Processes personal data, in Kosovo

Law No. 06/L-082 on Protection of Personal Data (Albanian: Ligji Nr. 06/L-082 per Mbrojtjen e te Dhenave Personale), arts. 1-6, 10, 23-32, 35-43, 73, 75-90 (general provisions, lawful basis, controller and processor obligations, DPIA, the Data Protection Officer, direct marketing lawful basis, and other sector-specific processing rules) · Read the law's page

• Establish a lawful basis under Article 5 before processing personal data of a person in Kosovo, and apply the Article 4 principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability throughout.
• Appoint a registered representative in Kosovo if you are a controller or processor not established there but use automatic or other equipment in Kosovo to process personal data, unless that equipment is used only for transit through Kosovo.
• Apply data protection by design and by default, keep a written record of your processing activities unless you employ fewer than two hundred and fifty people and none of the high-risk, non-occasional or special-category exceptions apply, and cooperate with the Agency for Information and Privacy on request.
• Carry out a data protection impact assessment before high-risk processing such as systematic automated evaluation with legal effects, large-scale special-category processing, or large-scale systematic monitoring of a publicly accessible area, and consult the Agency first where the assessment shows a risk you cannot mitigate.
• Appoint a Data Protection Officer if you are a public authority, or if your core activities require regular and systematic large-scale monitoring of data subjects or large-scale processing of special categories of data or criminal-offence data, and publish that officer's contact details to the Agency.
• Put appropriate technical and organisational security measures in place, proportionate to the risk, before and during processing.
• Use personal data collected from public sources for direct marketing only as Article 73 allows, limited to name, address, telephone number and email address unless the data subject has separately consented, and obtain written consent before using sensitive personal data for marketing.

Law No. 06/L-082 on Protection of Personal Data, arts. 11-20, 22, 74 (rights of the data subject) · Read the law's page

• Answer an access, rectification, erasure, restriction, portability or objection request within one month of receipt, extendable by two further months for complex or numerous requests, and tell the data subject about any extension within the first month.
• Tell a data subject, at the point you collect or first obtain their personal data, your identity, the purposes and legal basis of processing, the recipients, any transfer to a third country, the storage period, and their rights, within one month where the data came from elsewhere.
• Give a data subject a copy of their personal data on request, along with the purposes, categories, recipients, storage period and other Article 14 information, free of charge for the first copy.
• Correct inaccurate or incomplete personal data on request without undue delay.
• Erase personal data on request without undue delay where it is no longer necessary, consent is withdrawn with no other lawful basis, the data subject objects with no overriding ground, it was processed unlawfully, a legal obligation requires erasure, or it was collected under the child information-society-service consent rule.
• Restrict processing on request while accuracy is contested, in place of erasure where the data subject prefers restriction, where you no longer need the data but the data subject does for legal claims, or while an objection is being verified, and tell the data subject before lifting the restriction.
• Pass on any rectification, erasure or restriction to every recipient the data were disclosed to, unless that is impossible or disproportionately difficult, and tell the data subject who those recipients are on request.
• Give a data subject their data in a structured, commonly used, machine-readable format and transmit it to another controller on request where processing rests on consent or a contract and is automated.
• Stop processing personal data for direct marketing, including related profiling, as soon as a data subject objects, and bring that right to their attention explicitly and separately no later than the first communication with them.
• Where you rely on Article 74's specific direct-marketing procedure, stop the marketing use within eight days of receiving a written objection and confirm that in writing to the data subject within a further five days.

Law No. 06/L-082 on Protection of Personal Data, arts. 33-34 (personal data breach notification) · Read the law's page

• Notify the Agency for Information and Privacy of a personal data breach without delay and, where feasible, no later than seventy-two hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
• Give reasons for the delay if notifying the Agency after that seventy-two-hour period.
• As a data processor, notify the data controller without undue delay after becoming aware of a personal data breach.
• Communicate a personal data breach to the affected data subject without undue delay where the breach is likely to result in a high risk to their rights and freedoms, unless an Article 34(3) exception applies.
• Describe in the Agency notification the nature of the breach, the categories and approximate number of data subjects and records affected where possible, a contact point, the likely consequences, and the measures taken or proposed, supplying information in phases without undue further delay where it cannot all be given at once.
• Document every personal data breach, its facts, effects and remedial action, so the Agency can verify your compliance.

