis

(Patria) - Representatives of the BiH Agency for Identification Documents, Records and Data Exchange (IDDEEA) and the Ministry of Internal Affairs of Sarajevo Canton last week presented the eDokumenti - CIPS service, through which citizens of Sarajevo Canton can now obtain CIPS certificates electronically, provided they have a valid electronic signature deposited with IDDEEA.

A few days before this event, which was promoted as an important step towards digitalization of processes and modernization of public administration, the Appellate Panel of the Court of Bosnia and Herzegovina issued a ruling rejecting IDDEEA's lawsuit against the Decision of the Personal Data Protection Agency of BiH.

This Decision had previously prohibited IDDEEA from assigning electronic identity to citizens without a legal basis, and ordered them to delete the personal data of BiH citizens collected during the testing phase of the citizen electronic identity system, writes Istraga.ba.

Despite the aforementioned court ruling and the prohibition issued by the Personal Data Protection Agency, IDDEEA has continued to develop e-services within which it collects citizens' electronic signatures.

IDDEEA Director Almir Badnjević claims that the prohibition does not apply to the eDokumenti service because, as he says, "electronic identity and qualified electronic signature have nothing to do with each other".

- Namely, out of "ignorance" and "lack of knowledge" of the subject matter, these gentlemen have also included the story of electronic signatures, which was abolished in July 2024, into this electronic identity issue, which is not mentioned anywhere in the decision of the AZLP Agency or the Court of BiH.

Electronic identity and qualified electronic signature have nothing to do with each other. The Ministry of Communications and Transport of BiH has exclusive jurisdiction over electronic signatures - claims Badnjević.

However, it is evident from the ruling of the Court of BiH that, contrary to Badnjević's claims, the electronic signature is mentioned in the largest part of the ruling. As confirmed by the ruling of the Appellate Panel of the Court of BiH of November 28, IDDEEA established a system and processed data in the testing phase that are not prescribed by law, and this system also includes citizens' electronic signatures.

"Namely, the Law on Electronic Signatures does not recognize the terms 'remote signature' or 'cloud signature', nor does the said law regulate the processing of personal data, so the Agency has no legal basis to issue cloud signatures or remote signatures, given that it is legally authorized to issue qualified digital signatures which are an integral part of the personal identity card.

Therefore, the electronic identity system is not prescribed, so neither 'remote signature' nor 'cloud signature' is regulated, and the Law on IDDEEA of BiH does not prescribe this system either", states the ruling of the Court of BiH.



The terms "remote electronic signature" and "cloud signature" refer to how the electronic signature is technically created and stored.

In the case of a "remote" or "cloud" signature, the certificate and private key are not located on the citizen's computer or USB token, but are stored on the servers of the authorized service provider. Citizens sign documents remotely, usually with two-factor authentication (password and SMS code, mobile application, biometrics).

In the case of the IDDEEA agency, the Court of BiH panel emphasized that IDDEEA has not implemented a solution for the so-called cloud signature, and that it "exclusively has established systems for issuing electronic signatures based on qualified certificates".

Electronic processing of data in a different way and without a legal basis, according to the assessment of the Appellate Panel, "opens up the possibility of misuse of citizens' personal data".

"Since the legal basis for processing personal data is Article 18 of the Law on Electronic Signatures, personal data protection is prescribed in such a way that the certifier can only use personal data that is directly necessary from the person concerned or with their consent from a third party, the plaintiff did not have a legal basis for electronic processing of data in a different way", concluded the Council members.

Based on court and administrative decisions, it is clear that IDDEEA currently has no legal basis to collect and deposit remote electronic signatures from citizens.

Nevertheless, Director Badnjević has decided to ignore the court ruling and exploit a legal vacuum of sorts to establish a system for electronic issuance of CIPS, and these days he is tirelessly opening offices for the activation of electronic signatures in cities across BiH.

Novo Sarajevo, Doboj Jug, Usora, Čitluk, Bihać, Brčko are some of the places where IDDEEA registration offices for the activation of qualified electronic signatures have already been established.

Nearly five million euros are planned for expenditure solely on projects for the modernization of the document personalization center, network infrastructure, and equipment for personalization and software integration.

Istraga contacted several cybersecurity experts who assessed that opening local offices for electronic signatures without the prior establishment of adequate security systems poses a serious risk of possible hacker attacks and theft and misuse of citizens' data.

Namely, local IT systems often have insecure networks that are vulnerable to attacks, and the issue of the training of RA office employees to respond to potential security incidents also arises.

Instead of responding to specific legal and security dilemmas, Director of IDDEEA Almir Badnjević is trying to turn the numerous criticisms he has received lately into a political problem, accusing those who point out the shortcomings of the existing system of attempting to undermine the jurisdiction of the state agency.

Political interests regarding the work of IDDEEA certainly exist, and not only in Republika Srpska, where the current government routinely obstructs everything that carries the state prefix, but also in the Federation of BiH.

Digital transformation and "public administration revolution" is a priority project of the Minister of Communications and Transport Edin Forto, who insists on its swift implementation, and there is no doubt that Our Party will use this segment as one of the key arguments for the success of its political representatives in the upcoming election year.

Although the European Commission, in its 2025 Enlargement Report, stated that there had been no progress in BiH in the area of digital transformation, Forto and Badnjević claim that "such an assessment does not reflect the actual situation" and that Bosnia and Herzegovina has a digital infrastructure that "operates according to EU standards".

The question is not whether digitalization should be implemented, but whether it will be implemented legally, securely, and in the interest of citizens, or whether the price of an accelerated "revolution" will be paid by those whose data is being collected in the legal and security gray zone.