Decision on the Conditions and Procedures for Accessing and Using Confidential Statistical Data of the Central Bank of Bosnia and Herzegovina for Scientific Purposes

Based on Article 7, points b) and n), and Article 68, paragraphs 2 and 3 of the Law on the Central Bank of Bosnia and Herzegovina ("Official Gazette of BiH", nos. 1/97, 29/02, 8/03, 13/03, 14/03, 9/05, 76/06 and 32/07), the Governing Board of the Central Bank of Bosnia and Herzegovina, at its 4th session held on April 27, 2026, adopts

DECISION ON THE CONDITIONS AND PROCEDURES FOR ACCESSING AND USING CONFIDENTIAL STATISTICAL DATA OF THE CENTRAL BANK OF BOSNIA AND HERZEGOVINA FOR SCIENTIFIC PURPOSES

PART ONE – GENERAL PROVISIONS

Article 1. (Subject of the Decision) This Decision establishes the conditions and procedures under which access to and use of confidential statistical data generated by the organizational unit responsible for statistical affairs of the Central Office of the Central Bank of Bosnia and Herzegovina (hereinafter: organizational unit for statistics and Central Bank) for scientific purposes may be granted.

Article 2. (Purpose of the Decision) The purpose of adopting this Decision is to enable scientists conducting statistical analyses to access confidential statistical data that only allow indirect identification of statistical units, in accordance with Article 23 of Regulation (EC) No 223/2009 of the European Parliament and of the Council of 11 March 2009 on European statistics.

Article 3. (Definitions) (1) For the purposes of this Decision, certain terms shall have the following meanings: "confidential statistical data for scientific purposes" means confidential statistical data of the Central Bank generated by the organizational unit for statistics, which only allow indirect identification of statistical units, and which may be provided to a research entity conducting statistical analyses for scientific purposes upon written request; "non-confidential data" means aggregated statistical data from which neither direct nor indirect identification of a statistical unit is possible, and which may therefore be publicly published and made available to any natural or legal person requesting such data based on the Law on Freedom of Access to Information at the level of institutions of Bosnia and Herzegovina or other regulations; "statistical unit" is the basic unit of observation, namely a natural person, household, economic entity, and other legal entities to which the data relate; "identifier" is any uniquely determined characteristic from which an individual reporting or statistical unit can be directly or indirectly recognized, relating to "direct identification" and "indirect identification"; "direct identification" is the identification of a statistical unit based on its name or address, or based on a publicly available identification number; "indirect identification" is the identification of a statistical unit based on any method other than direct identification; "secure room" is a controlled room within the Central Bank's premises where access to confidential statistical data for scientific purposes is ensured, to which only authorized officials of the organizational unit for statistics of the Central Bank determined by its head (hereinafter: official of the organizational unit for statistics), officials of the organizational unit for information technology for equipment maintenance, and a researcher from the research entity have access; "research entity" is a legal entity engaged in scientific research activities or a scientific research unit (department, etc.) within a legal entity, which must be autonomous and independent in forming scientific conclusions, separate from the operational area of the legal entity to which it belongs, and registered in the manner specified in Article 6, paragraph (4), point a) of this Decision; "researcher at the research entity" is a natural person engaged in scientific research work at the research entity and formally affiliated with it, or a doctoral student enrolled in a postgraduate university doctoral program at the research entity; "applicant" is the research entity from point h) of this paragraph requesting access to confidential statistical data for scientific purposes; "data user" is the research entity from point h) of this paragraph to which access has been granted by the Central Bank and which has accepted the data use conditions set forth in Article 16 of this Decision; "research project" is a time-bound scientific research activity conducted by researchers at the research entity, or doctoral students during their postgraduate university doctoral studies, for the purpose of preparing a doctoral thesis, which has a clearly defined scientific research purpose, research director, research collaborators (if any), statistical analysis methods, a justified need for using statistical data, a description of expected results and their publication method (articles, presentations, publications, etc.), and duration; "anonymized data" means data prepared in such a way that a statistical unit cannot be identified either directly or indirectly, taking into account all relevant means that a third party could reasonably use for its identification. (2) Terms used in this Decision that have gender-specific meanings apply equally to the masculine and feminine genders.