Law No. 06/L-082 on Protection of Personal Data, arts. 44-51 (transfer of personal data to other states and international organisations) · Read the law's page

• Before transferring personal data to another state or an international organisation, confirm the destination is on the Agency's adequacy list, or ensure the transfer meets one of Article 49's other bases, such as the data subject's informed consent or the controller's own adequate safeguards.
• Where you rely on Article 49, keep a record of the transfer authorisation as part of your Article 29 processing register.
• Do not disclose or transfer personal data in response to a foreign court judgment or administrative decision unless an international agreement between that state and Kosovo authorises recognition or enforcement of the request.
• Expect the Agency's adequacy assessment to weigh the destination's rule of law and human rights record, the existence of an effective independent supervisory authority, its international commitments, and whether data subjects there have effective, enforceable rights and redress.
• Expect the Agency to review its adequacy list at least every four years, and to amend or suspend a listing without retroactive effect if a state or organisation stops ensuring an adequate level of protection.

Law No. 06/L-082 on Protection of Personal Data, arts. 52-72, 91-107 (remedies, the supervisory Agency, inspections, and administrative and criminal penalties) · Read the law's page

• Expect a data subject to be able to complain to the Agency for Information and Privacy that your processing breaches this law, and to pursue judicial remedy against you, against the Agency's decision, or against the Agency's failure to act within three months.
• Expect a representative body, organisation or non-profit association active in data protection to be able to lodge a complaint, pursue judicial remedy, or claim compensation on a data subject's behalf.
• Expect joint and several liability with every other controller or processor involved in the same processing for compensating a person's material or non-material damage from a breach of this law, unless you prove you bear no responsibility for it.
• Cooperate with an Agency inspection, including giving inspection officers access to documentation, computers, equipment and premises relevant to personal data processing.
• Comply with a corrective order an inspection officer issues, which can require correcting irregularities, destroying, blocking or anonymising personal data, temporarily halting unlawful processing, or fulfilling a data subject's rights request.
• Expect an administrative fine set according to the nature, gravity and duration of a violation, whether it was intentional or negligent, the categories of data affected, and your degree of cooperation with the Agency, ranging up to forty thousand euros for a general violation or, for a serious and large-scale violation by a company, up to four percent of your total annual worldwide turnover.
• Expect the total fine for several violations arising from the same or related processing to be capped at double the highest single fine this law sets.
• Expect criminal liability under the Criminal Code of the Republic of Kosovo on top of any administrative fine, since Article 106 preserves it separately.

Law No. 06/L-082 on Protection of Personal Data, arts. 7-9 (special categories, children and criminal-offence data) · Read the law's page

• Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or data about sex life or sexual orientation, unless a listed Article 8(2) exception applies, most commonly the data subject's explicit consent.
• Where you rely on an Article 8(2) exception, protect special categories of personal data with heightened, classified safeguards against unauthorised access and use.
• Confine any processing of personal data about a person's criminal convictions or offences, or related security measures, to what an official authority controls under the relevant law.
• Treat sixteen as the age at which a child may consent to an information-society service directly, and obtain or verify consent or authorisation from a parent or holder of parental responsibility below that age, making reasonable and ongoing efforts, using available technology, to confirm that consent when the child is between fourteen and sixteen.
• Treat an identifier your system derives from a photograph or video of a person in Kosovo, such as a faceprint, as covered biometric data under Article 3(1)(20); the definition names visual images and fingerprint, iris, retina, facial-feature and DNA data as examples and excludes nothing that is recording-derived.