General Provisions
This law aims to
- To protect individuals' fundamental rights and freedoms, focusing on the privacy and security of personal data.
- To establish rules for the compliance and enforcement of the law for both Albanian and foreign companies operating in Albanian territory.
- To cover all forms of personal data processing, both automated and manual.
Law It also outlines the limits of territorial and substantive application, including entities operating in Albania and those providing services to Albanian citizens from abroad.
Processing of Personal Data
The main processing principles include:
- Legality, justice, and transparency: Processing must be lawful and understandable to the data subjects. This means that individuals must be clearly informed about the purpose of collecting and processing their data.
- Data minimization: Only the data necessary for the purpose of processing is collected. For example, a business cannot collect personal data that is unnecessary for the services it offers.
- Storage limit: Data is retained only as long as necessary and is deleted as soon as the purpose for which it was collected is fulfilled.
- Security: Technical and organizational measures are necessary to prevent the loss or misuse of data.
Rights of Data Subjects
The law empowers citizens by granting them the following rights:
- The right to information: Data subjects must be clearly informed about the purpose and processing activities. This includes information on the retention period, potential recipients, and security measures.
- The right to correction and deletion: Individuals can request the correction of inaccurate data or the deletion of data when it is no longer necessary.
- The right to protest: Data subjects may refuse data processing for marketing or profiling purposes, thereby safeguarding their privacy.
- Data portability: An individual has the right to transfer his data from one controller to another.
Obligations of the Controller and Processor
Data controllers and processors must:
- Ensure technical measures: For example, by implementing encryption and pseudonymization to protect data from unauthorized access.
- They adhere to the principles of protection in design and implementation: From the planning phase of systems, measures must be taken to ensure data protection.
- Cooperate with regulatory authorities: Inspectors must be available to the Commissioner to provide necessary information or access.
International Data Transfer
Personal data may be transferred outside Albania only if:
- Necessary protection is guaranteed: The host country must offer a level of protection that is equal to or higher.
- Standard clauses are used: Standard agreements approved by the Commissioner enable the secure transfer of data to other countries.
- The law in force is respected: The transfer must comply with national and international regulations.
Commissioner and Supervision
Commissioner for the Right to Information and Protection of Personal Data is the main institution that:
- Monitors the enforcement of the law: Conducts inspections and assessments of compliance with legal provisions.
- Handles complaints: Individuals may file a complaint about the misuse of data.
- Educates the public: Informational campaigns are organized to raise awareness about individuals' rights and organizations' obligations.
Administrative Offenses
Violations of the provisions of the law are punishable by:
- Heavy fines: Financial measures that can significantly affect businesses or institutions.
- Corrective measures: The Commissioner may order the cessation of illegal activities and impose specific remedies.
Final Provisions
This law comes into force by replacing the previous provisions and providing a comprehensive legal framework for the protection of personal data in Albania. It represents a crucial step in harmonizing Albanian legislation with the EU General Data Protection Regulation (General Data Protection Regulation).
Key Benefits
- Citizens: They take full control of their personal data and are better protected from misuse.
- Businesses: They are required to increase transparency and security in data processing, minimizing the risk of breaches.
- European integration: Harmonization with EU standards increases credibility and accelerates the country's integration process.
For any questions or concerns regarding the enforcement of the law, you may contact the Commissioner for the Right to Information and Protection of Personal Data.