PART TWO – CONDITIONS FOR ACCESS AND USE OF CONFIDENTIAL STATISTICAL DATA FOR SCIENTIFIC PURPOSES

Article 4. (Conditions for Access and Use) Access to and use of confidential statistical data for scientific purposes may be granted if the entity requesting the data meets the following conditions:

• holds the status of a research entity as defined in Article 3, paragraph (1), point h) of this Decision;
• has experience in conducting research projects;
• is capable of implementing technical and organizational measures to ensure the protection of confidential statistical data.

Article 5. (Research Project) A proposal for a research project for which access to confidential statistical data is requested must contain:

• a clearly defined scientific purpose and research objectives;
• a justification for why the scientific purpose of the research project cannot be achieved using non-confidential data;
• the timeframe of the research project;
• data on the data user;
• the data sets for which access is requested and their analysis methods;
• a description of the expected results of the statistical analyses of the requested data;
• the method of publishing the research results for which confidential statistical data were used (articles, presentations, publications, etc.).

PART THREE – SUBMISSION AND RESOLUTION OF APPLICATIONS FOR USE OF CONFIDENTIAL STATISTICAL DATA FOR SCIENTIFIC PURPOSES

Article 6. (Submission of Application) (1) An application for the use of confidential statistical data for scientific purposes (hereinafter: application) and evidence of meeting the conditions for approval of the application shall be submitted in writing, on the application form provided in Annex 1 to this Decision, directly to the Central Bank, by mail to Marshal Tito Street No. 25, 71000 Sarajevo, or by email to: statistics@cbbh.ba. (2) The application must contain:

• identification data of the applicant,
• a detailed description of the research project and the scientific purpose of using the data,
• specification of the requested data (variables, period, statistical population),
• the period of use,
• research methodology,
• expected results and format of result presentation,
• data management plan and confidentiality protection measures,
• the anticipated duration of the project and the required duration of data access,
• a list of persons who will have access to the data,
• a statement accepting all provisions of this Decision, data use conditions, etc. (3) The application must contain all data from paragraph (2) of this Article, be filled out in clear printed letters, completed in full, and signed by the responsible person in the research entity (hereinafter: applicant). (4) Along with the application, the applicant is required to attach:
• proof that the legal entity is registered for conducting scientific research activities (extract from the court register or another register of a legally authorized body in Bosnia and Herzegovina, or an extract from the register of the country of incorporation for a legal entity outside Bosnia and Herzegovina showing the conduct of scientific research activities, or an extract from the register of recognized research entities of the European Commission (Eurostat) conducting statistical analyses for scientific purposes);
• the organizational chart of the applicant;
• proof that the researcher at the research entity who will have access to confidential statistical data holds the status of a scientist or master's degree holder (second cycle – master's studies, integrated studies) or Doctor of Science/Arts (third cycle – doctoral studies) at the research entity (extract from the Register of Scientists at the competent registration body in Bosnia and Herzegovina or confirmation of study status, or extract/confirmation of scientist status for scientists outside Bosnia and Herzegovina);
• a list of publications published by the entity requesting access and a list of research projects in which it participated;
• a signed Statement on the Obligation to Apply Measures for the Protection of Confidential Statistical Data at the place of access, computer system, or other medium where the confidential statistical data to be used will be stored, on the statement form provided in Annex 2 to this Decision. By this statement, the research entity and data user commit to applying minimum technical and organizational measures, which include, but are not limited to:
  • preventing the computer used for processing confidential statistical data from being connected to any public or local network (internet, LAN) during processing;
  • implementing measures to prevent unauthorized physical access to the premises and computer equipment where data are stored or processed;
  • the obligation to securely and permanently delete confidential data from all media after the end of the use period and to submit confirmation of data destruction to the Central Bank, in accordance with Article 21 of this Decision;
  • prohibition on copying, printing, or forwarding data to unauthorized third parties. (5) Evidence of meeting the conditions for approval of the application from paragraph (4) of this Article must not be older than 90 days from the date of submission of the application. (6) The applicant proposes the method of access to and use of confidential statistical data for scientific purposes in the application, and the Central Bank decides on it taking into account the detail and sensitivity of the data for which access is requested. (7) The applicant is materially and criminally liable for the accuracy of the data stated in the application.

