Makes high-risk automated decisions, in Albania

Law No. 124/2024, Arts. 12-19, 21 (rights of the data subject) · Read the law's page

• Tell a data subject, in concise and plain language and with particular care where the information is addressed to a minor, your identity and contact details, the purposes and legal basis of processing, the recipients, any transfer abroad, the retention period, and the rights available to them.
• Answer a data subject's request under Articles 13 to 20 as soon as possible and no later than 30 days after receiving it, extendable to 60 days for complex or numerous requests, and free of charge unless the request is manifestly unfounded or excessive.
• Give a data subject access to their personal data, its purpose, retention period, source, and recipients within 30 days of the request, and correct or erase inaccurate, unlawfully processed, or no longer necessary personal data within 30 days, telling every recipient the data were disclosed to of the change.
• Provide a data subject their personal data in a structured, commonly used, machine readable format on request, and transmit it directly to another controller where technically feasible.
• Stop processing a data subject's personal data for direct marketing, including related profiling, as soon as they object, without requiring a reason, and tell them of this right explicitly and separately at the first communication.

Law No. 124/2024, art. 20 (automated individual decisions) · Read the law's page

• Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly serious effects, unless a listed exception applies, and where an exception does apply, let them obtain human intervention, express their view, and contest the decision.