Article 7. (Supplementation and Correction of Application) (1) An application is considered properly submitted when it is filed on the prescribed form in written form, signed by the applicant, contains all necessary data about the applicant and the subject of the application, and all evidence prescribed by this Decision is attached to it. (2) The Commission for Statistical Confidentiality referred to in Article 8 of this Decision determines whether the application is properly submitted, and in case of an improperly submitted application, invites the applicant to supplement or correct it within 15 days. (3) In the case referred to in paragraph (2) of this Article, the application shall be considered submitted on the day it is supplemented and corrected in accordance with the invitation. (4) If the applicant does not comply with the invitation from paragraph (2) of this Article, the application shall be considered withdrawn.

Article 8. (Composition, Competences, and Working Method of the Commission for Statistical Confidentiality) (1) The Commission for Statistical Confidentiality consists of five (5) voting members and a non-voting secretary who performs administrative and technical tasks for the needs of the Commission. (2) The Chairperson of the Commission is the Vice Governor responsible for the statistics sector, external debt servicing, European integration, and payment systems, and his deputy is the head of the organizational unit for statistics. (3) The Governor of the Central Bank appoints the other members of the Commission and the secretary from among officials responsible for the preparation and production of statistical data and data dissemination. (4) The Commission decides by a majority vote of all members. (5) The working method and other matters important for carrying out the tasks within the Commission's scope shall be regulated by the Rules of Procedure, which are adopted by the Commission.

Article 9. (Review of Application) (1) The Commission reviews applications in the order of their receipt and submits them to the Governor of the Central Bank with a draft decision explaining the reasons for approval or rejection of the application, in writing. (2) The draft decision from paragraph 1 of this Article, together with an assessment of the risk of identification of the statistical unit and the consequences of potential identification on the statistical unit and the Central Bank, is established within 15 days from the date of receipt of a properly submitted application. (3) The Governor reviews the draft and may invite the Commission to provide additional explanations for its proposal.

Article 10. (Decision on Application) (1) The Governor decides on the approval or rejection of the application within 15 days from the date of receipt of the proposal from Article 9 of this Decision. (2) If the Governor agrees with the Commission's proposal approving the application and with the assessment that there are no obstacles to enabling the use of confidential data for scientific purposes, the organizational unit for statistics notifies the applicant in writing and invites them to provide a Statement of Acceptance of Data Use Conditions from Article 16 of this Decision. (3) If the Governor agrees with the Commission's proposal rejecting the application and with the assessment that there are obstacles to enabling the use of confidential data for scientific purposes, the organizational unit for statistics notifies the applicant in writing, stating the reasons for rejection. (4) The acts from paragraphs (2) and (3) of this Article are not administrative acts.

Article 11. (Extension and Amendment of Approval) (1) A data user may request an extension or amendment of the approval to access confidential statistical data by submitting a reasoned application at least 30 days before the expiration of the approval. (2) The extension and amendment procedure is conducted in the manner prescribed for submitting and resolving applications.

Article 12. (Withdrawal of Application) The applicant may withdraw the application in part or in whole at any time, and must notify the Central Bank in writing thereof.

PART FOUR – METHOD OF ACCESS TO CONFIDENTIAL STATISTICAL DATA FOR SCIENTIFIC PURPOSES

Article 13. (Method of Access) The use of confidential statistical data for scientific purposes of the Central Bank may only be enabled by accessing the data in the "secure room".

Article 14. (Access to Data in the "Secure Room") (1) Access to confidential statistical data for scientific purposes in the "secure room" enables access to data from which direct identification of the statistical unit is prevented. (2) The data user accesses confidential statistical data for scientific purposes in the "secure room" exclusively on a Central Bank computer with installed statistical analysis programs and under the supervision of an official of the organizational unit for statistics. (3) The data user, while working in the secure room, is obliged to follow the instructions for working with confidential statistical data for scientific purposes, which are provided to them before the start of work by an official of the organizational unit for statistics. (4) The data user must not print or copy data, connect recording devices to external ports, connect to the internet, install or remove hardware or software, boot the system using storage media, or access the Central Bank's internal network. (5) The organizational unit for statistics, in cooperation with the organizational unit for information technology, verifies whether the confidential statistical data for scientific purposes provided to the data user in the secure room allow only indirect identification of statistical units. (6) The Central Bank delivers statistical analysis results (files) generated in the "secure room" during work with confidential statistical data for scientific purposes to the data user by email within 30 days from the date of completion of work with the data, only after verifying the results from the perspective of statistical confidentiality.

Article 15. (Data Anonymization) (1) To determine whether only indirect identification of a statistical unit is possible, all relevant means by which a third party could reasonably be used to identify the statistical unit are taken into account. (2) Standard methods for data anonymization are established within the organizational unit for statistics with expert assistance from the organizational unit for information technology.

PART FIVE – METHOD OF USE OF CONFIDENTIAL STATISTICAL DATA FOR SCIENTIFIC PURPOSES

Article 16. (Acceptance of Use Conditions) (1) If an application for the use of confidential statistical data for scientific purposes is approved, before access to the data is enabled, the data user must sign a Statement of Acceptance of Data Use Conditions, whereby they commit to:

• complying with all provisions of this Decision, accepted data use conditions, and work instructions provided before the start of work by an official of the organizational unit for statistics,
• using the data exclusively for the approved scientific purpose (Article 17),
• respecting data confidentiality and not attempting to identify statistical units (Article 18, confidentiality statement),
• applying data protection measures in accordance with good practice (Article 19),
• not transferring data to third parties (Article 20),
• destroying or returning data upon project completion (Article 21),
• enabling control of data use (Article 22),
• submitting a report on the use of confidential statistical data (Article 23). (2) If the applicant refuses to sign the statement from paragraph (1) of this Article, the application shall be considered withdrawn and access to the requested data will not be enabled. (3) The Statement of Acceptance of Data Use Conditions is submitted on the statement form provided in Annex 3 to this Decision.

Article 17. (Limitation of Purpose of Use) By signing the statement in Article 16 of this Decision, the data user commits, under material and criminal liability, to using the confidential data for scientific purposes provided for use exclusively for the scientific purpose stated in the application, and may not use them for commercial or any other purposes.

Article 18. (Confidentiality Statement) (1) A data user whose application for the use of confidential statistical data for scientific purposes has been approved is obliged, before access to the data is enabled, to sign a confidentiality statement committing to the protection and confidentiality of the data they use. (2) If the use of confidential statistical data for scientific purposes is approved to a data user, the confidentiality statement must be signed by the responsible person of the data user and every researcher at the research entity who will have access to the data. (3) The confidentiality statement is submitted on the statement form provided in Annex 4 to this Decision.

Article 19. (Application of Data Protection Measures) The data user is responsible for taking all necessary legal, administrative, technical, and organizational measures to protect the confidential statistical data for scientific purposes made available to them, particularly regarding appropriate physical security of premises and computer systems, appropriate method of storing data in the computer system (the computer on which confidential data are stored must be password-protected and kept in a locked room), appropriate method of storing portable media on which data are stored, and appropriate method of storing confidential analysis results (restricted access to the room and computer where results are located).

Article 20. (Prohibition of Transferring Data to Third Parties) The data user must not make confidential statistical data for scientific purposes provided for use available or usable to third parties in any way, including all researchers at the research entity who have not signed the Confidentiality Statement from Article 18 of this Decision.

Article 21. (Destruction or Return of Data) (1) The data user is obliged to destroy all copies of confidential statistical data to which they had access or return them to the Central Bank within 30 days from the date of:

• completion of the research project,
• expiration of the approved access period,
• revocation of approval,
• prohibition of access. (2) The data user must submit a written statement on the actions taken pursuant to paragraph (1) of this Article. (3) This statement applies to the original data provided to the data user by the Central Bank and to all subsets of the original data set.

Article 22. (Right of Control and Supervision) (1) The data user is obliged to enable Central Bank officials to carry out control and supervision over the use of data that are the subject of access. (2) Control over data use includes:

• regular verification of log files,
• verification of results before export,
• periodic announced or unannounced inspection visits,
• verification of publications and presentations of results. (3) The user is obliged to provide access to all materials and documentation necessary for control.

Article 23. (Reporting on Use) (1) After the completion of the research project, and no later than within 30 days from the date of publication or dissemination of the research results, the data user is obliged to submit to the Central Bank a report on the use of confidential statistical data, in which all links to published research results for which the data were used are specified. (2) The user is obliged to submit:

• an annual progress report on the research (if access lasts longer than one year),
• a final report upon project completion,
• notification of all publications, presentations, and other forms of dissemination of research results. (3) The final report from paragraph (2) must contain:
• a brief description of the conducted research,
• main results,
• method of data use,
• confirmation of compliance with confidentiality rules. (4) All publications resulting from the use of data must contain:
• an acknowledgment to the Central Bank that enabled access to the data,
• a statement that the data originate from the Central Bank,
• a "disclaimer" that opinions and conclusions do not necessarily represent the views of the Central Bank.

Article 24. (Duration of Data Access) (1) Access to confidential statistical data for scientific purposes may only be approved within the duration of the research project. (2) The duration of access to confidential statistical data for scientific purposes from paragraph (1) of this Article may be extended only once upon request by the data user if there are justified reasons, and the request must be submitted no later than 30 days before the expiration of the term. (3) Access to confidential statistical data for scientific purposes is approved for the period from the date of approval of the access request until the completion of the research project, or in accordance with the proposed duration of the research project stated in the application, including the extended use period from paragraph (2) of this Article.

Article 25. (Violation of Conditions for Use of Confidential Statistical Data for Scientific Purposes) (1) The Central Bank will immediately temporarily prohibit the use of confidential statistical data for scientific purposes if it learns that the data user is violating the conditions for using the subject data. (2) The Commission for Statistical Confidentiality reviews the validity of knowledge regarding the violation of conditions for using confidential data for scientific purposes and proposes further action to the Governor. (3) If the Commission determines that the knowledge regarding the violation of conditions for using confidential statistical data is true, the Central Bank will prohibit the use of confidential data for scientific purposes for a specified period or permanently and proceed in accordance with the violation provisions of this Decision.

Article 26. (Registers) (1) The organizational unit for statistics maintains a register of research entities to which access to data has been approved on the "Register of Research Entities Form" provided in Annex 5 to this Decision. (2) The registers from paragraph (1) of this Article are kept permanently to ensure transparency and the possibility of control.

Article 27. (Protection of Data Confidentiality) (1) The organizational unit for statistics, within its scope of work, is responsible for taking all necessary legal, administrative, technical, and organizational measures to protect confidential statistical data for scientific purposes to which data users access in the "secure room", particularly regarding appropriate physical security of premises and computer systems, appropriate method of storing data in the computer system, and approp